Application attributes

Application attributes are the properties of the application, and appear as column headers in the My Applications tab. You can use them to filter application lists to focus on what you want to investigate. The following table explains the predefined attributes that you can edit (Date Created and Last Updated are controlled by ASoC).

Table 1. Predefined application attributes
Attribute Name Description
Risk Rating This indicates the aggregated business risk for this application. It is based on two factors: the highest Severity level of the Open Issues in the application, and the Business Impact as defined by the user. There are four levels: Low, Medium, High, Critical. If there are no open issues, or if Business Impact is Unspecified, Risk Rating will show as Unknown.
Name Use a unique name.
Critical/High/Medium/Low Issues The aggregated severity numbers for each application. These numbers are updated whenever issues are managed or a scan is run.
Work in progress The aggregated numbers of issues that are currently being fixed for each application (that is, Status = In progress). These numbers are updated whenever the issue status is updated.
Business Unit Knowing the business unit can help you to identify if there areas of concern.

For instance, if there are several applications that belong to the same business unit, there might be a resource issue to resolve so that testing or vulnerability fixing can continue successfully.

Asset Group Identifies the asset group the app belongs to. Administrators can restrict access to specific applications by assigning them to an asset group and limiting the users who belong in the group.
Description Further identifies the application for other users to understand its significance.
Business Impact Indicates how critical this application is to your business. User controlled.
Testing Status Indicate Not Started, In Progress, or Completed in this field. This attribute appears as a summary chart and can also be filtered in the application grid.
  • When you create a scan, Testing Status for the application changes to "In Progress".
  • When you Reset an application (UI: Edit > Reset > Delete all… | API: Apps/Reset/Delete Issues), the application's Testing Status changes to "Not Started".
Last Updated This field is only updated when a user updates a value for an application attribute. The following events do not trigger the field to update:
  • scan is run
  • issues are imported
  • issues are triaged
  • formulas are changed
New/Open/Fixed/Total Issues
  • New Issues: The number of issues with issue status = New.
  • Open Issues: The number of issues that have an issue status of "New", "Open", "Reopened", "In Progress" with a severity of "Low" or higher.
  • Fixed Issues: The number of issues that have an issue status of "Fixed" with a severity of "Low" or higher.
  • Total Issues: The sum of Open Issues and Fixed Issues.
Type Use this attribute to indicate whether this application is run or viewed on the web, mobile, or desktop. You might also indicate All if the application can be viewed on all types of devices.
URL The unique URL of the web application.
Hosts The IP address or server name where the application is hosted. If necessary, enter multiple values, and separate them by commas.
Business Owner Indicates who owns responsibility overall for the successful implementation and delivery of the application.
Development Contact Indicates the developer or the team lead responsible for this application.
Tester Indicates the focal point for security testing of this application.
Collateral Damage Potential The potential for damage or theft if the application is vulnerable. (CVSS Environmental metric)
Target Distribution The proportion of systems in the environment that are potential targets. (CVSS Environmental metric)
Availability Requirement The relative importance of availability of information. (CVSS Environmental metric)
Confidentiality Requirement The relative importance of confidentiality of user information. (CVSS Environmental metric)
Integrity Requirement The relative importance of integrity, or accuracy, of information. (CVSS Environmental metric)