Home
Managing application risk
Follow this workflow to manage application security risks in your organization.
Step 3: Determining risks and prioritizing vulnerabilities
Learn how to determine risks and prioritize vulnerabilities identified in an application.
Determining risk
Now that management and security analysts have a comprehensive view of the applications across the enterprise, it's time to get a complete picture of the application security risk. Use formulas to create rules for automated application asset classification. The automated calculation of an application security risk rating is based on the application's description and discovered vulnerabilities.
Examples of Functions
These functions are used in the attribute formulas.

Managing application risk
Follow this workflow to manage application security risks in your organization.
- Step 1: Creating an application inventory
  Learn how to create an application inventory.
- Step 2: Testing applications for vulnerabilities
  Learn how to test vulnerabilities identified in an application.
- Step 3: Determining risks and prioritizing vulnerabilities
  Learn how to determine risks and prioritize vulnerabilities identified in an application.
  - Determining risk
    Now that management and security analysts have a comprehensive view of the applications across the enterprise, it's time to get a complete picture of the application security risk. Use formulas to create rules for automated application asset classification. The automated calculation of an application security risk rating is based on the application's description and discovered vulnerabilities.
    - Formula components
      Product administrators can use any of the following components in your attribute formulas.
    - Examples of Functions
      These functions are used in the attribute formulas.
    - Built-in Formulas
      Use built-in formulas as a starting point to create or customize your own formulas.
    - Customizing the risk rating formula
      The risk rating formula is the most important attribute that you use to describe your applications. Use this example to customize the built-in risk rating. In this example, the business impact is calculated automatically, based on different application attributes.
    - Creating attributes with formulas
      Create and edit attributes that contain formulas to calculate the risk ratings for applications or to display issue information in application summaries. Delete formula attributes that are no longer relevant.
    - Modifying formulas
      You can modify AppScan Enterprise's built-in formulas to customize them for your business needs. For example, the Open Issues formula includes new, open, and reopened issues in its calculations. That might not fit with your requirements, so you can modify it to only include open and reopened issues.
    - Determining issue severity
      Security analysts can use CVSS scores to determine issue severity and prioritize vulnerability fixes for their organization.
  - Prioritizing Vulnerabilities
    Learn how to prioritize vulnerabilities identified in an application.
- Step 4: Remediating risks
  Learn how to remediate risks identified in an application.
- Step 5: Measuring progress and demonstrating compliance
  Learn how to measure progress and demonstrate compliance.

Examples of Functions

These functions are used in the attribute formulas.

Note: User role: Product Administrator

COUNT

COUNT(status=open,severity=low)

This example counts the number of 'low severity' issues that are 'open'. COUNT can only be used with filters in a formula.

IF

IF(businessimpact > 2, 5,1)

This example determines that if the 'businessimpact' value is greater than 2, the value to use in the formula is 5. If 'businessimpact' is less than 2, the value to use in the formula is 1. IF can only be used with values in a formula.

MAX

MAX(severity, status=open)

This example returns the maximum of all the severities that are 'open'. MAX can be used only with filters in a formula.

Table 1. Filter option values to use with MAX
Filter option values to use with MAX
Filter	Option	Numeric value to use in formula
Classification	Definitive	1
	Suspect	2
Severity	High	4
	Medium	3
	Low	2
	Information	1
Status	Open	1
	InProgress	2
	Reopened	3
	Noise	4
	Passed	5
	Fixed	6
	New	7
Discovery Method	DAST (Dynamic Analysis)	1
	SAST (Static Analysis)	0