Home
Managing application risk
Follow this workflow to manage application security risks in your organization.
Step 1: Creating an application inventory
Learn how to create an application inventory.
Creating an application inventory
Automated assessments are organized by application. For example, one application could be associated with a combination of several dynamic analysis and static analysis scan jobs. All scan findings are consolidated at the application level.
Creating a scan from an application
The easiest way to associate a scan to an application is to create the scan from the application. To associate an existing scan with an application, use the existing scan's Job Properties page.

Managing application risk
Follow this workflow to manage application security risks in your organization.
- Step 1: Creating an application inventory
  Learn how to create an application inventory.
  - Workflow examples for managing application security
    These workflow examples explain how you can start to manage applications: depending on whether you are using AppScan® Enterprise for the first time or you want to associate existing scans with new applications. Pick the example that best suits your needs, or use parts of examples as a starting point to create your own workflow.
  - Creating an application inventory
    Automated assessments are organized by application. For example, one application could be associated with a combination of several dynamic analysis and static analysis scan jobs. All scan findings are consolidated at the application level.
    - Application attributes
      Application attributes are the properties of the application, and appear as column headers in the main Application view. You can use them to filter application lists to focus on what you want to investigate. The following table explains the predefined attributes that you can edit (Date Created and Last Updated are controlled by AppScan Enterprise). If your administrator created customized attributes for your application or removed attributes that are not relevant, they do not appear in this help topic.
    - Creating an application profile template
      Security Analysts can create customized attributes for the application profile template. These customized attributes are used whenever a new application is created.
    - Creating an application
      Create an application and associate scans so that you can track security testing progress against the business impact on your critical web applications.
    - Importing and exporting an inventory list of applications
      Importing an inventory list of your applications can save you time by reducing redundant manual work effort. Start with a sample spreadsheet of application attributes, or merge the sample spreadsheet with your existing list. Your list of applications must be in a CSV format. Make sure that you use a spreadsheet editor, such as Microsoft™ Excel or Apache OpenOffice Calc, to edit your .csv file.
    - Creating a scan from an application
      The easiest way to associate a scan to an application is to create the scan from the application. To associate an existing scan with an application, use the existing scan's Job Properties page.
    - Associating scans with an application
      You can associate existing scan jobs with an application. A scan can be associated with only one application, but many scans can be associated with the same application. Associate existing scans with the application by selecting and adding multiple scan jobs. This method eliminates the work of associating scans individually, especially if you have many scans to work with. You can also change application associations with this method.
    - Editing multiple apps simultaneously
    - Deleting an application from your portfolio
      If you have created an application in your portfolio, you can delete it from the portfolio. When you delete an application, the contributing scans and their issues are not deleted.
  - User access control to applications
    Learn how to manage access privileges such as full, basic, or read-only access to the Standard Users and QuickScan Users granting to specific applications.
- Step 2: Testing applications for vulnerabilities
  Learn how to test vulnerabilities identified in an application.
- Step 3: Determining risks and prioritizing vulnerabilities
  Learn how to determine risks and prioritize vulnerabilities identified in an application.
- Step 4: Remediating risks
  Learn how to remediate risks identified in an application.
- Step 5: Measuring progress and demonstrating compliance
  Learn how to measure progress and demonstrate compliance.

Creating a scan from an application

The easiest way to associate a scan to an application is to create the scan from the application. To associate an existing scan with an application, use the existing scan's Job Properties page.

Procedure

Select the application from the list.
Click Create Scan and select a folder to store the scan.
From the Template list, select one of the following options:
- An import job
- A QuickScan template
- (Standard User or Administrator role only): Advanced Configuration (to create a scan from scratch)
Click Create to continue the scan configuration.
After you finish configuring the scan, run the job.
Note:
1. If a job is running and any of its internal domain has a blackout period that is scheduled, the job auto-suspend at the beginning of the blackout period and resume running when the blackout period ends.
2. If the job suspends, the agent service attempts to automatically resume the job five times.
3. When you delete a job, you also delete the data that is collected by the job. If you rerun the report packs that use the job, they do not include the old data. If you do not rerun the report packs, they retain the old data.
After the job runs, click the Application link for the job to return to the Monitor view to see the scan results and start triaging the issues that were discovered.