Getting started with application security management

Depending on your role, you can get started with different areas of the product.

About this task

Click here to learn how to create an application inventoryClick here to learn how to test applications for vulnerabilitiesClick here to learn how to determine risk and prioritize vulnerabilitiesClick here to learn how to remediate risksClick here to learn how to measure progress and demonstrate compliance
  • Read workflow examples to learn how you can start to work with applications: one for customers that are using AppScan Enterprise for the first time, and one for current customers who want to create applications and associate their existing scans with them. Pick the one that best suits your needs, or use parts of them as a starting point to create your own workflow. See Workflow examples for managing application security.
  • Get started with a role that closely matches your goals:
    Role Description
    System Administrator Your goals might include installing, configuring, and administering the Server, Database, and Enterprise Console.
    Security Analyst Your goals might include:
    • Audit a large number of applications and triage results
    • Monitor a large number of applications on an ongoing basis
    • Create and communicate test policies to Development and QA
    • Present application security risk reports to Management
    Management/Compliance Officer Your goals might include:
    • Assess the security risk to your organization that your web applications present
    • Identify the most problematic applications and take action
    • Assess if the security of your web applications is improving
    • Identify compliance risk related to various industry guidelines
    Application Security Champion Your goals might include:
    • Configure and run scans on the web applications assigned to you
    • Communicate the identified issues to Development for remediation
    • Assess the scan findings and verify that they are real vulnerabilities
    • Identify the most problematic applications and take action
    • Identify the types of issues that are most prevalent to create appropriate education programs
    Web Developer Your goals might include:
    • Fix issues discovered by Information Security, QA and automated build regression tests
    • Test the code that you develop (ad-hoc and as part of build regression testing)
    QA Tester Your goals might include:
    • Test applications for security issues based on policies specified by the Information Security team
    • Communicate the identified issues to Development for remediation