Security test policies

A security test policy is a predefined set of security tests. Users must be assigned both a server group and a test policy before they can perform security scans.

Administrators do not need to be granted explicit access to a test policy, nor do they need to be assigned to a server group. There are two types of test policies available:
Standard exclusion:
All predefined test policies, including the Complete test policy, exclude the following tests by default:

  • Outdated tests (such as old CVEs or outdated third-party tests)

  • Disruptive tests that might slow down AppScan’s performance (such as port listener tests)

  • A Simple security test policy defines tests at a high level. You can create and edit simple test policies in AppScan® Enterprise Server and assign them to server groups.
  • An Advanced security test policy defines tests at a more granular level. You can import advanced test policies from AppScan® 7.7 (or higher) and assign them to server groups, but you cannot edit their properties:
    • Application only: Includes all application level tests except invasive tests.
    • Complete: Includes all tests.
    • Default: Includes all tests except invasive tests (tests affecting server stability).
    • Developer Essentials (Deprecated): Includes a selection of application tests that have a high probability of success. This can be useful for evaluating a site when time is limited.
    • Infrastructure only: Includes all infrastructure level tests except invasive tests.
    • Invasive: Includes all invasive tests (tests that might affect the server's stability).
    • OWASP Top 10 - 2021: Includes all tests for the latest top 10 vulnerabilities categories mapped by OWASP.
    • OWASP Top 10 API Security Risks - 2023: Includes all tests for the latest top 10 API vulnerability categories mapped by OWASP.
    • Production Site: Excludes invasive tests that might damage the site, or tests that might result in Denial of Service to other users.
    • The Vital Few (Deprecated): Includes a selection of tests that have a high probability of success. This can be useful for evaluating a site when time is limited.
    • Third Party-Only: Includes all third-party level tests except invasive tests.
    • Web Services (Deprecated): Includes all SOAP related tests except invasive tests.

Deprecated test policy alternatives

What test policies can replace The Vital Few and the Developers Essentials test policies?
  • The following table provides suggested alternatives for the deprecated policies:
    Current Policy Suggested Alternatives
    Web Services Use the Default policy that now includes web services.
    The Vital Few

    Use the Default policy with the fastest Test Optimization setting.
    Developers Essentials

    Use the Application only policy with one of the faster Test Optimization settings.