Security test policies

A security test policy is a predefined set of security tests. Users must be assigned both a server group and a test policy before they can perform security scans.

Administrators do not need to be granted explicit access to a test policy, nor do they need to be assigned to a server group. There are two types of test policies available:
Standard exclusion:
All predefined test policies, including the Complete test policy, exclude the following tests by default:

  • Outdated tests (such as old CVEs or outdated third-party tests)

  • Disruptive tests that might slow down AppScan’s performance (such as port listener tests)

  • A Simple security test policy defines tests at a high level. You can create and edit simple test policies in AppScan® Enterprise Server and assign them to server groups.
  • An Advanced security test policy defines tests at a more granular level. You can import advanced test policies from AppScan® 7.7 (or higher) and assign them to server groups, but you cannot edit their properties:
    • Application only: Includes all application level tests except invasive tests.
    • Complete: Includes all tests.
    • Default: Includes all tests except invasive tests (tests affecting server stability).
    • Infrastructure only: Includes all infrastructure level tests except invasive tests.
    • Invasive: Includes all invasive tests (tests that might affect the server's stability).
    • OWASP Top 10 - 2021: Includes all tests for the latest top 10 vulnerabilities categories mapped by OWASP.
    • OWASP Top 10 API Security Risks - 2023: Includes all tests for the latest top 10 API vulnerability categories mapped by OWASP.
    • Production Site: Excludes invasive tests that might damage the site, or tests that might result in Denial of Service to other users.
    • Third Party-Only: Includes all third-party level tests except invasive tests.

Removed test policies

In version 10.12.0, we removed the Vital Few and Developer Essentials pre-packaged test policies.
Important:
After the upgrade, active scan profiles that used these deleted policies change to an Unassigned status. You must assign a new test policy to these profiles before you can run scans.
  • Use these alternative policies:
    Deprecated policy Suggested alternatives
    Web Services Use the Default policy, which now includes web services.
    The Vital Few

    Use the Default policy with the fastest Test Optimization setting.
    Developers Essentials

    Use the Application only policy with a faster Test Optimization setting.