Home
Managing application risk
Follow this workflow to manage application security risks in your organization.
Step 3: Determining risks and prioritizing vulnerabilities
Learn how to determine risks and prioritize vulnerabilities identified in an application.
Prioritizing Vulnerabilities
Learn how to prioritize vulnerabilities identified in an application.
Monitoring overdue issues
Security analysts can see the number of applications that have overdue issues so that they can quickly calculate which issues or applications are out of compliance. AppScan Enterprise v9.0.3 includes an Overdue formula that can be modified or used as an example for creating complex formulas. If your organization must comply with the Payment Card Industry standard, you can add that to the formula. Or modify the formula so that if an issue is still marked New after 10 days, and it has a high severity, it is automatically overdue.

Welcome
Welcome to the HCL AppScan Enterprise 10.4.0 documentation, where you can find information about how to install, maintain, and use HCL AppScan Enterprise.
Accessibility features for AppScan® Enterprise
Accessibility features assist users who have a disability, such as restricted mobility or limited vision, to use information technology content successfully.
Overview
Learn general information about the product.
Installing
Learn how to install the product.
Upgrading and migrating
Learn how to upgrade the product.
Integrating
Learn how to integrate the product with other solutions.
DevOps
Learn how to extend the product with REST APIs and plugins.
Best practices
Learn best practices for using the product.
Configuring
Learn how to configure the product.
Administering
Learn how to administer the product.
Managing application risk
Follow this workflow to manage application security risks in your organization.
- Step 1: Creating an application inventory
  Learn how to create an application inventory.
- Step 2: Testing applications for vulnerabilities
  Learn how to test vulnerabilities identified in an application.
- Step 3: Determining risks and prioritizing vulnerabilities
  Learn how to determine risks and prioritize vulnerabilities identified in an application.
  - Determining risk
    Now that management and security analysts have a comprehensive view of the applications across the enterprise, it's time to get a complete picture of the application security risk. Use formulas to create rules for automated application asset classification. The automated calculation of an application security risk rating is based on the application's description and discovered vulnerabilities.
  - Prioritizing Vulnerabilities
    Learn how to prioritize vulnerabilities identified in an application.
    - Workflow for issue triage
    - Filtering a list of security issues in an application
      When an application has many scans that discover many vulnerabilities, use filters on the preset issue attributes, such as Issue Severity, Issue Type, or Issue Status to help you reduce the list to a more manageable size.
    - Triaging issues in an application
      All issues are classified as 'new' by default. You can see an issue classification by viewing the issue status. If no issues display for an application, associate a security scan with the application. Otherwise, you must manage your issues from a report in the Scans view. If you move a scan job from one application to another, you won't lose any of your issue management changes.
    - Monitoring overdue issues
      Security analysts can see the number of applications that have overdue issues so that they can quickly calculate which issues or applications are out of compliance. AppScan Enterprise v9.0.3 includes an Overdue formula that can be modified or used as an example for creating complex formulas. If your organization must comply with the Payment Card Industry standard, you can add that to the formula. Or modify the formula so that if an issue is still marked New after 10 days, and it has a high severity, it is automatically overdue.
    - Editing multiple issues simultaneously
- Step 4: Remediating risks
  Learn how to remediate risks identified in an application.
- Step 5: Measuring progress and demonstrating compliance
  Learn how to measure progress and demonstrate compliance.
Troubleshooting and support
To help you understand, isolate, and resolve problems with your HCL® software, the troubleshooting and support information contains instructions for using the problem-determination resources that are provided with your HCL products.
Reference
Review reference information for the product.
Glossary

Monitoring overdue issues

Security analysts can see the number of applications that have overdue issues so that they can quickly calculate which issues or applications are out of compliance. AppScan Enterprise v9.0.3 includes an Overdue formula that can be modified or used as an example for creating complex formulas. If your organization must comply with the Payment Card Industry standard, you can add that to the formula. Or modify the formula so that if an issue is still marked New after 10 days, and it has a high severity, it is automatically overdue.

Before you begin

This is the Overdue formula:

IF(classification=scancoveragefindings,0,IF(status=noise,0,IF(status=passed,0,IF(status=fixed,0,AGE()-IF(severity>8.9, 3, IF(severity>6.9, 5, IF(severity>3.9, 7, IF(severity>0, 14, 100))))))))

Here's how the Overdue formula breaks down: If the issue status is noise, passed, or fixed, then the issue is not overdue. Otherwise, the formula is "issue AGE - severity mapping".

Table 1. Mapping Severity to Number of days overdue
Severity range	Value	Number of days overdue
Greater than 9.0	Critical	3
Greater than 7.0	High	5
Greater than 4.0	Medium	7
Greater than 0.1	Low	14
Less than 0.1	Information	100

If these suggested resolution times don't fit into your workflow, modify the formula in the Issue Profile Template.

About this task

Upgrade: If you created an Overdue attribute in a previous version of AppScan Enterprise, v9.0.3 appends "_1" to the name and then creates a new Overdue attribute for the formula to use.

Procedure

From the Portfolio view, sort the Overdue column in the application list in descending order, or add an Overdue=YES filter.
Apply filters to fine-tune the list, such as Max Severity=High + Business Impact=Critical Impact.
Select an application and group by Severity.
Now you can select an issue number and get more details, such as when the issue was created. This date indicates by how many days the issue is overdue for being fixed.