Customizing Values by Policies

As a Continuous Dynamic Admin, you can add or edit a risk management policy, and customize or accept the business risk ratings of vulnerability classes for one or more assets. Accepted risks are shown as "accepted" and display the default Continuous Dynamic risk rating.

Creating a Risk Management Policy

To create a risk management policy, perform the following steps:

  1. From the main Portal menu, select Admin > Risk Management.

  2. Click Create Policy.

    risk policy 1

  3. Enter a Policy Name.

    risk policy 2

  4. (Optional) Enter a Description.

  5. For Select Asset Type, select Sites & APIs.

  6. (Optional) Enter a Reason for creating the risk management policy.

  7. Click Next to proceed to the Customize step.

  8. Use the search bar to search for a Vulnerability Class.

  9. Select a Risk Rating to set a custom rating.

  10. Select the Custom Risk Rating for the vulnerability class: Critical, High, Medium, Low, or Note (informational).

    risk policy 5

  11. Select the CVSS Score to set a custom rating.

  12. Select the ratings for the Custom CVSS Score.

    risk policy 6

  13. (Optional) Select the Accept Risk checkbox to accept the overall vulnerability class as a business risk.

    Accepting risk is not recommended for general vulnerability classes because this will include all vulnerability subclasses.

  14. Click Next.

  15. Select an existing asset group from the Group dropdown, or select All Groups to display all assets.

    risk policy 7

  16. From the Available table, select the assets that you want to include in the policy. To locate specific assets, use the Search bar at the top of the Available or Selected columns. You can also click Select All to select all available assets.

  17. Click Save to assign the assets and create the risk management policy.

The customized ratings are used for the assigned assets in reports and in the Portal. However, the WhiteHat Security Index (WSI) and the PCI 3.2 Compliance Reports use the default Continuous Dynamic values for vulnerabilities.

Editing a Risk Management Policy

To edit a Risk Management Policy, perform the following steps:

  1. From the main Portal menu, select Admin > Risk Management.

    edit risk policy 1

  2. Select the Policy Name.

  3. Click Edit Policy.

    edit risk policy 2

  4. Edit the risk management policy. You can edit the Policy Name, Description, the Vulnerability Customizations, and the Assigned Assets.

    edit risk policy 3

  5. Click Save and Exit to finish editing the risk management policy.

Deleting a Risk Management Policy

Deleting a risk management policy involves first removing all associated assets. If there are no assets associated with the policy you want to delete, skip to step 8.

  1. From the main Portal menu, select Admin > Risk Management.

  2. Select the Policy Name.

  3. Click Edit Policy.

  4. Click Next to proceed to step 3. Assigned Assets.

  5. In the Selected table, click Select All.

    delete risk policy 3

  6. Click the left arrow to move the Assets from the Selected table to the Available table.

  7. Click Save and Exit.

  8. Select the checkbox beside the Policy Name that you want to delete.

  9. Select the Bulk Actions menu and then select Delete Policy.

    delete risk policy 4

  10. In the Delete Custom Policies dialog, click Confirm to delete the custom policy.

Video Tutorial - Customizing Vulnerabilities & Creating Custom Vulnerability Policies