Customizing Values by Policies

WhiteHat Portal Administrator accounts can add or edit a risk management policy, customize or accept the business risk ratings of vulnerability classes for one or more assets. (Accepted risks will be shown as accepted and display the default WhiteHat risk rating.)

Creating a Risk Management Policy

To create a Risk Management Policy, perform the following steps:

From the main WhiteHat Portal menu, click Admin.
Select the Risk Management tab.
Click Create Policy.
Type a Policy Name in the text field provided.
Optionally, type a Description in the text field provided.
Select the Asset Type from:
- Sites & APIs
- Applications
- Mobile Applications
Optionally, type a Reason in the text field provided.
Click Next.
To Search for a Vulnerability Class type in the search bar.
Click the Risk Rating to set a custom rating.
Select the Custom Risk Rating for the vulnerability class.
Click the CVSS Score to set a custom rating.
Select the ratings for the Custom CVSS Score.
Optionally, click the Accept Risk checkbox to accept the overall vulnerability class as a business risk.

Accepting Risk is not recommended for general vulnerability classes as this includes all vulnerability subclasses.
Click Next.
Select All Groups to display all assets or, select an existing asset group.
From the Available table, select the assets that you want to include in the policy. To locate specific assets, use the Search bar at the top of the Available or Selected columns. You can also click Select All to select all available assets.
Click Save to assign the assets and create the policy.

The customized ratings are used for the assigned assets for reports and for display in the WhiteHat Portal. However, the WhiteHat Security Index and the PCI 3.2 Compliance Reports use the default WhiteHat values for the vulnerabilities.

Editing a Risk Management Policy

To edit a Risk Management Policy, perform the following steps:

From the main WhiteHat Portal menu, click Admin.
Select the Risk Management tab.
Select the Policy Name.
Click Edit Policy.
Edit the Risk Management Policy, you can edit the Policy Name, Description, the Vulnerability Customizations, or the Assigned Assets.
Click Save and Exit to finish editing.

Deleting a Risk Management Policy

To delete a Risk Management Policy all associated assets must be removed. To remove associated assets, perform the following steps:

From the main WhiteHat Portal menu, click Admin.
Select the Risk Management tab.
Select the Policy Name.
Click Edit Policy.
Click Next.
Click Next.
Click Select All.
Click the left facing arrow to move the Assets from the Selected table to the Available table.
Click Save and Exit.
Click the checkbox beside the Policy Name.
Click the Bulk Actions icon.
Select Delete Policy.
Click Confirm to delete the custom policy.