Security Dashboard - Connection - login - logout

Mon, 01 Jan 0001 00:00:00 +0000

This documentation section provides the following information:

How to connect and login to the Security Dashboard
What sort of information is displayed in the dashboard
A simple explanation of the dashboard interface

Info

If you need to know more about how to deploy the Security Dashboard, please see: Deploy the CAST Security Dashboard.

Connecting to the Security Dashboard

To connect to the Security Dashboard, browse to the URL provided by your CAST Administrator. This will usually be in the following format:

Security Dashboard - GUI

Mon, 01 Jan 0001 00:00:00 +0000

Multiple Applications or single Application?

On login, depending on the number of Applications available, behavior is slightly different:

Number of Applications

Behavior

Single Application

You are taken direct to the Application landing page:

In versions≥ 2.11.0, outdated tiles (Data Safety, SQL Injection, XSS Command Injection, Misconfiguration) have been replaced with the updated tiles (CISQ-ISO 5055, CWE Top 25 2011-CWE Top 25 2022, OWASP 2017-OWASP 2021), and a new tile - PCI-DSS-V3.2.1 is added.

Security Dashboard - Risk Investigation

Mon, 01 Jan 0001 00:00:00 +0000

Risk Investigation view

Accessible from the sidebar menu or by clicking the Risk Model tile, this view enables investigation of the application risk from the Assessment Model perspective - moving through Health Measures/Business Criteria, Technical Criteria, Rules/Measures/Distributions right down to the objects in violation.

By default, only Business Criteria that are categorised as Health Measures will be displayed in the dashboard. All other Business Criteria that are NOT Health Measures will not be displayed. You can override this behaviour, to display ALL top-level Business Criteria if required - see Engineering Dashboard json configuration options from the CAST AIP documentation.

Security Dashboard - Application Investigation

Mon, 01 Jan 0001 00:00:00 +0000

Application Investigation view

Info

Note that the Application Investigation view is not available when viewing data from a previous snapshot.

Accessible from the sidebar menu or by clicking the Application Components tile, this view enables investigation of the objects in the Application. Data is presented in a series of tables on the left and right hand side of the page enabling you to drill down from an Application right down to an individual object within that Application, and view the Rules that those objects have violated.

Security Dashboard - Transaction Investigation

Mon, 01 Jan 0001 00:00:00 +0000

Transaction Investigation view

Accessible from the sidebar menu or by clicking an object in the Top Riskiest Transactions tile, this view enables investigation of the transactions in the Application. Data is presented in a series of tables on the left and right hand side of the page enabling you to drill down from a Transaction with a high level of risk (i.e. Violations) right down to the Violations themselves.

The view functions in a very similar way to the Risk Investigation view. The default Health Measure used for this view is Security.

Security Dashboard - Exclusions

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: This page provides instructions for managing Exclusions in the Security Dashboard.

Introduction

The Security Dashboard features the ability to Exclude objects from a future snapshot - this can be useful when the object is violating an AIP Quality Rule, but is irrelevant:

Info

Note that:

when an object is excluded, it will be excluded in the next snapshot and in all future snapshots.
using the Exclude feature will affect grades when a new snapshot is generated or when a snapshot is consolidated. This is because the violations that are excluded will not be included in the new results.
Exclusions are available when viewing data from a previous snapshot, however, the ability to edit Exclusions is only available from the most recent snapshot.

Permissions required to manage Exclusions

Feature	Permission required
To edit Exclusions - i.e. add/remove objects.	Your user login must have the EXCLUSION_MANAGER role.

Info

Notes:

Security Dashboard - Education

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: This page provides instructions for managing the Education list in the Security Dashboard.

Introduction

The Security Dashboard features the ability to add rules to an “Education list” to highlight specific issues that may not be corrected, but require tracking, monitoring. In essence the Education list:

enables an Architect or Technical Lead to identify the main issues in an Application and add related rules to the list to “educate” his team
the violations associated with the rule in the list may not necessarily be corrected because they may be too costly, however, the Architect or Technical Lead can use the list to explain to his development team the issues that exist (i.e. the violations can be shown) and how to avoid the issues in the future (i.e. by highlighting the associated rule documentation)
Rules in the Education list can be configured so that all NEW violations to the rule are automatically added to the Security Dashboard - Action Plan when the next snapshot is generated.
links to the Education list can be sent to development team members directly to “share and promote” best practices or how to adhere to specific rules.

Security Dashboard - Continuous Improvement

Mon, 01 Jan 0001 00:00:00 +0000

On this page:

Info

Summary: This page provides about the Continuous Improvement feature in the Security Dashboard.

Introduction

The Continuous Improvement feature allows you to view details/violations/statistics about the rules that have been selected for Education.

Accessing the feature

To access the feature:

From the Side Menu bar, click the following icon:

The focus will be set to the Education tab when using this icon and you will need to switch to the Improvement tab.

Security Dashboard - Report Generation

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: This page provides instructions for configuring and using the Report Generation feature.

Introduction

The Report Generation feature allows you to generate reports on the fly direct from the CAST Security Dashboard interface. Various reports can be generated, however, some require some configuration before they will work.

Info

Changing the language in reports

From ≥ 2.8, reports can be generated in the following languages:

German
Italian
Spanish
French
Chinese

To ensure that reports are generated in one of these languages, ensure that the Dashboard is localized to the chosen language using the User > Change Language menu, then generate a report. Some of the items in the generated reports will then be in the chosen language:

Security Dashboard - Search Options

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The CAST Engineering Dashboard has two search options available for use:

Basic search, providing search on items in the Assessment Model (i.e. rules) and on object names. Results are dependent on the location the search is made.
Advanced search, providing search for objects based on a list of violations. Results are not location dependent.

Each is explained below.

Basic search

Basic search is accessed from the top menu bar:

Security Dashboard - Exporting Data

Mon, 01 Jan 0001 00:00:00 +0000

Exporting data to Microsoft Excel file format

You can export data to an Excel file format if required. To export to Microsoft Excel file format, use the following icon which is available at the following levels:

Quality Investigation
- Health Measures
- Business Criteria
- Technical Criteria
- Rules, Distributions and Measures
- Violations
Application Investigation, Transaction Investigation
- Violations
Action Plan
Scheduled and Active Exclusions

When you click this icon, depending on your browser you will be prompted whether you would like to Save or Open the Excel file. The Excel file will contain the data you requested in column format:

Using the CAST Security Dashboard on Documentation - V2

Security Dashboard - Connection - login - logout

Connecting to the Security Dashboard

Security Dashboard - GUI

Multiple Applications or single Application?

Security Dashboard - Risk Investigation

Risk Investigation view

Security Dashboard - Application Investigation

Application Investigation view

Security Dashboard - Transaction Investigation

Transaction Investigation view

Security Dashboard - Exclusions

Introduction

Permissions required to manage Exclusions

Security Dashboard - Education

Introduction

Security Dashboard - Continuous Improvement

Introduction

Accessing the feature

Security Dashboard - Report Generation

Introduction

Security Dashboard - Search Options

Introduction

Basic search

Security Dashboard - Exporting Data

Exporting data to Microsoft Excel file format