Multiple Applications or single Application?

On login, depending on the number of Applications available, behavior is slightly different:

This software is subject to a limited access message

If, on login, you are presented with the following message on each page in the Security Dashboard, you should contact your CAST Administrator to request that the license is updated:

There are too many authorized users to connect to your Security Dashboard.
To avoid this limitation, you can contact your CAST Project Manager to update your licensing terms and conditions.

Security Dashboard interface

This section provides a brief explanation of the interface display options that are available to you.

Application landing page or home page

The Application landing or "home" page is displayed after a successful login:

It consists of multiple tiles used to display data and information from the most recent snapshot of the selected Application:

Risk Model tile

This default tile displays "at a glance" information about the current Application status:

• the number of Violations or Critical Violations in the Application (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))
• the number of Rules in the Application that have been triggered during an analysis/snapshot (this figure includes default CAST AIP Rules and also custom rules with IDs above 1,000,000)
• the number of Critical Rules in the Application that have been triggered during an analysis/snapshot
• clicking this tile will take you directly to the Risk investigation view (this can also be accessed by clicking the  button available in the sidebar).

Tag specific tiles 

Various additional tiles are displayed as follows:

• these display the number of Violations or Critical Violations in the Application for all the rules that are tagged with a specific tag (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))
  
• Clicking on any of these tiles navigates to the Risk investigation view (this can also be accessed by clicking the  button available in the sidebar) with the specific tag selected at the top of the table - therefore filtering and displaying only rules that have this tag. "All Rules" will be selected in the Technical Criteria table and the list of rules displayed in the right hand panel are those that correspond to the selected tag.

No applicable rules

When no rules belonging to the selected tag have been triggered, the tile displays "No applicable rules":

Critical Violations / Violations

Enabling / disabling the Critical Violations filter will effect the violation count displayed in these tiles:

Technologies Overview tile

• the total number of Violations or Critical Violations in the current Application per specific technology - in other words, the total number of times a Rule or Critical Rule has been violated by an object in the Application for that specific technology (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))
• Clicking this tile will take you directly to the Risk investigation view with the corresponding technology highlighted in the technology drop down (this can also be accessed by clicking the  button available in the sidebar).
• Drill down click option is disabled if the tile displays "N/A" Violations/Critical Violations.

Risk Introduced tile

By default, this tile shows two values for the Security Health Measure:

• Added Critical Violations or Violations > The number of critical violations or violations (i.e. "risk") introduced in the current snapshot
• Removed Critical Violations or Violations > The number of critical violations or violations removed from the current snapshot

Values are a comparison between the previous and current snapshot, therefore if this is the first snapshot then there will be Added Critical Violations or Violations but no Removed Critical Violations or Violations.

Behaviour when the tile is clicked

Clicking the tile will take you directly to the Health Measure in the Risk Investigation view (see Security Dashboard - GUI for more information), however, the Risk Investigation view will only show added and removed violation information. Any Health Measure, Technical Criterion or Rule where the number of Added and/or Removed violations is 0, will not be visible. A message will reflect this:

ISO-5055 Tile

The ISO-5055 extension is supported with full functionality. The ISO-5055 tile has been added to automatically display ISO-5055 data, with full drill down capability.

Drilling down through this tile will take you to the Risk Investigation view, where the focus will be set to the ISO-5055 Assessment Model (1) showing only the ISO-5055 metrics (2):

Configuring Assessment Model drop-down

In versions ≥ 2.11.0, user can add new industry standards to the assessment model drop-down by configuring ed.json file.

Application Components tile

This default tile displays "at a glance" information about the Violation status for the current Application:

• the number of Modules present in the Application (Modules can be configured during an analysis to divide the Application into meaningful groups)
• the number of Lines of Code present in the Application
• the total number of Objects in the current Application that contain at least one violation (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))
• the total number of Violations or Critical Violations in the current Application - in other words, the total number of times a Rule or Critical Rule has been violated by an object in the Application (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))
• the total number of Rules that have been violated in the current Application (the display depends on whether only Critical Violations or ALL Violations are being displayed (see Data Filtering on Critical Violations))

Clicking this tile will take you directly to the Application investigation view (this can also be accessed by clicking the  button available in the sidebar).

Top Riskiest Transactions tile

A "Top Riskiest Transactions tile" is provided "out-of-the-box" for the Security Health Measure:

This tile provides a clickable "cloud" of transaction names  - the larger and bolder the font used to display the transaction name, the higher the TRI value (TRI or Transaction Risk Index is an indicator of the risk for transaction) has within the Security Health Measure.

Clicking a transaction name in the tile will take you directly to the parent Health Measure in the Transaction Investigation view (this can also be accessed by clicking the  button available in the sidebar):

Click to enlarge

Top Riskiest Components tiles

A "Top Riskiest Components tile" is provided "out-of-the-box" for the Security Health Measure:

This tile provides a clickable "cloud" of object names  - the larger and bolder the font used to display the name, the higher the Risk (previously known as PRI: Propagated Risk Index) value the object has within the Security Health Measure. See this table for more information about how Risk is calculated.

Clicking an object name in the tile will take you directly to the object in the Application Investigation view - for example clicking the MFJDEMUT object will show this (click to enlarge):

Top Modules with Violations or Critical Violations tile

One "Top Modules with Violations" tile is provided "out-of-the-box" for the Security Health Measure:

This tile provides a listing of the modules sorted by the number of violations / critical violations present in each module. Tile can be resized to display more or less modules. Clicking a module in the tile will take you directly to the module in the Application Investigation view. In the Application Investigation view, violated Rules are listed by their number of violations, with critical rules first (by default: ordered by number of violations):

Security Health Measure weakness/strength tiles

Two tiles listing the Strength and Weakness of the Security Health Measure, listed by Technical Criteria:

These tiles provide

• Strengths: Items displayed at the Technical Criteria that do not have any critical violations (this includes Technical Criteria that have no critical Rules or Technical Criteria that have critical rules with no violations).
  
• Weaknesses: Items displayed are the Technical Criteria considered to have at least one critical violation. The Technical Criteria are sorted from worst (top) to least bad (bottom).

Clicking a Technical Criterion in the tile will take you directly to the Technical Criterion in the Risk Investigation view:

Top Rules with increasing violations

A "Top Rules with increasing violations" tile is provided "out-of-the-box" for the Secure Coding - Input Validation technical criterion:

These tiles displays Top Rules with increasing violations: the value represents the difference (increase) in the number of violations for the Rule between the most recent and the previous snapshot. The higher the value, the larger the difference, i.e. those Rules listed at the top of the list have MORE violations since the previous snapshot.

Violation count difference is displayed on the right of a rule and a red dot is added when the rule is critical. Rules are clickable and will take you direct to the Rule in the Risk Investigation view.

Action Plan tile

A default Action Plan tile is displayed showing, initially, the total number of objects that have been added to the Action Plan list since the last snapshot was generated. Clicking the tile will take you directly to the Action Plan).

This tile can be manually re-sized (drag and drop the corners or sides of the tile) to include more information about Pending and Solved items (see the Action Plan for more information about the Pending and Solved statistics):

Exclusions tile

A default Exclusions tile is displayed showing:

• Active Exclusions > Shows the number of violations that have been added to the Exclusion list and a subsequent snapshot has been generated (therefore the violations are not part of the results of the current snapshot) - i.e. they are actively excluded.
• Scheduled Exclusions > Shows the number violations that have been added to the Exclusion list and no snapshot has yet been generated (therefore the violations still form part of the results of the current snapshot). When a snapshot is generated, exclusions in this list will move to the Active Exclusions list.

Clicking the tile will take you to the relevant Exclusion page, see Security Dashboard - Exclusions for more information.

Continuous Improvement tile

A "Continuous Improvement" tile is available out of the box:

• This tile shows the following information:
  • Removed Violations in the current snapshot
  • Added Violations in the current snapshot
• No data is shown when a previous snapshot is activated.
• Clicking the tile will take you direct to the Improvement tab, which is part of Continuous Improvement.

Configuring the landing or home page

As explained previously the landing page or home page contains a set number of "default" tiles that are delivered "out of the box". Your dashboard Administrator may chose to configure additional tiles or custom locations for the default set of tiles but you have a certain amount of freedom to set up the home page as you require:

• All tiles (custom and default) can be moved by dragging and dropping to the new location.
• Some tiles can be resized larger or smaller by dragging and dropping the bottom right hand corner of the tile. When tiles are configured (whether custom or default), they contain information that specifies their maximum and minimum size on the horizontal and vertical axes - i.e. you may find that certain tiles will not resize as you wish - this is by design.

Saving changes

Changes you make to the location or size of tiles is saved via a cookie, therefore the positions and sizes of tiles will be retained over successive sessions using the same browser. Using a different browser on the same workstation will not retain the changes to the tiles.

Resetting the home page

If you would like to reset the position and size of the tiles as they are provided to you "out of the box", you can use the Reset homepage option located in the top right hand corner:

Adding tiles as bookmarks/favorites

If you would like to monitor a specific Rule (perhaps a critical Rule with multiple violations) in your Application via a tile in the landing/home page you can do so by adding a "bookmark" or "favorite" tile which links to the item in question. To do so:

• Navigate to the item you would like to monitor. In this example we have a chosen a critical Rule that has a high number of violations.
• Ensure the item is selected, then click the star icon (highlighted below) to add the item as a bookmark or favorite on the landing/homepage:

• A message will inform you that the tile has been added:

• The tile will now be visible in the landing/home page. The number of violations will be displayed, whether the rule is critical and, where applicable, an evolution percentage will be displayed which represents how the number of violations for the Rule has evolved between the current and previous snapshots:

Changing tile colors

Each tile displayed in the landing or home page will be configured with a predefined colour. However, you can change this from your browser:

• Click the cog icon in the top right hand corner of any tile and choose the colour you require.

Changing the dashboard language display

By default, the Security Dashboard is delivered with language display set to English: all messages and text displayed in the dashboard is only displayed in English. However, it is possible to choose a specific language locale and provided that a translation of the default English text and messages has been configured (see Dashboard localization in the CAST AIP documentation), the dashboard will then display text and messages in the chosen language. To do so, click the user menu drop down and select the the Change Language option:

A popup window will then enable you to select the required language - choose the language and click Change:

The dashboard will then reset and text items will be displayed in the chosen language.

Top menu bar

A description of each numbered item is provided below:

Hi, I want to share with you my Security Dashboard. You can access it by clicking this url :
http://server:8080/CAST-Engineering/engineering/index.html#ADG/applications/101/snapshots/2/business/60017/qualityInvestigation/60013.
Regards.

Side menu bar

What information is available?

The information displayed in the Security Dashboard is derived from snapshots generated by the CAST AI Administrator and provides a detailed "engineering" level view of your set of Applications - this includes specific information about Rules and Violations.

Snapshots

All data that is displayed is taken from the most recent snapshot that has been generated for the selected Application. However, it is possible to view data from a previous snapshot if required by using the snapshot selector in the top menu:

Clicking this option will display a drop down menu where you can select the snapshot you require:

To view a previous snapshot, select it on the timeline and then click the Select Snapshot option:

The display will then update to show the data from the selected snapshot.

Returning to current snapshot

To return to the current snapshot data use the snapshot selector button on the top menu bar to select the most recent snapshot:

Data filtering on Critical Violations

By default, the Security Dashboard only shows information about Critical Violations, rather than showing data for ALL violations - this allows you to instantly see the most important flaws in the analyzed application.This data filter is controlled by the following icon in the Top Menu bar:

When in the default position showing only information about Critical Violations, the icon is colored red as shown above. When in this position, the dashboard only shows information about Critical Violations and other non-Critical Violations are ignored. For example, the Risk Model tile will display data only about Critical Violations (as specified in the black circle):

Disabling filtering on Critical Violations

If you would prefer to view all data about ALL Violations (not just Critical Violations) in your application, you can disable the filter by clicking the filter icon on the top menu:

Once the filter is disabled, ALL data is now displayed. For example the Risk Model tile now displays data about ALL violations:

Data display

The data available is displayed using various different "views":

• Risk Investigation
• Application Investigation
• Transaction Investigation

Action Plan/Exclusion list/Education list/Continuous Improvement

The Security Dashboard features the ability:

• to add and remove objects (violations) to and from an "Action Plan" - an Action Plan is simply a list of objects (i.e. "violations") that have been selected for action in the next snapshot generation process with a priority level assigned to them. Users can then use the list to focus their re-mediation work. Think of it as a "to do list" - i.e. objects that require work to remove the violation flagged by CAST AIP.
• to Exclude objects from a future snapshot - this can be useful when the object is violating an AIP Rule, but is irrelevant or is a false positive.
• to add and remove Rules to and from an "Education" list to promote best practices.
• to view detailed information about rules that have been added to the Education list in the Continuous Improvement feature.

See:

• Security Dashboard - Action Plan
• Security Dashboard - Exclusions
• Security Dashboard - Education
• Security Dashboard - Continuous Improvement

Report Generation

The Report Generation feature allows you to generate reports on the fly direct from the CAST Security Dashboard interface. Various reports can be generated, however, some require some configuration before they will work. See Security Dashboard - Report Generation for more information:

Advanced Search

Accessing the Advanced Search feature

The Advanced Search feature can be accessed using the icon in the left hand menu:

Enabling the Advanced Search feature

"Out of the box", the Advanced Search feature is not enabled and the following message will be displayed:

This indicates that a "violations index" (on which the feature relies) has not yet been generated. To generate the index the following methods are available:

http://<server>:<port>/<dashboard>/static/diagnostic.html

http://<server>:<port>/<dashboard>/static/default.html

<domain>/violations-index

%CATALINA_HOME%\webapps\<dashboard>\WEB-INF\web.xml

<context-param>
	<param-name>rebuildViolationsSearchIndexesOnStart</param-name>
	<param-value>true</param-value>
</context-param>

@echo off
@echo Computing Violations Indexes ...

util.bat > util.log
@echo --------------------------------

@echo off
setlocal enableDelayedExpansion
@echo Automated Violations Indexes Creation
@echo -------------------------------------
 
for /F "delims== eol=#" %%D in (domains.properties) do (
	@echo Process %%D/violations-index
	start /B titi.bat %%D
	@echo.
)

@echo off
prompt $_
setlocal enableDelayedExpansion
set "domain=%~1"
 
@echo Start  %domain% !DATE!_!TIME!
curl -s -u user:pwd -X PUT http://localhost:8080/<dashboard>/rest/%domain%/violations-index
@echo  is the response from %domain%
@echo Finish %domain% !DATE!_!TIME!

Using the Advanced Search feature

When the feature is accessed and the violations index has been generated, the following will be displayed:

Left hand panel

The left hand panel provides a set of filters that can be used to narrow down the search cope. Filters are explained in XXXX.

Right hand panel

The right hand panel list the results of the search. Key points: with no search criteria or filters enabled will show all violations available in the currently selected snapshot indicated by the following text: a search field is available for you to enter the object name you are searching for. Results in will be updated in real time. you can download the results to an Excel file for portability requirements: 20 results are shown. Use the Show More button to display additional results: the result lists uses the following columns: Option to add/remove the violation from the Action Plan or the Scheduled Exclusion List. Note that to interact with the Action Plan/Scheduled List, your user login must have the role QUALITY_MANAGER/EXCLUSION_MANAGER roles. These can be assigned at user level (when using Default Authentication mode) or via user or group (when using Standard LDAP authentication). Action / Exclusions Indicates whether the violation has been added to the Action Plan or the Scheduled Exclusion List: Item has been added to the Action Plan. Item has been added to the Scheduled Exclusion List. Object Name Location Displays the object name, and in the case of file based objects (as oppose to Database objects), the location on disk of the object. Status Displays the status of the object in comparison to the previous snapshot - e.g.: Added Updated Deleted Unchanged Clicking this icon will take you direct to the object in the Application Investigation view.

Using filters for the Advanced Search

The filters available in the left hand panel enable the search scope to be limited. The following filters can be enabled by expanding the section and selecting with a tick:

Exporting data to Microsoft Excel file format

You can export data to an Excel file format if required. To export to Microsoft Excel file format, use the following icon which is available at the following levels:

• Quality Investigation
  • Health Measures
  • Business Criteria
  • Technical Criteria
  • Rules, Distributions and Measures
  • Violations
• Application Investigation, Transaction Investigation
  • Violations
• Action Plan
• Scheduled and Active Exclusions

When you click this icon, depending on your browser you will be prompted whether you would like to Save or Open the Excel file. The Excel file will contain the data you requested in column format:

Violation level export - Associated Value data

When you export to Excel from the Violation level, a column containing a Rule's Associated Value may also be available in the resulting Excel file - in the example below, "JSP Page name" is the Associated Value for the Rule "Action Artifacts should not directly call a JSP page":

The Associated Value refers to a specific output for the Rule in question. For the Rule shown above "Action Artifacts should not directly call a JSP page", the Associated Value is defined as the JSP Page name - in other words, for this Rule, the JSP file listed in the column highlighted above violates the Rule in question. You can view the Associated Value configuration in the CAST Management Studio by opening the Assessment Model and locating the Rule: