A scorecard report is a valuable tool for organizations to assess the security status of their web applications. It provides a comprehensive overview of the security posture, enabling decision-makers to identify vulnerabilities, track progress, and make informed decisions to enhance security.
Key Facts
- Creation: To create a scorecard report, you can go to the Reports section and select “New Report” or click the “+” button. Then, choose the report type as “Scorecard Report” and click “Finish”.
- Customization: Scorecard reports can be customized according to your needs. You can create report templates and apply filters to include or exclude specific web applications based on tags.
- Inclusion of Web Applications: By default, the scorecard report includes all web applications with detected vulnerabilities. However, you can target the report to specific web applications by selecting tags. The report will then include only web applications that match at least one of the selected tags.
- Last Scan Date Filter: The scorecard report allows you to filter web applications based on the last scan date. You can specify a date range or choose from options like today, last week, last month, or a specific date. This filter helps you focus on web applications that were scanned within a specific timeframe.
- Results: The scorecard report provides details about your catalog entries in categories such as New, Approved, Rogue, Ignored, and In Subscription. These categories help you understand the security status of your web applications.
Creating a Scorecard Report
To create a scorecard report, users can navigate to the Reports section and select “New Report” or click the “+” button. The report type should be specified as “Scorecard Report,” followed by clicking “Finish.”
Customizing the Scorecard Report
Scorecard reports offer customization options to cater to specific requirements. Users can create report templates and apply filters to include or exclude web applications based on tags. This allows for targeted reporting and focuses on applications of interest.
Inclusion of Web Applications
By default, the scorecard report encompasses all web applications with detected vulnerabilities. However, users can refine the report by selecting tags to include only web applications that match at least one of the selected tags. This ensures a focused analysis of specific applications.
Last Scan Date Filter
The scorecard report provides a last scan date filter to enable users to focus on web applications scanned within a specific timeframe. This filter allows for targeted analysis and identification of vulnerabilities that may have arisen during a particular period.
Results and Categories
The scorecard report presents detailed information about catalog entries in various categories, including New, Approved, Rogue, Ignored, and In Subscription. These categories provide insights into the security status of web applications, helping organizations prioritize remediation efforts and strengthen their overall security posture.
Conclusion
The scorecard report is a powerful tool that empowers organizations to gain a comprehensive understanding of their web application security status. Its customizable features, targeted reporting capabilities, and detailed results enable decision-makers to identify vulnerabilities, track progress, and make informed decisions to enhance the security of their web applications.
References
- Qualys. (n.d.). Scorecard Report. Retrieved from https://qualysguard.qg2.apps.qualys.com/portal-help/en/was/reports/interactive_report_scorecard.htm
- Datapine. (2023, June 28). KPI Scorecard – See Performance Templates & Examples. Retrieved from https://www.datapine.com/blog/kpi-scorecard-examples-templates-to-track-performance/
- Kaplan, R. S., & Norton, D. P. (1992). The Balanced Scorecard—Measures that Drive Performance. Harvard Business Review, 70(1), 71-79.
FAQs
What is a scorecard report?
A scorecard report is a comprehensive assessment of the security status of web applications, providing detailed information about vulnerabilities, progress tracking, and actionable insights to enhance security.
How do I create a scorecard report?
To create a scorecard report, navigate to the Reports section, select “New Report” or click the “+” button, choose the report type as “Scorecard Report,” and click “Finish.”
Can I customize scorecard reports?
Yes, scorecard reports offer customization options. You can create report templates and apply filters based on tags to include or exclude specific web applications, enabling targeted reporting.
How does the last scan date filter work?
The last scan date filter allows you to focus on web applications scanned within a specific timeframe. Specify a date range or choose from options like today, last week, last month, or a specific date to analyze vulnerabilities detected during that period.
What information is included in the results section of a scorecard report?
The results section of a scorecard report provides detailed information about catalog entries in various categories, such as New, Approved, Rogue, Ignored, and In Subscription. This categorization helps you understand the security status of web applications and prioritize remediation efforts.
Can I share scorecard reports with others?
Yes, scorecard reports can be shared with relevant stakeholders to provide a comprehensive view of the security posture of web applications. Sharing reports facilitates collaboration and informed decision-making.
How can scorecard reports help improve security?
Scorecard reports empower organizations to identify vulnerabilities, track progress in addressing them, and make informed decisions to enhance the security of their web applications. By providing a clear understanding of the security status, organizations can prioritize remediation efforts and strengthen their overall security posture.
Are there any best practices for using scorecard reports?
Best practices for using scorecard reports include customizing reports to focus on specific areas of interest, utilizing the last scan date filter to analyze vulnerabilities over time, and sharing reports with relevant stakeholders to facilitate collaboration and informed decision-making.