Policies

Policies in API Security Testing (APIST) define the vulnerability types you want Traceable to detect in your endpoints, including any AI endpoints.

What you will learn from this topic

By the end of this topic, you will be able to understand:

• The available predefined policies by Traceable, and when to use each one.

• Steps to create a custom policy.

• The ways you can select attacks when creating a custom policy.

Available policies

The following are the available predefined policies by Traceable. These are the system built-in policies that do not require custom YAML configuration:

Traceable measures the performance of these policies to help you anticipate scan behavior before choosing the right policy. For more information, see Scan Policy Performance. If none of the predefined policies fit your requirements, you can create a custom policy. For more information, see the section below.

Create a policy

To create a custom policy, navigate to Testing → Policies and click Create Scan Policy. To create a policy, follow the given steps:

1. Select the attacks: Specify the Policy name and select the attacks from one of the three ways listed in Attack selection.

2. Advance configuration: You can select the following advanced configurations:

   1. Attack methods: Choose from GET, PUT, POST, DELETE, and PATCH.

   2. Attack coverage: This advanced option lets you choose the type of tests you wish to run:

      • Smoke: These are basic security tests for continuous coverage.

      • Optimized: Traceable runs fewer, smarter tests using selective payloads and learned data when you select this option.

      • Exhaustive: When you choose this option, Traceable attempts to cover all the scenarios with all possible attacks.

   3. Run only safe attacks: Choose this option to run API Security Tests directly in the production environment. The tests run when you select this option are non-disruptive.

3. Save the policy: Traceable displays a policy summary as the final step. Click Create Policy to save the policy.

Attack selection

AST scans execute attacks on your API endpoints and detect the selected vulnerabilities. You can select the attacks in either of the following ways:

• Specific attacks: Traceable runs your selected tests on the API endpoints when you choose this option.

• All attacks: Traceable runs all available tests on your API endpoints when you choose this option. However, this may be time-consuming.

• Rule-based attacks: Traceable runs the available tests on the API endpoints based on the filters you apply when you choose this option. For example, the filters in the screenshot identify Security Misconfiguration and High-severity vulnerabilities.
  

  

You can choose from the above attacks according to your requirements while creating a policy. For information on the attack recommendations you can use based on the scan you wish to create using the above policy, see Scan Creation Recommendations.

Attack Categories

For all the categories of attacks, Traceable describes each attack and the OWASP category into which it falls. All the attacks fall into one of the following categories:

• Server-side request forgery

• Security misconfiguration

• JSON Web Token

• Access control

• Insecure design

• SQL injection

• Authorization

• Improper asset management

• Remote code execution

• Data Exposure

• Cross-site scripting

• Security headers

• TLS

• No SQL injection

• Business logic

• Authentication

• AI

Note

A scan must have at least one policy. Policies apply to all environments.