Rollout of this feature is underway across our platform. It will be broadly available by September 10th.

Security team leaders need a high-level view to understand how effectively their organization is managing risk. Gauge your security health and easily manage team activities using our Application Security Governance view, which provides executive-level visibility of trends to help you understand progress and prioritize.

Why account-level views?

To monitor protection status and immediately make posture improvements, Security Hub is a great tool. To hone in on and investigate significant security events, your specialists want the detailed views and tools they find in Web Security Analytics.

But someone like your Chief Information Security Officer (CISO) needs to understand your organization as a whole and set priorities at the highest level. CISOs and leaders at the VP or Director level need a view across your entire account that surfaces score movement drivers and protection gaps. That's what they can find in the Application Security Governance report, also sometimes called CISO Dashboard.

Access Application Security Governance

Open this executive-level dashboard to get started.

Log in to Akamai Control Center.
From the Control Center menu, click Security > Security analytics > Security Hub.
Security Hub landing page opens.
On the top-right of the screen, click the Account-level view link.
The Application Security Governance view opens.

Filter the view using tags

This report is intentionally high-level, but you may still want to limit your view to one category. For example, say you need protection metrics for web assets in the EU only. You can organize and view security data by security configuration tags.

Set a categorization system that aligns with how you organize security areas. For example, you may have security setups for different business units or geographic regions.
Use these categories to create and apply tags to all your account's security configurations.
Within the Application Security Governance view, these tags appear at the top of the screen. Click one or more to filter the view to show data only for security configurations with those tags.

Security posture score

The chart on the top left gives a high-level posture overview. It shows

your posture score, which is a high-level indication of how effective your current web application security settings are. It’s an algorithmic measure from 0 to 1000 which indicates how prepared you are for attack. A score of zero is not at all prepared and 1000 is as prepared as possible. About scoring
the percentage posture score has improved or worsened in the past week
how you’re doing compared to others in your industry and geographic region

These charts are intended to give a high-level view. To track and actively improve security posture score your team can use Security Hub instead.

Traffic and attack trends

Understand how your setup is responding to attacks with a look at the Attack traffic and mitigation section on the upper right of the report. It shows basic attack volume and the percentage of attack requests that got a mitigating response action, like deny, and those that got a non-mitigating response, like alert.

📘
Mitigating vs. non-mitigating actions
Actions that merely report or log a detection are non-mitigating actions, meaning that they don't affect the request when an attack is detected. Any action that denies a request, slows a response, or throws up a challenge mitigates the request in some way.
It's a security best practice to start protection setup using non-mitigating actions (like alert) which only log detections, so you can track activity until you're confident that settings are effectively identifying attack requests. At that time, change response actions to mitigating actions, like deny or challenge to actually block or control unwanted requests.
The faster you move to mitigating actions, the better, and having done so is one measure that informs your security posture score.

To learn more, click View details. The charts that appear c

Interact with the attack traffic chart

It’s easy to see specifics, zoom in on a traffic spike, or drill down for more details. On charts, you can:

set the time period you want to view, by selecting it from the time period dropdown on the upper right of the chart
view the details for a specific moment in time by hovering over a point on the timeline.
view numbers for a chart data element by hovering over it.
show or hide chart data elements by clicking the element name in the legend.
focus traffic flagged by a specific protection by selecting it from the All protection areas dropdown

Track issue trends

To understand the issues that contribute the most to your score, click the High-impact issues link beside your security posture score. You see a panel slide in that lists issues in the following separate tabs:

Top open issues shows active issues impacting your score the most.
Closed this week lists the issues your team resolved during the last 7 days to improve your score.

View security posture breakdown

Drill down to see details on security posture status.

See scores for specific security configurations

Under Security posture breakdown, the Security configurations section shows the number of security configurations that fall in each posture score grade. Click a number or the section's View details link to learn more.

See which of your web assets are covered or not

Under Security posture breakdown, the Asset coverage section shows the. Click View details to learn more. Armed with information, ask your team to improve the score using Security Hub tools to fix partially-covered or uncovered web sites, APIs, or apps.

See which protection types you're missing

Are you covered against all types of attacks? Understand gaps in your security coverage. Your team can see the same list and take action to improve your score by covering additional attack vectors.

📘
Extend your protection, analysis, and remediation capabilities by adding any of the third-party integrations you see under Available integrations within the Action center. The Akamai Application Protection Platform plays well with others, be it your cloud provider, data analysis solution, or issue resolution queue. Expand the list to see what's currently available and click through to learn more on that vendor's site. Third-party integrations do not impact security posture.

Track team progress and activities

Security posture score fluctuations may be the best high-level gauge of your team's security preparedness, but the Application Security Governance view also gives you operational awareness about what's going on on. It lets you see the various issues and alerts your staff is handling via Security Hub and tracking in Web Security Analytics.

The bottom section of the Action center features several lists within three tabs:

Remediable insights are system-detected issues that are automatically surfaced for your team to address and fix.
Open security issues lists of items your team can address to raise your security posture score. Click a configuration name to view it in Security Hub to learn more about what's going on.
Web Security Analytics alerts Your security analysis staff members can create alerts for certain conditions or events. These alerts appear here for your awareness. Click a configuration name to view it in Security Hub and learn more about what's going on.

📘
Items on these three tabs are view-only here in this account-level report. You team members using Security Hub can see these issues too and have the ability to take action on them directly from there.