1"use strict";(self["webpackChunkcyrisk"]=self["webpackChunkcyrisk"]||[]).push([[2996],{7639:function(e,t){const a={update:{text:"We identified that software running on your servers is subject to known vulnerabilities. We recommend you install all available updates or replace with a more secure substitute if possible.",icon:"darkBlue fas fa-upload"},protect:{text:"We identified the following services as being available on your servers. In order to prevent an attacker from exploiting these services, we recommend that you turn these services off or install a web application firewall to restrict access to the following services:",icon:"darkBlue fas fa-shield-alt"},review_findings:{text:"CyRisk has detected the following issues which may represent significant risk to your enterprise, but insufficient information is available to confirm the true level of risk. Please review these findings to determine whether they require additional risk mitigation activities.",icon:"darkBlue fas fa-eye"},review:{text:"We bring the following findings to your attention so that you can confirm it is properly configured and up-to-date.",icon:"darkBlue fas fa-tasks"},configure:{text:"We have detected missing or incorrect configurations on the domains listed below. Please review each issue and correct them as advised.",icon:"darkBlue fas fa-cogs"},informational_findings:{text:"The following are informational findings that, if addressed, could further improve the security posture of your organization. These findings are considered low severity and do not pose an immediate threat to your systems or data. However, addressing these findings can help to reduce the overall risk to your organization and improve your CyRisk Security Rating. We recommend reviewing these findings and addressing them as resources and priorities allow.",icon:"darkBlue fas fa-circle-info"}},i={tracking_pixels:{text:"We identified the presence of a Tracking Pixel or similar retargeting pixel (also called a web beacon) embedded on your website. This is a clear graphic image (often literally one pixel in size) that is delivered via web browser or HTML email. It's a snippet of back-end JavaScript code that allows visitors' activity on your website to be tracked. It can collect many different types of data, including: HTTP headers, pixel-specific data, button click data, custom-defined values, and form field names.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties. Should such a data breach occur, then the damage to your business could be significant. A data protection authority may impose a substantial fine, and negative publicity could harm your company's reputation and profitability. Additionally, website owners may face legal action from individuals or groups seeking redress through the courts.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. Do not use pixel tracking on authenticated websites where users will be entering PHI. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using pixel tracking technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data. Third parties are often opaque about how they store the data, and in some cases do not know what kinds of information is being tracked and where it is being stored.",icon:"darkBlue fad fa-user-secret"},ddg_join_ads:{text:"Ad Trackers are small software applications that are embedded in a website in order to collect data about visitors' interactions with a website and send it to a server for deeper analysis. Ad trackers are generally invisible to users, so it is important to understand what ad trackers are in use on your websites, what data is being collected, where that data is being sent and how it is being used.",risk:"Ad trackers often deliver advertisements that can obscure the contents of visited
1web pages or even link to phishing websites or promote potentially malicious applications. Moreover, ad trackers can gather data on users' browsing habits, which could then be sold to third parties, used improperly for marketing purposes, or monetized in some other way. The Federal Trade Commission (FTC), the Department of Health and Human Services Office for Civil Rights (OCR), as well as several other regulatory bodies have issued guidance warning that non-compliant use of ad tracking technologies when collecting Personally Identifiable Information (PII) or Protected Health Information (PHI) will be viewed as a data breach.",remediation:"We recommend that you ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Document your data privacy program.",icon:"darkBlue fad fa-binoculars"},cookies:{text:"Third-Party Cookies are small pieces of code that get placed in the web browsers of visitors to a website by a website other than the one the user is currently visiting. One company may have multiple cookies, and some cookies may not have a clear attribution to a company.",risk:"Whereas first-party cookies are used to improve user interactions with the host website, third-party cookies are created and placed by someone other than the website's owner (often a marketing group). They are, by definition, considered \"non-essential\" under data privacy laws worldwide. The Federal Trade Commission (FTC), the Department of Health and Human Services Office for Civil Rights (OCR), as well as several other regulatory bodies have issued guidance warning that non-compliant use of tracking technologies when collecting Personally Identifiable Information (PII) or Protected Health Information (PHI) will be viewed as a data breach.\nUnder the European Union's General Data Protection Regulation (GDPR), cookie data is considered personal data, and the placement of third-parties cookies requires opt-in consent from the website user.\nUnder the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), cookie data is considered personal information. Businesses must offer opt-out consent for the placement of third-party cookies and, further, must disclose what they do with the data gathered in this way. A business' website must provide a clear and conspicuous 'Do Not Sell Or Share My Personal Information' link on its website.",remediation:"We recommend that you ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Document your data privacy program.",icon:"darkBlue far fa-cookie-bite"},canvas_fingerprinters:{text:"Canvas Fingerprinting is a browser fingerprinting technique that uses JavaScript code to uniquely identify users via the HyperText Markup Language 5 (HTML5) Canvas element. Instead of placing cookies, it instructs the browser to randomly draw graphics using the Canvas API, which will render differently on different web browsers and operating systems.",risk:"Canvas Fingerprinting creates a highly-accurate and personalized digital fingerprint of the user's browser; therefore, it collects personal data about website visitors. The Federal Trade Commission (FTC), the Department of Health and Human Services Office for Civil Rights (OCR), as well as several other regulatory bodies have issued guidance warning that non-compliant use of online tracking technologies when collecting Personally Identifiable Information (PII) or Protected Health Information (PHI) will be viewed as a data breach. Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), browser fingerprinting is a unique personal identifier. Businesses must offer opt-out consent for such tracking and, further, must disclose what they do with the data gathered in this way. Browser fingerprinting is legal in Europe, so long as website owners comply with the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy Directive, namely to obtain users' consent before tracking them.",remediation:"We recommend that you should update your website privacy policy to specifically address the use of canvas fingerprinting scripts. Do not use canvas fingerprinting on authenticated websites where users will be entering PHI. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain affirmative consent from website visitors for the use of canvas fingerprinting scripts to preempt any legal challenges. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program.",icon:"darkBlue fad fa-fingerprint"},session_recorders:{text:"Session replay software is a tool that allows companies to reconstruct a real-time, visual record of all user interaction with the website, including their clicks, mouse movements, scrolls, and time spent on the website or application, which can then be used for internet marketing and user behavior research.",risk:"Recently, plaintiffs' attorneys have had success with filing data privacy class action lawsuits alleging violations of state wiretapping laws, in particular the: 1) California Invasion of Privacy Act (CIPA); 2) Florida Security and Communications Act (FSCA); and 3) Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA).",remediation:"We recommend that you should carefully consider the use of session replay technology and consult legal counsel regarding best practices for the jurisdiction in which you and your website visitors are located. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using third-party session replay software to preempt any legal challenges. Update your website privacy policy to specifically address the use of session replay software. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data.",icon:"darkBlue fad fa-screencast"},ga:{text:"Remarketing is an analytics tool that allows you to use data and metrics to create lists of website visitors and then share those lists automatically with an ad platform to show targeted ads as visitors browse elsewhere on the internet. A remarketing audience is a list of cookies or mobile-advertising IDs that represents a group of users you want to re-engage because of their likelihood to convert. User behavior information that can be tracked in this manner includes pages viewed, location, on-site activity, and goal completion.",risk:"The use of remarketing technologies without consent could potentially violate the federal Stored Communications Act (SCA) and/or the Federal Wiretap Act, as amended by the Electronic Communications Privacy Act (ECPA). Additionally, state wiretapping laws could also be implicated.",remediation:"We recommend that you should carefully consider the use of remarketing analytics technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using remarketing analytics technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data.",icon:"darkBlue fad fa-comments-dollar"},key_logging:{text:"Some websites collect data entered into forms, even without users hitting the submit button. Some keyloggers capture data as each keystroke is entered while others collect the data when users move to the next field. Some keystroke capture systems are deployed for child monitoring while others are used for employee monitoring. In some cases, data is preserved in an effort to save users time if they move off the site and come back later.",risk:"The use of keyloggers without consent could potentially violate the federal Stored Communications Act (SCA) and/or the Federal Wiretap Act, as amended by the Electronic Communications Privacy Act (ECPA). Additionally, state wiretapping laws could also be implicated.",remediation:"We recommend that you should carefully consider the use of keylogger technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using keystroke logging software. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data.",icon:"darkBlue fad fa-keyboard-down"},biometrics:{text:"Biometric data encompasses immutable personal characteristics, including physical, biological, or behavioral traits such as fingerprints, DNA, retinal and iris patterns, facial images, voice, and even less obvious behavioral traits, recorded in a machine-readable format, representing the unique attributes that define an individual. There are a wide range of systems used to collect and use biometric data.",risk:"The collection, storage, processing or transmission of biometric data can the risk of privacy infringement, identity theft, and unauthorized access to or misuse of biometric data, with potential long-term consequences for individuals. In addition, engaging in surreptitious and unexpected collection or use of biometric information can lead to regulatory fines and penalties and the organization collecting biometric data may face legal action from individuals or groups seeking redress through the courts.",remediation:"Conduct a privacy risk analysis regarding the collection and use of biometric data and consult legal counsel regarding best practices for the jurisdiction in which you are located. Provide notice (e.g., through a website banner or pop-up box) and obtain consent from data subjects when collecting biometric data. Validate that your technology partners' practices and capabilities with regard to biometric data are fully compliant, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to any users prior to collecting their data. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Provide appropriate training for employees and contractors whose job duties involve interacting with biometric data or technologies that use such information. Conduct ongoing monitoring to ensure that the any biometric data technologies are functioning as anticipated and are not likely to harm the data subjects.",icon:"fas fa-fingerprint"},geolocation_tracking:{text:"Geolocation tracking technology is a system that utilizes satellite, cellular, or Wi-Fi signals to pinpoint and monitor the real-time geographic location of a device, such as a smartphone or GPS receiver. Geolocation tracking technologies can collect information that is sufficient to identify the street name and name of the city or town in which a data subject's device is located. Many organizations seek to use this data in a wide range of products and services.",risk:"Geolocation data is sensitive personal information about data subjects. Geolocation information can raise privacy concerns because it can reveal a consumer's movements in real time and provide a detailed record of a consumer's movements over time. When correlated with other data, it can divulge intimately personal details about an inidividual, including health information, religious, political, business and social activities, all without the data subject's knowledge or consent. A data protection authority may impose substantial fines and penalties, and negative publicity could harm your company's reputation and profitability. Additionally, organizations may face legal action from individuals or groups seeking redress through the courts.",remediation:"Carefully consider the use of geolocation tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. Provide notice (e.g., through a website banner or pop-up box) and obtain affirmative consent from users when employing geolocation tracking technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Verify the exact data types that are being collected, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy.",icon:"fas fa-map-marker-alt"},chat_technologies:{text:"Chat technologies are widely used on website where real-time communication are required to enable users to ask questions or engage with an organization's sales, support or similar functions. These communications may occur through voice or text-based conversations on a website.",risk:"Chat communications may be saved by the chat technology vendor and potentially used for purposes other than the original communication purpose. Additionally, chat communications may b
1e subject to data privacy laws and regulations.",remediation:"We recommend that you carefully consider the use of chat technologies and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice and obtain consent from website visitors when using chat technologies. Ensure your data privacy practices are compliant with current regulatory requirements.",icon:"fas fa-comments"},blocker_evasion:{text:"Ad blocker detection and evasion technologies are used to detect when users have ad blocking software installed and attempt to bypass or circumvent these blockers to display advertisements.",risk:"Ad blocker evasion can create privacy concerns as it may override user preferences for blocking tracking technologies and advertisements. This can lead to unauthorized data collection and potential violations of user consent preferences.",remediation:"We recommend respecting user choices regarding ad blocking software. Consider implementing transparent disclosure about advertising practices and provide users with clear opt-out mechanisms that are honored regardless of ad blocking software.",icon:"fas fa-shield-slas
1h"},protected_information:{text:"Protected information, in the context of internet privacy, refers to sensitive and confidential data, such as personal identifiers, financial details, or any information subject to legal safeguards.",risk:"Organizations handling protected information face risks of data breaches, privacy breaches, operational disruptions, legal liability and regulatory fines and penalties as well as potential reputational damage.",remediation:"Organizations should implement robust cybersecurity and privacy compliance programs to reduce the risk associated with collecting, processing, storing and transmitting protected information. This includes ensuring compliance with data protection laws by building a solid foundation of governance with policies and procedures, privacy impact assessments, regular risk assessments, ongoing employee training and awareness, and a strong and effective system of security and privacy controls.",icon:"fas fa-user-shield"},gdpr_exposure:{text:"GDPR exposure refers to the potential liability and compliance requirements under the General Data Protection Regulation when processing personal data of EU residents.",risk:"Non-compliance with GDPR can result in significant fines up to 4% of annual global turnover or â¬20 million, whichever is higher. Additional risks include reputational damage and loss of customer trust.",remediation:"Implement comprehensive GDPR compliance measures including lawful basis for processing, data protection impact assessments, privacy by design principles, and clear privacy policies. Ensure proper consent mechanisms and data subject rights procedures are in place.",icon:"fas fa-balance-scale"},data_residency:{text:"Data residency exposure refers to risks associated with storing or processing data in jurisdictions that may not provide adequate data protection or may conflict with applicable privacy laws.",risk:"Storing data in jurisdictions with inadequate protections can expose organizations to compliance violations, unauthorized access by foreign governments, and potential conflicts with data localization requirements.",remediation:"Implement data mapping to understand where data is stored and processed. Use appropriate safeguards such as standard contractual clauses or adequacy decisions. Consider data localization requirements and implement appropriate technical and organizational measures.",icon:"fas fa-globe-americas"},subdomain_limit_reached:{text:"Subdomain limit reached indicates that the maximum number of subdomains for analysis has been exceeded during the security assessment.",risk:"Limited subdomain analysis may result in incomplete security coverage and potential blind spots in the security assessment.",remediation:"Consider upgrading your assessment plan to include additional subdomain analysis or prioritize the most critical subdomains for security evaluation.",icon:"fas fa-exclamation-triangle"},session_storage:{text:"Session replay software is a tool that allows companies to reconstruct a real-time, visual record of all user interaction with the website, including their clicks, mouse movements, scrolls, and time spent on the website or application, which can then be used for internet marketing and user behavior research.",risk:"Recently, plaintiffs' attorneys have had success with filing data privacy class action lawsuits alleging violations of state wiretapping laws, in particular the: 1) California Invasion of Privacy Act (CIPA); 2) Florida Security and Communications Act (FSCA); and 3) Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA).",remediation:"We recommend that you should carefully consider the use of session replay technology and consult legal counsel regarding best practices for the jurisdiction in which you and your website visitors are located. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using third-party session replay software to preempt any legal challenges. Update your website privacy policy to specifically address the use of session replay software. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data.",icon:"darkBlue fad fa-screencast"},personal_data:{text:"Protected information, in the context of internet privacy, refers to
1sensitive and confidential data, such as personal identifiers, financial details, or any information subject to legal safeguards.",risk:"Organizations handling protected information face risks of data breaches, privacy breaches, operational disruptions, legal liability and regulatory fines and penalties as well as potential reputational damage.",remediation:"Organizations should impliment robust cybersecurity and privacy compliance programs to reduce the risk associated with collecting, processing, storing and transmitting protected information. This includes ensuring compliance with data protection laws by building a solid foundation of governance with policies and procedures, privacy impact assessments, regular risk assessments, ongoing employee training and awareness, and a strong and effective system of security and privacy controls.",icon:"fas fa-user-shield"},sensitive_data:{text:"Geolocation tracking technology is a system that utilizes satellite, cellular, or Wi-Fi signals to pinpoint and monitor the real-time geographic location of a device, such as a smartphone or GPS receiver. Geolocation tracking technologies can collect information that is sufficient to identify the street name and name of the city or town in which a data subject's device is located. Many organizations seek to use this data in a wide range of products and services.",risk:"Geolocation data is sensitive personal information about data subjects. Geolocation information can raise privacy concerns because it can reveal a consumer's movements in real time and provide a detailed record of a consumer's movements over time. When correlated with other data, it can divulge intimately personal details about an inidividual, including health information, religious, political, business and social activities, all without the data subject's knowledge or consent. A data protection authority may impose substantial fines and penalties, and negative publicity could harm your company's reputation and profitability. Additionally, organizations may face legal action from individuals or groups seeking redress through the courts.",remediation:"Carefully consider the use of geolocation tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. Provide notice (e.g., through a website banner or pop-up box) and obtain affirmative consent from users when employing geolocation tracking technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Verify the exact data types that are being collected, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy.",icon:"fas fa-map-marker-alt"},biometric_data:{text:"Biometric data encompasses immutable personal characteristics, including physical, biological, or behavioral traits such as fingerprints, DNA, retinal and iris patterns, facial images, voice, and even less obvious behavioral traits, recorded in a machine-readable format, representing the unique attributes that define an individual. There are a wide range of systems used to collect and use biometric data.",risk:"The collection, storage, processing or transmission of biometric data can the risk of privacy infringement, identity theft, and unauthorized access to or misuse of biometric data, with potential long-term consequences for individuals. In addition, engaging in surreptitious and unexpected collection or use of biometric information can lead to regulatory fines and penalties and the organization collecting biometric data may face legal action from individuals or groups seeking redress through the courts.",remediation:"Conduct a privacy risk analysis regarding the collection and use of biometric data and consult legal counsel regarding best practices for the jurisdiction in which you are located. Provide notice (e.g., through a website banner or pop-up box) and obtain consent from data subjects when collecting biometric data. Validate that your technology partners' practices and capabilities with regard to biometric data are fully compliant, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to any users prior to collecting their data. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Provide appropriate training for employees and contractors whose job duties involve interacting with biometric data or technologies that use such information. Conduct ongoing monitoring to ensure that the any biometric data technologies are functioning as anticipated and are not likely to harm the data subjects.",icon:"fas fa-fingerprint"},ai_technologies:{text:"We identified the presence of AI-powered technologies on your website or infrastru
1cture. These tools may collect user data, process interactions, or perform automated analysis as part of their functionality.",risk:"AI technologies can introduce privacy risks by collecting behavioral data, profiling users, or processing personal information in ways that may not be transparent to end users. Some AI tools transmit data to third-party servers for model inference or improvement, which may conflict with privacy regulations such as GDPR and CCPA.",remediation:"Review all AI technologies detected and ensure their data collection and processing practices are disclosed in your privacy policy. Obtain user consent where required by applicable law, particularly for any AI tools that process personal or sensitive data. Evaluate vendor data processing agreements to confirm compliance with relevant privacy regulations.",icon:"darkBlue fas fa-robot"},third_parties:{text:'Third-party data disclosure occurs when a company shares user information with outside entities such as advertising platforms, analytics providers, or business partners. Under privacy laws like the California Consumer Privacy Act (CCPA), companies must disclose if they "sell" or "share" data and ensure that third parties uphold the same privacy standards.',risk:"Opaque or inconsistent data handling directly affects liability and insurability. Lack of transparency in third-party data sharing can trigger regulatory actions, litigation, and rapid loss of customer trust. Because vendors often apply uneven privacy and security standards, the risk of misuse, accidental disclosure, or compliance failures rises significantly. Entrusting data to weaker vendors also heightens breach likelihood, increasing exposure to direct costs, long-tail claims, reputational harm, and regulatory scrutiny.",remediation:'Organizations should maintain an updated inventory of all data-sharing partners. Rigorous vetting of vendors and data sharing partners, including reviews of security practices and prior regulatory history, must be paired with ongoing monitoring. Contracts should require equivalent security and compliance practices as well as liability protections. Consumers should be given clear opt-out rights for data "sales" or "sharing," with these practices disclosed transparently in privacy policies. Such measures reduce claims risk, strengthen compliance, and improve underwriting outcomes. Moreover, if the organization will be collecting or processing sensitive personal information (SPI), then consent should be obtained first. Currently, fourteen states (Colorado, Connecticut, Delaware, Indiana, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia) require businesses to obtain explicit, opt-in consent for collection or processing of SPI, as well as conducting a data protection assessment (DPA).',icon:"darkBlue fas fa-handshake"},high_risk_third_parties:{text:"High-risk third parties are entities with a history of privacy controversies, regulatory actions, or class-action lawsuits. These may include advertising technology firms, data brokers, or platforms known for broad data collection. They are considered higher risk because they often receive large amounts of user data and have often been named in classâaction privacy lawsuits or regulatory actions.",risk:"Working with high-risk third partiesâsuch as data brokers, ad tech f
1irms or vendors with histories of lawsuits or regulatory actionsâgreatly increases exposure. Oversharing data raises the chance of investigations, settlements, and unauthorized disclosure when user data is combined with other sources. Associations with these vendors erode trust and damage reputations. Many also have poor security, making them prime targets for cyberattacks. For underwriters, this translates to higher loss potential across privacy litigation, liability claims, regulatory fines and breach impacts.",remediation:"Organizations should track and vet all high-risk vendors, reviewing both security practices and prior enforcement actions. Data sharing should be minimized and anonymized where possible. Due diligence must include ongoing monitoring of compliance performance. Alternative partners with stronger privacy records should be prioritized where possible. Contracts with existing vendors should impose strict security, liability, and notification requirements. Legal counsel should be consulted before partnering with firms under repeated scrutiny. These steps demonstrate proactive risk management, reduce claim probability, and strengthen underwriting profiles. Moreover, if the organization will be collecting or processing sensitive personal information (SPI), then consent should be obtained first. Currently, fourteen states (Colorado, Connecticut, Delaware, Indiana, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia) require businesses to obtain explicit, opt-in consent for collection or processing of SPI, as well as conducting a data protection assessment (DPA).",icon:"darkBlue fas fa-exclamation-triangle"},malicious_third_parties:{text:"High-risk third parties are entities with a history of privacy controversies, regulatory actions, or class-action lawsuits. These may include advertising technology firms, data brokers, or platforms known for broad data collection. They are considered higher risk because they often receive large amounts of user data and have often been named in classâaction privacy lawsuits or regulatory actions.",risk:"Working with high-risk third partiesâsuch as data brokers, ad tech f
1irms or vendors with histories of lawsuits or regulatory actionsâgreatly increases exposure. Oversharing data raises the chance of investigations, settlements, and unauthorized disclosure when user data is combined with other sources. Associations with these vendors erode trust and damage reputations. Many also have poor security, making them prime targets for cyberattacks. For underwriters, this translates to higher loss potential across privacy litigation, liability claims, regulatory fines and breach impacts.",remediation:"Organizations should track and vet all high-risk vendors, reviewing both security practices and prior enforcement actions. Data sharing should be minimized and anonymized where possible. Due diligence must include ongoing monitoring of compliance performance. Alternative partners with stronger privacy records should be prioritized where possible. Contracts with existing vendors should impose strict security, liability, and notification requirements. Legal counsel should be consulted before partnering with firms under repeated scrutiny. These steps demonstrate proactive risk management, reduce claim probability, and strengthen underwriting profiles. Moreover, if the organization will be collecting or processing sensitive personal information (SPI), then consent should be obtained first. Currently, fourteen states (Colorado, Connecticut, Delaware, Indiana, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia) require businesses to obtain explicit, opt-in consent for collection or processing of SPI, as well as conducting a data protection assessment (DPA).",icon:"darkBlue fas fa-exclamation-triangle"},third_party_connections:{text:"Third-party connections are technical mechanismsâsuch as Application Programming Interfaces (APIs), Software Development Kits (SDKs), plug-ins, and other integrationsâthat allow external systems or vendors to access or exchange data. These connections often operate in the background, enabling features like payments, analytics, or social media logins.",risk:"Third-party connectionsâsuch as APIs, SDKs, and plug-insâintroduce risks because of limited visibility and control. Aggressive attorneys will threaten lawsuits for the presence of such connections, asking for large sums of money to go away. It is not uncommon for companies to be unaware that such connections exist, or of exactly what data is being collected, transmitted, or shared. This can lead to oversharing, regulatory non-compliance, and user privacy violations. Some tools transmit personal data without consent, while vulnerabilities in APIs or SDKs can serve as attack vectors for unauthorized access and large-scale breaches. For underwriters, this creates exposure across regulatory fines and penalties, legal costs, reputational damage, and breach liabilities.",remediation:"Organizations should maintain a complete inventory of all active integrations, limit them to business-critical functions, and remove all redundant, outdated or unused connections. Vendor documentation must be reviewed to confirm what data is collected and shared. APIs and SDKs should undergo regular audits and penetration testing to detect unauthorized collection or exploitable flaws. Transparency should be reinforced by disclosing third-party connections in privacy policies. These practices strengthen governance, reduce breach and compliance risks, and support more favorable underwriting terms.",icon:"darkBlue fas fa-link"},consent_manager:{text:"Consent manager technologies are tools used in websites to facilitate the transparent and user-friendly collection, storage, and management of data subject consents. The intent is to help ensure compliance with privacy regulations by allowing individuals to make informed choices regarding the processing of their personal data. Consent managers reduce risk by providing a systematic and transparent approach to obtaining and managing user consent for data processing, ensuring compliance with privacy regulations, minimizing the likelihood of unauthorized data collection, and enhancing transparency in the handling of personal information, thus mitigating potential legal and reputational risks for businesses.",icon:"darkBlue fas fa-user-check"},privacy_signals:{text:"Privacy signals contain information about disclosures made, opt-out storage, and other privacy choices selected by a user regarding consumer data privacy. These include the U.S. Privacy User Signal Mechanism and the Global Privacy Control. Although the U.S. Privacy signal has been deprecated as of January 31, 2024, it is still widely used. The risk mitigation impact will be adjusted over time.",icon:"darkBlue fas fa-signal"},safe_harbor:{text:"Safe Harbor provisions provide legal protections for organizations that implement specific privacy and data protection frameworks. These frameworks help establish compliant data handling practices and reduce regulatory exposure by demonstrating proactive privacy compliance efforts.",icon:"darkBlue fas fa-anchor"},gdpr_privacy_tools:{text:"GDPR privacy tools are technologies and systems implemented to ensure compliance with the General Data Protection Regulation. These tools help organizations manage data subject rights, conduct privacy impact assessments, and maintain compliance with European privacy regulations.",icon:"darkBlue fas fa-tools"},canadian_privacy_tools:{text:"Canadian privacy tools are technologies and frameworks designed to ensure compliance with Canadian privacy legislation, including PIPEDA (Personal Information Protection and Electronic Documents Act) and provincial privacy laws. These tools help organizations handle personal information in accordance with Canadian privacy requirements.",icon:"darkBlue fas fa-maple-leaf"}
1,transparency:{text:"Transparency tools and practices help organizations provide clear, accessible information about their data collection, processing, and sharing practices. These include privacy policies, data processing disclosures, and user-friendly privacy communications that enhance trust and regulatory compliance.",icon:"darkBlue fas fa-eye"},fb_pixel_events:{text:"We identified the presence of a Tracking Pixel or similar retargeting pixel (also called a web beacon) embedded on your website. This is a clear graphic image (often literally one pixel in size) that is delivered via web browser or HTML email. It's a snippet of back-end JavaScript code that allows visitors' activity on your website to be tracked. It can collect many different types of data, including: HTTP headers, pixel-specific data, button click data, custom-defined values, and form field names.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties. Should such a data breach occur, then the damage to your business could be significant. A data protection authority may impose a substantial fine, and negative publicity could harm your company's reputation and profitability. Additionally, website owners may face legal action from individuals or groups seeking redress through the courts.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. Do not use pixel tracking on authenticated websites where users will be entering PHI. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using pixel tracking technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements and validate your ad tech partners' approaches to data privacy, making sure they don't violate consumers' rights. Make sure that you understand what data is being collected from website visitors, the purpose(s) for which such data is collected, with whom the data is shared, and what disclosures are made to website visitors in your privacy policy. Document your data privacy program. Review your vendor agreements to ensure that they reflect any legal obligations. Starting in 2023, three states (California, Colorado, and Virginia) will require companies to have contracts with third parties that reflect and uphold the companies' privacy policy as it pertains to consumers' data. Third parties are often opaque about how they store the data, and in some cases do not know what kinds of information is being tracked and where it is being stored.",icon:"darkBlue fad fa-user-secret"},twitter_pixel_events:{text:"We identified the presence of a Twitter Tracking Pixel embedded on your website. This tracking pixel allows Twitter to monitor visitors' activity and can collect various types of data for advertising and analytics purposes.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice and obtain consent from website visitors when using pixel tracking technology. Ensure your data privacy practices are compliant with current regulatory requirements.",icon:"darkBlue fad fa-user-secret"},linkedin_pixel_events:{text:"We identified the presence of a LinkedIn Tracking Pixel embedded on your website. This tracking pixel allows LinkedIn to monitor visitors' activity and can collect various types of data for advertising and analytics purposes.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice and obtain consent from website visitors when using pixel tracking technology. Ensure your data privacy practices are compliant with current regulatory requirements.",icon:"darkBlue fad fa-user-secret"},tiktok_pixel_events:{text:"We identified the presence of a TikTok Tracking Pixel embedded on your website. This tracking pixel allows TikTok to monitor visitors' activity and can collect various types of data for advertising and analytics purposes.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. At a minimum, provide notice and obtain consent from website visitors when using pixel tracking technology. Ensure your data privacy practices are compliant with current regulatory requirements.",icon:"darkBlue fad fa-user-secret"},pixel_tracking:{text:"We identified the presence of Tracking Pixels or similar retargeting pixels (also called web beacons) embedded on your website. These are clear graphic images (often literally one pixel in size) that are delivered via web browser or HTML email. They are snippets of back-end JavaScript code that allow visitors' activity on your website to be tracked. They can collect many different types of data, including: HTTP headers, pixel-specific data, button click data, custom-defined values, and form field names.",risk:"Traditional controls such as blocking third-party cookies may not entirely prevent pixels from collecting and sharing information. Potential compromise of users' data is the most significant risk associated with tracking pixels. A rogue or even misconfigured pixel could send users' personal data to an unauthorized third party server. Website owners can be held accountable for any data breaches caused by the pixels that they host, even when such pixels are created and managed by third parties. Should such a data breach occur, then the damage to your business could be significant. A data protection authority may impose a substantial fine, and negative publicity could harm your company's reputation and profitability. Additionally, website owners may face legal action from individuals or groups seeking redress through the courts.",remediation:"We recommend that you should carefully consider the use of pixel tracking technology and consult legal counsel regarding best practices for the jurisdiction in which you are located. Do not use pixel tracking on authenticated websites where users will be entering PHI. At a minimum, provide notice (e.g., through a website banner or pop-up box) and obtain consent from website visitors when using pixel tracking technology. Ensure your consent management platform is handling opt-out and opt-in requests properly. Ensure your data privacy practices are compliant with current regulatory requirements.",icon:"darkBlue fad fa-user-secret"}};t.A={sections:{urgent:{title:"Urgent",icon:"fas fa-siren-on error"},remote_management_security:{title:"Remote Management Security",icon:"fas fa-laptop-house"},mail_security:{title:"Mail Security",icon:"fas fa-envelope"},file_transfer_security:{title:"File Transfer Security",icon:"fas fa-exchange"},database_security:{title:"Database Security",icon:"fas fa-database"},web_server_security:{title:"Web Server Security",icon:"fas fa-server"},software_security:{title:"Software Security",icon:"fas fa-hdd"},domain_security:{title:"Domain Security",icon:"fas fa-globe"},printer_security:{title:"Printer Security",icon:"fas fa-print"},peer_to_peer_security:{title:"Peer-To-Peer Security",icon:"fas fa-share-alt"},security_mitigating_controls:{title:"Security Mitigating Controls",icon:""},portfolio_risk_exposure:{title:"Portfolio Risk Exposure",icon:""},privacy_checks:{title:"Privacy Risk Detections",icon:""},web_tracking_technologies:{title:"Web Tracking Technologies",icon:"fas fa-user-secret"},personal_information:{title:"Personal Information",icon:"fas fa-user-shield"},third_party_data_disclosures:{title:"Third Party Data Disclosures",icon:"fas fa-share-alt"},regulatory_exposures:{title:"Regulatory Exposures Summary",icon:""},privacy_mitigating_controls:{title:"Privacy Mitigating Controls",icon:""},historical_privacy_risks:{title:"Historical Privacy Risk Detections",icon:"fas fa-history"},informational_findings:{title:"Informational Findings",icon:"fas fa-circle-info"}},genericActions:a,privacyActions:i,get actions(){return{...a,...i}}}},52996:function(e,t,a){a.d(t,{N:function(){return o},z:function(){return n}});a(74423),a(44114),a(18111),a(22489),a(20116),a(7588),a(13579);var i=a(7639),r=a(29668);const o={recommendationsIn(e){const t=[],a=Object.keys(i.A.sections),o=r.OH,n=e.sort((e,t)=>
1a.indexOf(e.section)-a.indexOf(t.section)).filter(e=>(e.items.sort((e,t)=>{const a=o.indexOf(e.action),i=o.indexOf(t.action);return i<0?-1:a<0?1:a-i}).forEach(e=>{if(e.sub_items=e.sub_items.filter(e=>"Low"===e.severity_group?(t.push(e),!1):!e.passed),e.sub_items&&e.sub_items.length>0){const t=e.sub_items.filter(e=>!1!==e.all_recommendations),a=t.filter(e=>!1===e.passed);e.sub_items=a}}),e.items=e.items.filter(e=>e.sub_items.length>0),e.items.length>0));return t.length>0&&n.push({section:"informational_findings",items:[{action:"informational_findings",sub_items:t}]}),n},formatDate(e){if(e){let t;if(e){const a=new Date(e);let i=""+(a.getMonth()+1),r=""+a.getDate();const o=a.getFullYear();i.length<2&&(i="0"+i),r.length<2&&(r="0"+r),t=[o,i,r].join("-")}else t=null;return t}},yearIn(e){if(e)return e=e.substring(0,4),parseInt(e)},getToday(){const e=new Date,t=String(e.getDate()).padStart(2,"0"),a=String(e.getMonth()+1).padStart(2,"0"),i=e.getFullYear();return i+"-"+a+"-"+t},domainObjToArr(e){const t=[];for(const a of e)t.push(a.hostname);return t},simpleDomainsIn(e){const t=[];for(const a of e)if(t.push(a.hostname),a.subdomains)for(const e of a.subdomains)t.push(e.subdomain);return t},domainTreeIn(e){let t=0;const a=1,i=[{id:a,name:"All Domains",expanded:!0,val:!0,selected:!0,severity_breakdown:{Critical:0,High:0,Medium:0,Low:0}}];let r=1;for(const o of e){const e={categoryId:a,id:a+"_"+r,name:o.hostname,expanded:!1,val:!0,vulnerability_count:o.vulnerability_count,severity_breakdown:o.severity_breakdown};t+=o.vulnerability_count;for(const t of Object.keys(o.severity_breakdown))i[0].severity_breakdown[t]+=o.severity_breakdown[t];i.push(e);for(const t in o.subdomains){const e={categoryId:a+"_"+r,id:a+"_"+r+"_"+(parseInt(t)+1),name:o.subdomains[t].subdomain,val:!0,vulnerability_count:o.subdomains[t].vulnerability_count,severity_breakdown:o.subdomains[t].severity_breakdown};i.push(e)}r++}return i[0].vulnerability_count=t,i},vendorSearchIn(e){const t=[];for(const a of e)if(a.is_active){const e={ID:a.id,percent_complete:a.percent_complete,owner_id:a.owner_id,tags:a.tags,domains:a.domains,ipv4_cidrs:a.ipv4_cidrs,errors:this.filterErrorsIn(a.errors),total_scan_count:a.total_scan_count,in_progress_scan_count:a.in_progress_scan_count,error_scan_count:a.error_scan_count,cancel_scan_count:a.cancel_scan_count,target_name:a.target_name};t.push(e)}return t},targetIn(e){return e.year_founded=this.yearIn(e.year_founded),e["ID"]=e.id,e},targetSearchIn(e){const t=[];for(const a of e)if(a.is_active){const e={ID:a.id,target_name:a.target_name};t.push(e)}return t},targetOut(e){if(e.year_founded=e.year_founded?e.year_founded:"",e.domains=e.domains?e.domains:[],e.ipv4_cidrs=e.ipv4_cidrs?e.ipv4_cidrs:[],e.schedule_time=e.schedule_time?e.schedule_time:this.getToday(),e.schedule_type=e.schedule_type?e.schedule_type:"once",e.type=e.type?e.type:"client",e.is_active=!e.is_active||e.is_active,e.can_be_accessed_by=e.can_be_accessed_by?e.can_be_accessed_by:[],e.can_be_accessed_by.length>0){const t=[];for(const a of e.can_be_accessed_by)t.push(a.id);e.can_be_accessed_by=t}return e.locations&&e.locations.length>0&&(e.locations=e.locations.filter(e=>Object.values(e).some(e=>e&&""!==String(e).trim()))),e},vendorOut(e){if(e.domains=e.domains?e.domains:[],e.ipv4_cidrs=e.ipv4_cidrs?e.ipv4_cidrs:[],e.schedule_time=e.schedule_time?e.schedule_time:this.getToday(),e.type=e.type?e.type:"vendor",e.is_active=!e.is_active||e.is_active,e.can_be_accessed_by=e.can_be_accessed_by?e.can_be_accessed_by:[],e.can_be_accessed_by.length>0){const t=[];for(const a of e.can_be_accessed_by)t.push(a.id);e.can_be_accessed_by=t,!e.tags||e.tags}return e.locations&&e.locations.length>0&&(e.locations=e.locations.filter(e=>Object.values(e).some(e=>e&&""!==String(e).trim()))),e},targetsIn(e){const t=[];for(const a of e){let e=null;a.last_scan&&a.last_scan.posture&&(e=a.last_scan.posture);const i={ID:a.id,target_name:a.target_name,phase:a.phase,percent_complete:a.percent_complete,owner_id:a.owner_id,tags:a.tags,domains:a.domains,ipv4_cidrs:a.ipv4_cidrs,locations:a.domains.concat(a.ipv4_cidrs),errors:this.filterErrorsIn(a.errors),total_scan_count:a.total_scan_count,in_progress_scan_count:a.in_progress_scan_count,error_scan_count:a.error_scan_count,cancel_scan_count:a.cancel_scan_count,last_scan:!!a.last_scan&&a.last_scan,last_completed_scan:a.last_completed_scan?a.last_completed_scan:{completed:!1},last_scan_posture:e,schedule_type:a.schedule_type?a.schedule_type:null};t.push(i)}return t},remediationIn(e){const t=this.sevSerialize(e.severity);return e["severityCategory"]=t.category,e["severityColor"]=t.color,e["locations"]=e.domains.concat(e.ips),e},laymanDescIn(e,t){return e&&e.length>0?e:t?[t]:["Description is currently unavailable..."]},vulnIn(e){const t=this.sevSerialize(e.severity),a={category:e.category,cve:e.cve?e.cve:e.title,de
1scription:e.technical_description?e.technical_description:"",layman_description:this.laymanDescIn(e.layman_description,e.technical_description),domains:e.domains,ips:e.ips?e.ips:[],locations:e.domains.concat(e.ips),remediation:e.remediation?e.remediation:"",severity:e.severity,title:e.title?e.title:e.cve,severityCategory:t.category,severityColor:t.color};return a},radarVulnsIn(e){const t=[];for(const a of e)t.push(this.vulnIn(a));return t},sevSerialize:function(e){const t={category:"",color:""};return e>=9?(t.category="Critical",t.color="#c02741"):e>=7?(t.category="High",t.color="#eb933c"):e>=4?(t.category="Medium",t.color="#fedf40"):(t.category="Low",t.color="#4abc96"),t},scansIn(e){for(const t of e)t["timestamp"]=this.date2timeStamp(t.request_time),t["pretty_time"]=this.timeStampToDate(this.date2timeStamp(t.request_time))," "!=t["real_name"]&&null!=t["real_name"]||(t["real_name"]=t["user_name"]);return e},filterErrorsIn(e){const t={};for(const a in e){let i=[];const r=e[a];switch(a){case"hosts":i=["Search term not found"];break;case"vulnerabilities":i=["cve.circl.lu","('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))"];break;default:}t[a]=r.filter(function(e){for(const t of i)if(e.error_message.includes(t))return!1;return!0})}return t},trendsIn(e){for(const t of e)t.count_hosts=t.count_hosts?t.count_hosts:0,t.overall=t.overall?t.overall:0,t.timestamp=this.date2timeStamp(t.scan.request_time),t.vulnerable_hosts=t.vulnerable_hosts?t.vulnerable_hosts:0,t.vulnerable_services=t.vulnerable_services?t.vulnerable_services:0,t.count_vulnerabilities=t.count_vulnerabilities?t.count_vulnerabilities:0,t.count_services=t.count_services?t.count_services:0;return e.filter(e=>e.scan.errors.length<1)},date2timeStamp(e){if(e){const t=Date.parse(e);return t}},timeStampToDate(e){const t=new Date(e);return t.toLocaleDateString("en-US",{hour:"numeric",hour12:!0,minute:"numeric"})},leadingZeroMinutes(e){return(e.getMinutes()<10?"0":"")+e.getMinutes()},assembleInitialTreeVal(e){const t=[];for(const a of e)t.push(a.id);return t},hostsIn(e){for(const t of e){const e=[];for(const a of t.services)a.cves.length&&e.push(a);t["affected_services"]=e}return e},sanKeyIn(e){let t=0;for(const i of e)i.total_severity&&i.total_severity>t&&(t=i.total_severity);const a=[.25*t,.5*t,.75*t];for(const i of e)for(const e in a)i["weight"]=1,i.total_severity>a[e]&&(i["weight"]+=parseInt(e)+1);return e},summariesIn(e){return e},hostTrendsIn(e){const t=[];for(const a of e){const e={host:a.ipv4,services:a.service_count?a.service_count:0,vulns:a.cves.length,vulnerable_services:a.affected_services.length?a.affected_services.length:0};t.push(e)}return t},hostTrendsBubbleIn(e){const t=[];for(const a of e){let e=0;for(const t of a.cves)e+=t.severity;const i={host:a.ipv4,services:a.service_count?a.service_count:0,totalSeverity:e,vulns:a.cves.length,vulnerable_services:a.affected_services.length?a.affected_services.length:0};t.push(i)}return t},userOut(e){return 1===e.type?e.type="admin":e.type="user",void 0===e.send_email&&(e.send_email=!0),e},usersIn(e){for(const t of e){switch(t.date_joined=this.timeStampToDate(this.date2timeStamp(t.date_joined)),t.type){case"root":t.type=0;break;case"admin":t.type=1;break;case"user":t.type=2;break;default:t.type=0}t.send_email=!0}return e},defaultAccessMatrices(){return{user:{scan:{read:!0,create:!0,delete:!0},report:{read:!0,create:!0,update:!0,delete:!0},target:{read:!0,create:!0,update:!0,delete:!0},account:{read:!0,create:!1}},admin:{target_aggs:{delete:!1,read:!0,create:!1,update:!1},target_forms:{delete:!0,read:!0,create:!0,update:!0},target_trends:{delete:!1,read:!0,create:!1,update:!1},target:{delete:!0,read:!0,create:!0,update:!0},scan:{delete:!0,read:!0,create:!0,update:!0},report:{delete:!0,read:!0,create:!0,update:!0},account:{delete:!0,read:!0,create:!0,update:!0},user:{delete:!0,read:!0,create:!0,update:!0}}}},reportsIn(e){return e},targetsConciseIn(e){for(const t of e)t["ID"]=t.id;return e},boolsIn(e){return e?"Yes":"No"},tweikAssessmentIn(e){const t=[];for(const a in e){const i=t.find(t=>
1t.id===e[a].section);i||t.push({id:e[a].section,label:e[a].section,items:[]}),t.find(t=>t.id===e[a].section).items.push(e[a])}for(const a of t)a.items=this.serializeAssessmentItems(a.items);return this.reorderAssessment(t)},serializeAssessmentItems(e){if(e){const t=[];for(const a in e){const i=e[a].section_short_id+"-"+e[a].subsection,r=t.find(e=>e.id===i);r||t.push({id:i,label:e[a].subsection,items:[]}),t.find(e=>e.id===i).items.push(this.serializeAssessmentItem(e[a]))}for(const e of t)e.items.sort((e,t)=>e.id>t.id?1:-1);return t}return[]},serializeAssessmentItem(e,t){return e["type"]="nist",e["uniqueKey"]=t,"TRUE"===e.required||"true"===e.require?e.required=!0:e.required=!1,"Domain/IP array"===e.type&&(e.type="domain ip array"),e},reorderAssessment(e){const t=e.find(e=>"IDENTIFY"===e.id),a=e.find(e=>"PROTECT"===e.id),i=e.find(e=>"DETECT"===e.id);let r=e.find(e=>"RESPOND"===e.id);r||(r=e.find(e=>"RESPONSE"===e.id));const o=e.find(e=>"RECOVER"===e.id);return[t,a,i,r,o]},arrayMove(e,t,a){if(a>=e.length){let t=a-e.length+1;while(t--)e.push(void 0)}return e.splice(a,0,e.splice(t,1)[0]),e}},n={in(e){const t={domains:e.domains,ipv4_cidrs:e.ipv4_cidrs};return e["domIps"]=t,e.year_founded=parseInt(e.year_founded),e["primary_contact_email"]=e["primary_contact_email"]?e["primary_contact_email"]:"",e},out(e){if(e.year_founded=e.year_founded?e.year_founded:"",e.domains=e.domains?e.domains:[],e.ipv4_cidrs=e.ipv4_cidrs?e.ipv4_cidrs:[],e.schedule_time=e.schedule_time?e.schedule_time:o.getToday(),e.schedule_active=!1,e.schedule_type=e.schedule_type?e.schedule_type:"once",e.type=e.type?e.type:"client",e.is_active=!e.is_active||e.is_active,e.can_be_accessed_by=e.can_be_accessed_by?e.can_be_accessed_by:[],e.can_be_accessed_by.length>0){const t=[];for(const a of e.can_be_accessed_by)t.push(a.id);e.can_be_accessed_by=t}for(const t in e.locations[0])""===e.locations[0][t]&&delete e.locations[0][t];return 0===Object.keys(e.locations[0]).length&&(e.locations=[]),e},serializeCustomerItem(e){return"TRUE"===e.required||"true"===e.require?e.required=!0:e.required=!1,Array.isArray(e.values)&&(e.values=e.values.filter(e=>{if(e.id)return!0})),"Domain/IP array"===e.type&&(e.type="domain ip array"),"customer_entity_type"===e.id&&(e["deps"]=null),e}}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.