API Fields: Risk Types

Not all risk types are returned by the Bitsight API. Access is controlled on a per-organization level (i.e., an organization must have the right subscriptions) and depends on the endpoint.

Bitsight risk types are grouped in the following manner:

• Compromised Systems
  • Botnet Infections
  • Spam Propagation
  • Malware Servers
  • Unsolicited Communications
  • Potentially Exploited
• Diligence
  • SPF Domains
  • DKIM Records
  • TLS/SSL Certificates
  • TLS/SSL Configurations
  • Open Ports
  • Web Application Headers
  • Patching Cadence
  • Insecure Systems
  • Server Software
  • Desktop Software
  • Mobile Software
  • DNSSEC Records
  • Mobile Application Security
  • Domain Squatting
• User Behavior
  • File Sharing
  • Exposed Credentials
• Public Disclosures
  • Security Incidents
  • Other Disclosures
• Vulnerability

Compromised Systems

The Compromised Systems risk category indicates the presence of malware or unwanted software, which is evidence of security controls failing to prevent malicious or unwanted software from running within an organization.

Name: Compromised Systems

Botnet Infections

The Botnet Infections risk vector indicates that devices on a company’s network are participating in a botnet (combination of “robot” and “network”), either as bots or as a command and control (C&C or C2) server.

Names:

• Botnet Infections
• botnet_infections
• botnet

Spam Propagation

The Spam Propagation risk vector is composed of spambots, where a device on a company’s network is unsolicitedly sending commercial or bulk email (spam). If spam originates from email addresses or devices within a company’s network, this is an indication of an infection.

Names:

• Spam Propagation
• spam_propagation
• spam

Malware Servers

The Malware Servers risk vector is an indication that a system is engaging in malicious activity, such as phishing, fraud, or scams. A company’s network is hosting malware that is meant to lure visitors to a website or send a file that injects malicious code or viruses.

Names:

• Malware Servers
• malware_servers
• mal_server

Unsolicited Communications

The Unsolicited Communications risk vector indicates a host is trying to contact a service on another host. It might be attempting to communicate with a server that is not providing or advertising any useful services, the attempt may be unexpected, or the service is unsupported. This also accounts for hosts that might be scanning darknets.

Names:

• Unsolicited Communications
• unsolicited_comm
• unexp_comm

Potentially Exploited

The Potentially Exploited risk vector indicates that a device on a company’s network is running a potentially unwanted program (PUP) or potentially unwanted application (PUA).

Names:

• Potentially Exploited
• potentially_exploited
• pot_exploited

Diligence

The Diligence risk category assesses the steps a company has taken to prevent attacks, their best practice implementation, and risk mitigation (e.g., server configurations) to determine if the security practices of an organization are on par with industry-wide best practices.

Name: Diligence

SPF Domains

The SPF Domains risk vector assesses the effectiveness of Sender Policy Framework (SPF) records, which are DNS records that identify mail servers permitted to send email on behalf of a domain. Properly configured SPF records ensure that only authorized hosts can send email on behalf of a company by providing receiving mail servers the information they need to reject mail sent by unauthorized hosts.

Names:

• SPF
• spf

DKIM Records

The DKIM Records risk vector assesses the effectiveness of DomainKeys Identified Mail (DKIM) records, which is a countermeasure against adversaries that are attempting to send fake email by using a company’s email domain. Properly configured DKIM records can ensure that only authorized hosts can send email on behalf of a company.

Names:

• DKIM
• dkim

TLS/SSL Certificates

The TLS/SSL Certificates risk vector evaluates the strength and effectiveness of the cryptographic keys within TLS and SSL certificates, which are used to encrypt internet traffic. Certificates are responsible for verifying the authenticity of company servers to associates, clients, and guests, and also serves as the basis for establishing cryptographic trust.

Names:

• SSL Certificates
• ssl_certificates
• certificate

TLS/SSL Configurations

The TLS/SSL Configurations risk vector determines if the used security protocol libraries support strong encryption standards when making connections to other machines. TLS/SSL is a widely used method of securing communications over the Internet.

Names:

• SSL Configurations
• ssl_configurations
• ssl

Open Ports

The Open Ports risk vector observes ports that are exposed to the Internet, known as “open ports.” While certain ports must be open to support normal business functions and few companies will actually have no ports open, the fewer ports that are exposed to the Internet, the fewer openings there are for attack.

Names:

• Open Ports
• open_ports
• open_port

Web Application Headers

The Web Application Headers risk vector analyzes security-related fields in the header section of communications between users and an application. They contain information about the messages, determine how to receive messages, and how recipients should respond to a message.

Names:

• Web Application Headers
• application_security
• http_headers

Patching Cadence

The Patching Cadence risk vector evaluates systems that are affected by software vulnerabilities (holes or bugs in software, hardware, or encryption methods that can be used by attackers to gain unauthorized access to systems and their data) and how quickly any issues are fixed.

Names:

• Patching Cadence
• patching_cadence
• pc

Insecure Systems

The Insecure Systems risk vector assesses endpoints (which can be any computer, server, device, system, or appliance with internet access) that are communicating with an unintended destination. The software of these endpoints may be outdated, tampered, or misconfigured. A system is classified as “insecure” when these endpoints try to communicate with a web domain that doesn’t yet exist or isn’t registered to anyone.

Names:

• Insecure Systems
• insecure_systems
• insecure_sys

Server Software

The Server Software risk vector helps track security problems introduced by server software that is no longer supported. Supported software versions receive attention from the software development team and vendor when bugs or vulnerabilities are discovered.

Names:

• Server Software
• server_software

Desktop Software

The Desktop Software risk vector compares the version information of laptop and desktop software with the latest and currently available software versions to determine if the device software is supported or out-of-date.

Names:

• Desktop Software
• desktop_software
• endpoint_pc

Mobile Software

The Mobile Software risk vector compares the version information of mobile device operating systems and browsers with the latest and currently available software versions to determine if the device software is supported or out-of-date.

Names:

• Mobile Software
• mobile_software
• endpoint_mobile

DNSSEC Records

The DNSSEC Records risk vector determines if a company is using the DNSSEC protocol, which is a public key encryption that authenticates DNS servers, and then assesses the effectiveness of its configuration. The DNSSEC protocol protects against DNS spoofing, which involves diverting traffic to an attacker’s computer, creating an opportunity for loss of confidentiality, data theft, etc.

Names:

• DNSSEC
• dnssec

Mobile Application Security

The Mobile Application Security risk vector analyzes the security aspects of an organization’s mobile application offerings that are publicly available in official marketplaces, such as the Apple App Store and Google Play.

Names:

• Mobile Application Security
• mobile_application_security
• mobile_appsec

Domain Squatting

The Domain Squatting risk vector detects the presence of domains named similarly to those that are owned and trademarked by an organization. Detection for these types of domains is based on information provided by DNS queries.

User Behavior

The User Behavior risk category assesses employee activity, such as file sharing and password re-use.

Name: User Behavior

File Sharing

The File Sharing risk vector tracks the sharing of files, such as books, music, movies, TV shows, and applications. This includes files shared over the BitTorrent protocol or when observed on company infrastructure.

Names:

• File Sharing
• file_sharing
• torrent

Exposed Credentials

The Exposed Credentials risk vector looks at verified breaches to indicate if the employees of a company had their information publicly disclosed and posted online as a result of a successful cyber attack on their company’s third parties.

Name: Exposed Credentials

Public Disclosures

The Public Disclosures risk category provides information related to possible incidents of undesirable access to a company’s data, including breaches, general security incidents, and other disclosures. Information is collected from verifiable news sources, both domestic and international, and by filing Freedom of Information Act (FOIA) requests.

Name: Public Disclosures

Security Incidents

The Security Incidents risk vector involves a broad range of events related to the undesirable access of a company’s data or resources, including personal health information, personally identifiable information, trade secrets, and intellectual property. They’re grouped into Breach Security Incidents and General Security Incidents.

Names:

• Security Incidents
• data_breaches
• Breach Security Incident = breach
• General Security Incident = general

Other Disclosures

The Other Disclosures risk vector includes other kinds of publicly disclosed events. It’s considered to be the least severe among the Public Disclosures risk vectors.

Name: other

Vulnerability

Learn more about vulnerabilities.

Name: vulnerability