Security Culture Indicators

5 automated security scanners

Security Champion Program Erosion

Purpose: The Security Champion Program Erosion Scanner is designed to detect signs of disengagement within an organization by analyzing meeting frequency, initiative reduction, and overall security culture indicators through publicly available data sources.

What It Detects:

Meeting Frequency Decline: Identifies a decrease in the number of meetings related to security initiatives, indicating reduced engagement in regular security discussions or updates.
Initiative Reduction: Detects a reduction in the number of new security-related projects or initiatives being launched, analyzing LinkedIn posts, GitHub repositories, and news articles for mentions of security projects.
Security Champion Activity on GitHub: Monitors activity levels of security champions on GitHub, including commits, pull requests, and issues, to identify reduced contributions to security-related repositories.
News and Media Coverage: Analyzes news articles and press releases for mentions of security initiatives or champion activities, detecting a decline in positive media coverage related to the company’s security efforts.
Job Board Analysis: Examines job postings on technology-focused job boards for changes in security-related roles or responsibilities, identifying reduced emphasis on security skills or certifications in job descriptions.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This input is crucial for searching relevant data sources such as LinkedIn posts, GitHub repositories, and news articles related to the company’s security initiatives.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - This helps in customizing search queries to extract specific information about the organization’s activities in the realm of cybersecurity.

Business Impact: Monitoring the disengagement of security champions is critical as it directly impacts an organization’s ability to maintain a robust and proactive security posture. A decline in engagement can lead to reduced innovation, increased vulnerability, and potential compliance issues that could have significant financial and reputational consequences.

Risk Levels:

Critical: Conditions that pose immediate threats to the organization’s cybersecurity posture, such as consistent reduction in meeting frequency or a notable decrease in security-related project launches over an extended period.
High: Situations where there is a noticeable decline in activity from key security champions on GitHub, indicating potential disengagement.
Medium: Occurrences of reduced engagement indicated by fewer mentions of the company’s security initiatives in news articles or job postings.
Low: Informal findings that do not significantly impact the organization’s security posture but are still indicative of a less proactive approach to cybersecurity.
Info: General informational outputs from data collection, providing baseline insights into organizational activities related to security.

Example Findings:

“Meeting frequency decline detected: last quarterly security meeting was canceled” - Indicates a significant reduction in the frequency of critical security meetings.
“Initiative reduction detected: new security project launch has been delayed” - Suggests that there is a slowdown or pause in launching new security projects, which could be indicative of broader disengagement issues within the organization’s security team.

Security Awareness Response Degradation

Purpose: The Security Awareness Response Degradation Scanner is designed to detect potential issues related to cybersecurity within an organization by analyzing publicly available data sources such as GitHub repositories, news articles, job board postings, and SEC filings. This tool aims to identify increases in phishing failures, decreases in report rates, and declines in security recognition, providing insights that can help improve organizational security posture.

What It Detects:

Phishing Failure Increase: Identifies mentions of increased phishing attempts or successful phishing incidents, indicating a rise in phishing-related security issues.
Report Rate Decrease: Analyzes incident reports and breach disclosures to identify any reduction in the frequency of reported security incidents, suggesting fewer security incidents are being publicly disclosed.
Recognition Decline: Evaluates job board postings and LinkedIn profiles for declining mentions of key cybersecurity certifications and technologies, indicating a decrease in the recognition or emphasis on cybersecurity skills and tools within the organization.
Breach Mentions: Searches for specific breach-related terms to identify recent security incidents that may have compromised sensitive information.
Technology Stack Disclosure: Examines job board postings, LinkedIn profiles, and GitHub repositories for mentions of key technologies like AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, and Elastic, which can help assess the security practices and technology stack within the organization.

Inputs Required:

domain (string): The primary domain to analyze, such as “acme.com,” providing a context for data collection from various sources.
company_name (string): The company name for statement searching, like “Acme Corporation,” which helps in targeting specific information during the analysis process.

Business Impact: This scanner is crucial for organizations looking to maintain and enhance their cybersecurity posture by proactively identifying potential weaknesses and areas of improvement. By detecting early signs of security degradation, such as increased phishing failures or reduced reporting rates, organizations can take immediate action to mitigate risks and improve overall security awareness and response mechanisms.

Risk Levels:

Critical: Conditions that directly lead to significant data breaches or severe system vulnerabilities are considered critical. These include but may not be limited to the discovery of unauthorized access in GitHub repositories or high-profile data breaches mentioned in SEC filings.
High: Issues such as prominent mentions of security incidents in news articles and job board postings, indicating a higher risk of compromised information, are classified as high severity.
Medium: Medium risk findings involve subtle indicators like decreased references to specific cybersecurity tools or certifications across various platforms, which still pose significant risks but may not be as immediately critical as those at the high level.
Low: Informational findings include mentions of technology stack changes that do not necessarily indicate immediate security threats but are indicative of potential future issues or lack of investment in advanced security practices.
Info: These are generally non-critical, informative alerts about general cybersecurity trends and awareness within the organization’s ecosystem.

If specific risk levels are not detailed in the README, they have been inferred based on the purpose and impact of the scanner.

Example Findings:

A notable increase in phishing attempts mentioned across multiple platforms could indicate a higher vulnerability to social engineering attacks, posing a critical risk to sensitive information.
Reduced reporting rates from previous years might suggest inadequate security measures or lack of awareness training among employees, which is classified as high risk due to potential exposure of the organization’s assets and reputation.

Security Leadership Visibility Reduction

Purpose: The Security Leadership Visibility Reduction Scanner is designed to identify potential weaknesses in executive communication strategies related to cybersecurity. By analyzing patterns of messaging and topic avoidance, this tool aims to detect reduced visibility and commitment to cybersecurity within organizations.

What It Detects:

Executive Messaging Decrease: This involves testing for a reduction in the frequency and prominence of executive communications on security topics. The scanner checks for fewer mentions of security topics in press releases, annual reports, and company blogs, as well as a decline in the number of security-related statements from leadership.
Security Topic Avoidance: It detects avoidance of specific security terms and phrases in public communications. This includes checking for omission of security incidents, vulnerabilities, and risk factors in official statements, along with reduced detailed discussions about cybersecurity strategies and initiatives.
Priority Shift Signals: The scanner tests for shifts in organizational priorities away from security towards other business areas. It also checks for increased focus on non-security topics in executive communications and reduced allocation of resources to cybersecurity projects and initiatives.
Security Incident Coverage Analysis: This involves detecting reduction in coverage of security incidents in news articles, press releases, and company blogs. The scanner looks for fewer detailed descriptions of security breaches and their impacts, as well as a decline in the number of security-related media appearances by executives.
Risk Factor Disclosures: It tests for reduced disclosure of risk factors related to cybersecurity in SEC filings. This includes checking for omission of specific security risks and vulnerabilities in annual reports and potential security threats and mitigation strategies.

Inputs Required:

domain (string): The primary domain to analyze, such as “acme.com”.
company_name (string): The company name used for statement searching, such as “Acme Corporation”.

Business Impact: This scanner is crucial for assessing the cybersecurity posture of organizations by monitoring executive communications and ensuring that security remains a priority in organizational strategies. Weaknesses in these areas can lead to inadequate risk management and increased vulnerability to cyber threats.

Risk Levels:

Critical: Significant reduction or absence of any mention of security incidents, vulnerabilities, or related topics in public statements from executives.
High: Reduced frequency and prominence of security communications in official documents like annual reports and press releases.
Medium: Omission of detailed discussions about cybersecurity strategies and initiatives in executive communications.
Low: Minor reduction in coverage of security incidents in media appearances or online mentions.
Info: Minimal impact on public statements, with no significant deviations from typical communication patterns.

Example Findings:

A company consistently avoids mentioning specific security terms like “data breach” and “cybersecurity risk” in its annual reports, indicating a potential shift away from prioritizing cybersecurity.
Inconsistent or reduced coverage of security incidents in recent press releases compared to previous years, suggesting possible neglect in this area.

Policy Exception Normalization

Purpose: The Policy_Exception_Normalization Scanner is designed to identify potential security culture issues by detecting increasing waivers, standard exemptions, and requirement relaxations in organizational policies. It analyzes public records, OSINT sources, and security disclosures to help identify compromised policy adherence.

What It Detects:

Waiver Mentions: Identifies instances of waived requirements or exceptions from established policies.
Standard Exemptions: Detects mentions of standard exemptions or carve-outs in organizational policies.
Requirement Relaxation: Identifies cases where security requirements are relaxed or modified to accommodate certain conditions.
Policy Deviation Statements: Detects statements indicating deviation from the original policy guidelines.
Security Incident Waivers: Identifies mentions of waivers related to security incidents, such as breaches.

Inputs Required:

domain (string): The primary domain under analysis, which helps in searching for relevant policies and disclosures.
company_name (string): The name of the company whose policy exceptions are being evaluated, aiding in targeted search queries.

Business Impact: This scanner is crucial as it alerts to potential weaknesses in security protocols where requirements might be overlooked or exempted without proper justification. Such complacency can lead to significant vulnerabilities that could compromise organizational security posture and compliance with regulatory standards.

Risk Levels:

Critical: Severe deviations from policy guidelines, direct compromises of critical security measures, and documented instances of non-compliance with legal or contractual obligations.
High: Significant exceptions or relaxations in policies that affect key security controls, leading to potential risks in areas such as data protection and operational resilience.
Medium: Minor deviations or relaxed requirements that might not directly impact critical functions but could indicate broader issues in policy enforcement across the organization.
Low: Informal waivers of non-critical procedures where compliance does not significantly affect security posture, typically indicating a need for improved clarity in communication and understanding of policies.
Info: Routine exceptions or relaxations that do not pose immediate risk but could be indicative of evolving policy interpretation or procedural changes over time.

Example Findings:

“The company has waived the requirement for routine quarterly security audits, which might indicate a lack of commitment to maintaining up-to-date security measures.”
“Exemptions from standard compliance checks are granted without clear justification in policies designed to ensure third-party vendor security standards are met.”

Security Training Engagement Decline

Purpose:
The Security Training Engagement Decline Scanner is designed to identify declines in security training completion rates, knowledge retention, and participation levels within an organization by analyzing publicly available data sources. This tool helps assess the effectiveness of ongoing security awareness programs.

What It Detects:

Completion Rate Drops: Identifies mentions of declining or reduced completion rates for security training programs.
Knowledge Retention Decrease: Looks for indications of reduced knowledge retention among employees post-training.
Participation Reduction: Identifies reductions in employee participation in security training sessions or programs.
Training Program Changes: Analyzes changes in the structure, frequency, or content of security training programs that might indicate a decline in effectiveness.
Security Incident Correlation: Correlates detected declines with recent security incidents to determine if there is a potential link between reduced training and increased vulnerabilities.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact:
Assessing the effectiveness of security training programs is crucial for maintaining a robust security posture within an organization. Ineffective or declining training can lead to increased vulnerabilities and potential security incidents, impacting both operational efficiency and sensitive data protection.

Risk Levels:

Critical: Severe declines in completion rates, significant knowledge retention issues, and substantial participation reductions that correlate with known security incidents.
High: Moderate decreases in any of the monitored training metrics without immediate corrective action plans or documented mitigation strategies.
Medium: Slight drops in completion rates or engagement levels, potentially indicating a need for improvement but not immediately critical.
Low: Minimal changes in training metrics that do not significantly impact security posture or compliance requirements.
Info: Informal feedback from employees about training effectiveness without concrete data to support specific concerns.

Example Findings:

“Recent reports indicate a decline in the completion rates for our phishing simulation training, which has been linked to increased instances of social engineering attacks.”
“There have been indications that knowledge retention among staff regarding basic security protocols has significantly dropped over the past year.”