Hiring Intelligence

5 automated security scanners

Recruiter Communication Analysis

Purpose: The Recruiter Communication Analysis Scanner is designed to identify and analyze internal details within public communications from recruiters that could potentially expose sensitive information such as data breaches, unauthorized access, compromised systems, specific technology stack disclosures, certification claims, subdomain discoveries, and mentions in news articles or job boards.

What It Detects:

Breach Mentions: The scanner detects references to data breaches, security incidents, unauthorized access, or compromised systems within public communications from recruiters.
Tech Stack Disclosure: It identifies mentions of specific technology stacks like AWS, Azure, GCP, and Kubernetes, which could indicate internal technical details that should be protected.
Certification Claims: The scanner looks for claims related to certifications such as SOC 2, ISO 27001, PCI DSS, or HIPAA compliance.
Subdomain Discovery: By utilizing Certificate Transparency logs, the scanner discovers subdomains that might reveal additional infrastructure details not publicly known.
News and Job Board Analysis: The scanner searches news articles and job boards for mentions of the company which may include sensitive information or technical disclosures.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps in identifying potential security risks associated with unintentional disclosure of sensitive company information, which could lead to data breaches and loss of trust among stakeholders. It ensures that internal technical details remain protected from unauthorized access or public exposure.

Risk Levels:

Critical: Conditions where there are clear indications of significant data breaches or unauthorized access attempts should be considered critical.
High: High severity findings include explicit mentions of specific technology stacks and certification claims, which could lead to internal technical details being disclosed.
Medium: Medium severity includes subdomain discoveries and mentions in news articles that might hint at sensitive information but are not direct breaches or disclosures.
Low: Low severity involves general company mentions on job boards without explicit technical or sensitive content.
Info: Informational findings pertain to the presence of technology stack disclosures and certification claims, which while revealing internal details, do not pose immediate critical threats.

Example Findings:

A recruiter mentioning a specific data breach in an email thread that could lead to unauthorized access attempts.
An AWS mention in a job description for a senior cloud architect position, indicating potential exposure of internal technology stack details.

Interview Question Leakage

Purpose: The Interview Question Leakage Scanner is designed to identify potential vulnerabilities by detecting the leakage of internal application names, architecture details, and security processes through publicly available sources such as GitHub repositories, job boards, news articles, and other online platforms. This helps in identifying potential threats that could be exploited by external actors.

What It Detects:

Internal Application Names: Identifies mentions of specific internal application names in public repositories, job postings, and news articles.
Architecture Details: Discovers detailed descriptions of the company’s architecture, including technologies used (e.g., AWS, Azure, GCP).
Security Processes: Detects mentions of internal security processes and certifications claimed by the company.
Code Leaks: Searches for sensitive code snippets or configuration files that may have been inadvertently shared in public repositories.
Breach Mentions: Identifies references to data breaches, security incidents, and unauthorized access attempts.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps in safeguarding sensitive information and intellectual property by detecting unauthorized disclosure of internal applications, architecture details, and security processes through public channels. Such disclosures could lead to significant risks such as data breaches, unauthorized access, and loss of competitive advantage.

Risk Levels:

Critical: Conditions that directly compromise the confidentiality, integrity, or availability of critical systems or sensitive information are considered critical.
High: Conditions that pose a high risk of exposing internal processes or compromising security measures are considered high.
Medium: Conditions that may lead to moderate exposure but do not significantly impact system functionality are considered medium.
Low: Informal mentions or non-critical details that do not directly affect security posture are considered low.
Info: Informational findings include general statements about the company’s capabilities without specific detail that could be actionable for an attacker.

If risk levels are not specified in the README, it can be inferred that critical risks are those with immediate and severe consequences, high risks involve significant exposure but do not compromise core functionality, medium risks indicate a potential issue requiring attention, low risks are minimal concerns, and informational findings provide general context without actionable implications.

Example Findings:

An internal application name “acme_tool” was found in a public GitHub repository.
Detailed architecture details including AWS and Kubernetes were discovered in configuration files within multiple repositories.
The company claims to be SOC 2 Type 1 certified, which is mentioned in job descriptions on Indeed.

Hiring Platform Correlation

Purpose: The Hiring_Platform_Correlation Scanner is designed to identify potential security vulnerabilities that could be exploited during hiring processes by detecting breach windows aligned with recruiting activities and critical role vacancies through analysis of public records and OSINT sources.

What It Detects:

Breach Mentions in Public Records: Identifies mentions of data breaches, security incidents, unauthorized access, or compromised information in various public sources.
Tech Stack Disclosure on Job Boards: Discovers technology stack disclosures related to AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, and Elastic in job postings.
Certification Claims in Company Descriptions: Detects claims of SOC 2, ISO 27001, PCI DSS, and HIPAA compliance in company descriptions or security pages.
Subdomain Discovery via Certificate Transparency: Identifies subdomains associated with the target domain using Certificate Transparency logs to uncover potential attack surfaces.
Security Incident Coverage in News Articles: Searches for news articles covering security incidents related to the target company, providing additional context on breaches and vulnerabilities.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner helps organizations proactively identify potential security risks during the hiring process, allowing them to take preemptive measures to mitigate vulnerabilities that could be exploited by malicious actors during critical hiring phases.

Risk Levels:

Critical: Conditions where there are active data breaches or unauthorized access incidents directly linked to the company’s public records and job postings.
High: Conditions where significant technology stack disclosures without adequate security measures are disclosed in job listings, potentially exposing sensitive information.
Medium: Conditions where minor certification claims exist but lack detailed compliance documentation or clear evidence of implementation.
Low: Conditions where minimal subdomains are discovered through Certificate Transparency logs, indicating a lower risk profile for the company’s infrastructure.
Info: Conditions where general news coverage mentions the company without specific security incident details.

Example Findings:

A job posting mentioning AWS and Kubernetes but lacking detailed security protocols could be flagged as a high-risk finding due to potential exposure of sensitive cloud configurations.
A data breach mention in public records that coincides with an active hiring campaign for roles potentially linked to the compromised information could indicate critical risk, suggesting immediate review of recruitment practices and enhanced security measures.

Job Description Exposure

Purpose: The Job Description Exposure Scanner is designed to uncover sensitive information such as technology stack, project details, and team structure disclosed in publicly available job descriptions. This information can be exploited by potential adversaries to gain insights into a company’s internal operations and vulnerabilities, posing significant security risks.

What It Detects:

Technology Stack Disclosure: Identifies mentions of specific cloud providers (AWS, Azure, GCP) and references to infrastructure tools (Terraform, Ansible, Docker), as well as security and monitoring tools (Splunk, Datadog, Elastic).
Project Revelations: Uncovers detailed descriptions of ongoing or completed projects, identifying the technologies used in these projects.
Team Structure: Reveals the roles and responsibilities within the team, including key personnel involved in critical projects, and detects hierarchical structures and reporting lines.
Security Advisories: Scans for security-related advisories or disclosures, looking for mentions of vulnerabilities or past incidents, as well as references to compliance standards (SOC 2, ISO 27001).

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com, which helps in searching job descriptions related to this domain.
company_name (string): The company name for statement searching, e.g., “Acme Corporation,” which is used to filter relevant job descriptions containing information about the company’s projects and team.

Business Impact: This scanner is crucial as it helps in identifying potential leaks of sensitive corporate information that could be exploited by external parties, potentially leading to security breaches or intellectual property theft. It underscores the importance of maintaining strict controls over publicly available job descriptions to safeguard internal operations and sensitive data.

Risk Levels:

Critical: Exposure of highly sensitive information such as detailed project plans, specific technology usage in projects, and detailed team structures that could lead directly to actionable threats or breaches.
High: Disclosure of general technology stack details without specificity, which might still be valuable but less critical for direct threat actions.
Medium: Mentions of compliance standards like SOC 2 or ISO 27001, indicating potential regulatory and security obligations that need to be managed carefully.
Low: General statements about having a “strong” team or using common tools without specific references, which are less likely to pose immediate risks but should still be monitored for broader compliance and information exposure.
Info: Informational findings such as mentions of general industry practices or public availability of job descriptions that do not directly reveal internal operations.

If the README doesn’t specify exact risk levels, infer them based on the scanner’s purpose and impact.

Example Findings: The scanner might flag a specific mention of AWS usage in a job description as critical if it indicates involvement with high-value cloud projects, or as low if it merely states general experience without detail. Similarly, detailed descriptions of completed projects could be flagged as high risk if they include proprietary technology not publicly disclosed elsewhere.

CV Database Security

Purpose: The CV_Database_Security Scanner is designed to identify and alert users about potential exposure of candidate personally identifiable information (PII) and hiring manager details through publicly available sources such as GitHub, LinkedIn, news articles, job boards, and SEC filings. This tool helps in identifying potential security risks related to the handling of sensitive recruitment data.

What It Detects:

Candidate PII Exposure: The scanner detects patterns indicative of candidate PII exposure on public repositories or codebases by searching for common PII fields such as names, email addresses, phone numbers, and social security numbers using regex patterns.
Hiring Manager Details: Identifies mentions of hiring manager details in publicly accessible documents and job postings, looking for patterns that may reveal personal information about hiring managers.
Breach Mentions: Searches for terms related to data breaches or unauthorized access in public records and news articles, using regex patterns such as “data breach”, “security incident”, “unauthorized access”, and “compromised”.
Tech Stack Disclosure: Identifies mentions of specific technology stacks used by the company, which could be relevant to security assessments.
Certification Claims: Detects claims of certifications that may indicate compliance or security measures, searching for patterns like SOC 2, ISO 27001, PCI DSS, and HIPAA compliant.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps in identifying and mitigating potential risks associated with the unauthorized exposure of sensitive recruitment data, which could lead to significant privacy violations and legal repercussions. Ensuring the security of candidate information is paramount for maintaining trust and compliance with regulations such as GDPR and HIPAA.

Risk Levels:

Critical: Conditions that directly lead to a high likelihood of severe data breaches or significant exposure of sensitive information are considered critical. This includes any breach disclosure statements in public records, unauthorized access detected in repositories, and mentions of security incidents without mitigation measures.
High: High risk conditions involve substantial exposure of candidate PII through public codebases or mentions that suggest potential vulnerabilities in the company’s data handling practices.
Medium: Medium risk conditions pertain to moderate exposure of information and include general mentions of breaches, unauthorized access attempts, and lack of disclosure about technology stacks used by the company.
Low: Low risk conditions are informational findings such as generic breach mentions not specifying details or minor exposures that do not pose significant security threats.
Info: Informational findings provide context but generally do not indicate active risks unless escalated to higher severity levels.

Example Findings:

The scanner flagged a public GitHub repository containing candidate resumes with PII fields clearly visible, posing a high risk of exposure.
A job posting on the company’s career page inadvertently disclosed details of one of its hiring managers, which was considered a critical risk due to potential misuse by unauthorized parties.