Digital Resilience

5 automated security scanners

Recovery Automation

Purpose: The Recovery Automation Scanner is designed to detect automated recovery and self-healing systems within an organization’s security documentation. Its primary objective is to ensure robust incident response capabilities by identifying whether the company has mechanisms in place to automatically recover from security incidents without manual intervention.

What It Detects:

Automated Recovery Indicators: The scanner looks for mentions of automated recovery processes, self-healing system descriptions, presence of automated failover mechanisms, references to automatic response protocols, and any mention of autonomous incident resolution.
Policy Indicators: It searches security policy documents, incident response plans, data protection policies with automated components, access control measures that are automated, and compliance certifications related to automated systems for mentions of automation.
Maturity Indicators: The scanner tests for SOC 2 compliance mentions, ISO 27001 standards referencing automation, penetration test results indicating automated recovery, vulnerability scan reports mentioning automated response, and any certification or assessment that includes automation.
Technical Documentation References: It searches technical documentation describing automated systems, architecture diagrams showing automated components, code repositories with automated scripts, configuration files related to automated processes, and technical guides on setting up automated recovery.
Public Policy Pages and Trust Center Information: The scanner tests public policy pages for mentions of automation, checks trust center information for automated response capabilities, verifies compliance certifications displayed on the website, detects any press releases or announcements about automated systems, and flags any blog posts or news articles discussing automation.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This is necessary for the scanner to gather information from the specified company website.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - This helps in contextually relevant search queries and results extraction.

Business Impact: Identifying automated recovery mechanisms within an organization’s security documentation is crucial as it directly impacts the efficiency of incident response, potentially reducing downtime and minimizing manual labor required during incidents. It also enhances overall cybersecurity posture by ensuring proactive rather than reactive measures are in place.

Risk Levels:

Critical: Findings that indicate a complete absence or significant deficiency in automated recovery mechanisms, which could lead to severe consequences such as prolonged downtime or high impact on business operations.
High: Findings that suggest limitations in automation capabilities, posing potential risks of delayed response times or increased manual intervention required during incidents.
Medium: Findings that indicate partial coverage or moderate reliance on automated systems, suggesting a need for improvement to enhance overall incident handling efficiency.
Low: Findings that show minimal reliance on automation with significant manual processes, indicating room for optimization in the deployment of automated recovery mechanisms.
Info: Non-critical findings that provide basic awareness about existing automation within specific areas but do not significantly impact overall security posture or response times.

Example Findings:

A company’s incident response plan mentions a fully automated failover mechanism, indicating high criticality for its ability to recover from incidents without significant human intervention.
In technical documentation, there are no references to automated scripts used in routine tasks, suggesting medium risk due to potential manual overload during operations.

Service Degradation Planning

Purpose: The Service Degradation Planning Scanner evaluates a company’s ability to maintain essential functions during service degradation by analyzing their security documentation, public policies, and compliance certifications. This helps ensure that organizations can gracefully degrade services while preserving critical operations.

What It Detects:

Identifies the presence of comprehensive security policies.
Checks for incident response plans.
Verifies data protection measures.
Ensures access control protocols are in place.
Confirms SOC 2 compliance.
Validates ISO 27001 certification.
Looks for penetration testing records.
Detects vulnerability scanning or assessment activities.
Analyzes trust center pages for transparency and detailed security information.
Checks for incident response timelines and procedures.
Verifies communication strategies during service degradation.
Scans for mentions of relevant compliance certifications.
Ensures adherence to industry standards and regulations.
Validates the presence of third-party audits or assessments.
Reviews public policy pages for security-related content.
Checks for disaster recovery plans.
Verifies business continuity strategies.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations prepare for and mitigate the risks associated with service degradation, ensuring that security measures are in place to protect sensitive data and maintain critical operations during such events.

Risk Levels:

Critical: The presence of incomplete or inadequate security policies, lack of incident response plans, or failure to comply with relevant standards can lead to severe consequences including significant data breaches and operational disruptions.
High: Inadequate data protection measures, poor access control protocols, or missing compliance certifications can expose the organization to high risks, potentially leading to substantial financial losses or regulatory penalties.
Medium: While less critical than those at higher risk levels, medium severity issues still pose significant threats such as partial service degradation and potential legal liabilities if not addressed promptly.
Low: Informational findings may include minor discrepancies in security practices that do not significantly impact the organization’s operations but are nonetheless important for continuous improvement.
Info: These findings provide general insights into the company’s approach to information security, which can be useful for understanding broader security posture and best practices adherence.

Example Findings:

The company lacks a comprehensive security policy that covers all critical aspects of its operations.
There are no documented incident response plans in place, making it difficult to recover from potential security breaches efficiently.

Chaos Engineering

Purpose: The Chaos Engineering Scanner is designed to detect fault injection, resilience testing, and recovery validation within systems. Its purpose is to ensure that these systems can effectively withstand unexpected failures and recover swiftly, thereby maintaining digital resilience and ensuring business continuity.

What It Detects:

Fault Injection Indicators: Identifies mentions of fault injection techniques such as network disruptions, service outages, or data corruption, focusing on specific terms like “fault injection,” “chaos monkey,” and “resilience testing.”
Resilience Testing Patterns: Detects references to resilience testing frameworks and methodologies, searching for terms related to chaos engineering and failure simulation.
Recovery Validation Indicators: Identifies statements pertaining to recovery processes and the validation of system recovery capabilities, including phrases like “recovery plan,” “disaster recovery,” and “incident response.”
Systemic Testing Mentions: Detects mentions of systemic testing approaches that aim to evaluate the overall robustness of systems, looking for terms such as “systemic testing,” “holistic testing,” and “end-to-end testing.”
Documentation and Certification References: Identifies references to compliance certifications and security documentation related to resilience and recovery, including phrases like “ISO 27001,” “SOC 2,” and “penetration test.”

Inputs Required:

domain (string): The primary domain of the system being analyzed, such as “acme.com”.
company_name (string): The name of the company for which the statement searching is conducted, e.g., “Acme Corporation”.

Business Impact: This scanner plays a critical role in enhancing digital resilience by proactively identifying potential vulnerabilities and weaknesses that could lead to system failures or disruptions. By detecting fault injection and testing for resilience, organizations can develop more robust recovery plans and ensure they are prepared for unexpected events, thereby minimizing business impact and maintaining operational continuity.

Risk Levels:

Critical: Findings that directly indicate a severe vulnerability in the system’s ability to withstand faults or recover from failures without significant disruption of services.
High: Indicators of high risk where systems may experience prolonged outages or require extensive manual intervention for recovery, impacting business operations significantly.
Medium: Where there are indications of moderate risk, requiring attention and potentially leading to partial service disruptions or increased operational overhead.
Low: Minimal impact findings that do not pose significant risks but still warrant monitoring and improvement efforts to enhance overall system robustness.
Info: Informative findings that provide insights into current practices but do not indicate immediate concerns.

Example Findings:

“Our chaos monkey experiments have consistently shown our systems can handle unexpected outages without major disruptions.”
“The ISO 27001 certification confirms our commitment to maintaining robust security measures and resilience in the face of cyber threats.”

This structured documentation provides a clear, user-friendly overview of the scanner’s capabilities and its role in enhancing digital resilience within organizations.

Resilient Architecture

Purpose: The Resilient Architecture Scanner is designed to identify and assess single points of failure within an organization’s architecture, evaluating the robustness against failures and attacks through the detection of redundancy measures.

What It Detects:

Single Points of Failure Identification: Identifies critical components or services that lack redundancy, which could lead to a complete system outage if they fail.
Redundancy Effectiveness Evaluation: Assesses the effectiveness of existing redundancy measures such as load balancers and failover mechanisms to ensure they are properly configured and tested for resilience against failures.
Policy Compliance Review: Checks for the presence of security policies related to redundancy and disaster recovery, verifying compliance with industry standards like SOC 2 and ISO 27001.
Incident Response Plan Evaluation: Analyzes incident response plans to ensure they account for potential single points of failure in their coverage strategies.
Documentation and Trust Center Information Review: Examines company security documentation and trust center information to gather details on the architecture’s resilience, including system reliability and failover capabilities.

Inputs Required:

domain (string): The primary domain to analyze, providing a context for the scanner to search within.
company_name (string): The company name used for searching relevant statements in documentation and trust center information.

Business Impact: This scanner is crucial as it helps organizations understand their vulnerability points and enhances their security posture by ensuring that critical systems are adequately redundant, thereby reducing the risk of significant disruptions due to single failures.

Risk Levels:

Critical: Conditions where a single point of failure could lead to severe consequences such as data loss or system collapse.
High: Situations where multiple points of failure might result in substantial risks and potential business impacts.
Medium: Issues that, while significant, can be mitigated through existing processes but still require attention for optimal security practices.
Low: Minor issues that do not significantly impact the overall system integrity or operations.
Info: Informative findings about best practices or areas where improvements could enhance resilience without immediate critical risks.

Example Findings:

A critical database server lacks any failover mechanism, posing a significant risk of complete system outage in case of failure.
An evaluated load balancer is found to be ineffective due to insufficient testing and configuration for redundancy purposes.

Regional Resilience

Purpose: The Regional Resilience Scanner evaluates the geographic distribution and regional isolation of a company’s security measures to identify potential vulnerabilities in its global operations. This helps ensure that the company has robust security policies and controls across different regions, preventing isolated incidents from becoming widespread issues.

What It Detects:

Geographic Distribution Analysis: Identifies the presence of regional security offices or teams, checks for region-specific compliance certifications (e.g., SOC 2, ISO 27001), and verifies data protection policies tailored to different regions.
Regional Isolation Patterns: Detects gaps in communication and coordination between regional security teams, identifies isolated incident response plans without centralized oversight, and evaluates the presence of region-specific access controls and authentication mechanisms.
Compliance Certification Review: Searches for mentions of SOC 2, ISO 27001, and other relevant compliance certifications, verifies that certifications are up-to-date and cover all regions, and checks for penetration testing and vulnerability assessment reports specific to each region.
Policy Indicators Analysis: Looks for security policy documents mentioning regional considerations, identifies incident response plans with regional-specific procedures, and detects data protection policies adapted to local laws and regulations.
Trust Center Information Evaluation: Analyzes trust center pages for regional security disclosures, verifies the presence of region-specific security reports and updates, and checks for transparency in how regional security incidents are handled.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps in assessing the global security posture of a company, ensuring that no region becomes vulnerable due to lack of centralized oversight or inadequate regional policies. It directly impacts the overall risk management and compliance with industry standards.

Risk Levels:

Critical: Conditions where there are significant gaps in regional security measures, non-compliance with critical certifications, or severe vulnerabilities identified without mitigation plans.
High: Conditions where regional policies lack comprehensive coverage, access controls are insufficient, or there is a risk of unauthorized data exposure due to outdated compliance certificates.
Medium: Conditions where some regional policies need improvement, certain regions lack specific security features, or there is potential for increased vulnerability if not addressed promptly.
Low: Conditions where minor inconsistencies in regional security measures exist, and most policies are adequately aligned with the company’s global strategy.
Info: Informal findings indicating areas of good practice but potentially needing enhancements to align with best industry standards.

Example Findings:

A region lacks a dedicated security team despite being responsible for critical infrastructure.
Regional compliance certificates, such as ISO 27001, are outdated and not renewed across all regions.