Home > SWS Blog > Cyber Security Scans – Part 2
Cyber Security Logo

Cyber Security Scans - Part 2

In our previous Cyber Security Scan post, we began discussing the findings of the initial scan. Here are the rest of the scan results.

There are a total of 87 findings in the “DNS HEALTH” section

There are 0 high-severity findings

There are 11 medium-severity findings

    • There are 11 findings in the “SPF Record Missing” category; they are all related to other websites on my server

There are 76 medium-severity findings

    • There is 1 finding in the “Malformed SPF Record” category, which is related to another website on my server
    • There are 75 findings in the “SPF Record Contains a Softfail” category; they are all related to other websites on my server

So for this particular website, there isn’t any action for this section. I will circle back and clean up the other websites on the server as soon as I complete this effort

Today, the “DNS HEALTH” section looks like:

Have Questions?

Need Your Cyber Security Scan Reviewed or Explained?

Contact Us
Contact Us
First
Last

There are a total of 811 findings in the “PATCHING CADENCE” section

There are 239 high-severity findings

There are 528 medium-severity findings

There are 44 low-severity findings

Today, the “PATCHING CADENCE” section looks like:

There are a total of 2,383 findings in the “APPLICATION SECURITY” section

There are 194 High Severity findings

    • There are 194 findings in the “Site does not enforce HTTPS” category. They are all for other websites on my server. I assigned this client’s website a new IP address, where they were the only website on it, to help alleviate this silliness

There are 759 medium-severity findings

    • There are 431 findings in the “Content Security Policy (CSP) Missing” category; these are all for other websites on my server
    • There are 48 findings in the “Insecure HTTPS Redirect Pattern” category, the majority are for other websites on my server
    • There are 25 findings in the “Redirect Chain Contains HTTP” category; the majority are for other websites on my server
    • There are 255 findings in the “Website Does Not Implement HSTS Best Practices” category; the majority are for other websites on my server

There are 948 low-severity findings

    • There are 90 findings in the “Cookie Missing ‘Secure’ Attribute” category; the majority are for other websites on my server
    • There are 29 findings in the “Session Cookie Missing ‘HttpOnly’ Attribute” category; the majority are for other websites on my server
    • There are 428 findings in the “Website does not implement X-Content-Type-Options Best Practices” category; the majority are for other websites on my server
    • There are 401 findings in the “Website does not implement X-Frame-Options Best Practices” category; the majority are for other websites on my server

The following are actually HTTP Header issues with WordPress websites:

    • Cookie Missing ‘Secure’ Attribute
    • Content Security Policy (CSP) Missing
    • Website does not implement X-XSS-Protection Best Practices
    • Content Security Policy Contains Broad Directives
    • Website does not implement X-Frame-Options Best Practices
    • Website does not implement X-Content-Type-Options Best Practices

And to be honest, I have never dealt with this one before, but it was quickly resolved and removed from the results.

Today, the “APPLICATION SECURITY” section looks like:

All said and done, they were scanning 47 total IP addresses in 3 countries for some reason. One of the websites that appeared in the list of vulnerabilities moved away from my server over 10 years ago, talk about a flashback.

In the next post, I will cover the remaining items in the “APPLICATION SECURITY” section and wrap this all up.

Facebook Linkedin X-twitter Pinterest