{ "title": "", "landingPage_heading1": "", "landingPage_description1": "", "landingPage_button": "", "landingPage_description2": "", "landingPage_heading2": "", "landingPage_description3": "", "landingPage_description4": "", "copyrightPart1": "", "copyrightPart2": "", "poweredBy": "", "securityAssessment": "", "summary": "", "showAllTests": "", "ShowFailedTest": "", "securityGrade": "", "requestTheCompleteReport":"", "requestTheCompleteReportContent":"", "lookingForMore":"", "lookingForMoreContent":"", "firstName":"", "lastNAme":"", "email":"", "companyName(optional)":"", "fnamePlaceholder":"", "lnamePlaceholder":"", "emailPlaceholder":"", "companyPlaceholder":"", "emailMeTheReport":"", "emailSussessHeading1":"", "emailSussessHeading2":"", "emailSussessContent1":"", "emailSussessContent2":"", "done":"", "emailErrorHeading":"", "emailErrorContent":"", "tryAgain":"", "dataProtection": "", "A": "", "B": "", "C": "", "D": "", "F": "", "high": "", "medium": "", "low": "", "risk": "", "threatAndAccessResultString": "", "dataProtectionResultString": "", "doesyourInternetSecurityPassTest": "", "failed": "", "passed": "", "tests": "", "securityRecommendationReport": "", "fullTestResults": "", "assessmentDetails": "", "assessment": "", "security": "", "securityRecommendations": "", "seeSampleReport": "", "sampleReportModal1":"", "sampleReportModal2":"", "getRecommendations": "", "threatPrevention": "", "accessControl": "", "status": "", "testName": "", "testDetails": "", "learnMore": "", "howToFixThis": "", "contactUs": "", "loading": "", "solutionRecommendation": "", "testDescription": "", "validFnameError": "", "validLnameError": "", "validEmailError": "", "validCompanyError": "", "invalidPersonalEmailError":"", "companyLengthError": "", "fnameLengthError":"", "lnameLengthError":"", "emailLengthError":"", "emailContent": "", "emailSubject": "", "testConfig": { "EXE": { "enabled":"1", "weight":"8", "title":"", "description":"", "fail":"", "how":"", "descPopUp":"hello", "loading":"" }, "MALICIOUS": { "enabled":"1", "weight":"10", "title":"Block threats in known malicious websites", "description":"This tests if a benign object from a known malicious site is able to be blocked. It does not attempt to download actual malware.", "fail":"It is important to update your security devices with the latest threat reputation data as soon as it becomes available. Try updating your security solution's list of compromised websites in real time. To minimize risk, users should always receive this protection regardless of their connection type or location. ", "how":"To protect your users, your security solutions should be able to update their threat reputation data as often as possible or in real time.", "descPopUp":"This test checks to see if a benign object hosted on a known malicious site is able to be blocked by your security solution. It uses a compromised site from a publicly published list by Google. It does not attempt to download actual malware.", "loading":"Testing whether you're vulnerable to malicious sites" }, "PHISHING": { "enabled":"1", "weight":"10", "title":"Detect a phishing attack", "description":"This checks if you can access one of the latest validated phishing sites uncovered by Phishtank.com. ", "fail":"Criminals typically target phishing attacks at employees in order to steal corporate credentials or sensitive data. Links received in spam email or shared on social networks are often the culprit. Updating your security infrastructure with a known list of phishing sites in real time is needed. To minimize risk, all users on or off network should remain protected at all times.", "how":"Your security infrastructure should refresh its block list of phishing sites as often as possible or in real time.", "descPopUp":"This test checks to see if your computer is able to access one of the latest validated phishing sites uncovered by Phishtank.com. The test covers all infection vectors, including mobile traffic, which criminals have started to take advantage of as a key weakness area in many current security solutions. This test does not attempt to download actual malware. ", "loading":"Testing whether you're protected from phishing sites" }, "COOKIE": { "enabled":"1", "weight":"10", "title":"Prevent cookie stealing or session hijacking", "description":"This test takes a cookie from one website and tries to post it to a second one, a clear sign of an attempt to hijack the web session ", "fail":"Criminals often try to steal browser cookies, which means they can impersonate you, hijack your web sessions, and possibly infiltrate your online accounts. To prevent hijacking of your web session, consider using a security solution that can confirm that a website's cookies are being sent back to the correct originating website.", "how":"Your security solution should be able to confirm that a website's cookies are being sent back to the correct originating website.", "descPopUp":"This test takes a cookie from one website and tries to post it to a second one, a clear sign of an attempt to hijack the web session. To make sure you have not received a false positive, please check to see that you are not blacklisting the Zscaler website.", "loading":"Testing whether you're vulnerable to cookie stealing" }, "BOTNET": { "enabled":"1", "weight":"15", "title":"Stop a botnet callback", "description":"This test tries to contact a known botnet command-and-control server and download a benign file. Real information is not sent out. ", "fail":"Devices infected with malware can be used to exfiltrate credentials, data, or intellectual property. Hackers can also use these devices as launching points for further network infection, or instruct them to participate in DDoS attacks. Consider a security solution that not only blocks initial infections but can quickly identify and block all malicious botnet activity across all your user devices.", "how":"Consider a security solution that can quickly identify and block botnets \"calling home\" to control servers.", "descPopUp":"This test tries to contact a known botnet command and control server (\"calling home\") and download a benign file. The server is selected from Google's Safebrowsing list; real information is not sent out.", "loading":"Testing whether you're vulnerable to
botnets" }, "XSS": { "enabled":"1", "weight":"10", "title":"Prevent cross-site scripting\n", "description":"This tests if your browser can be compromised by a website that has been infected with malicious code. ", "fail":"Consider a security solution that can protect users when they visit compromised websites by scanning the entire URL and content to identify the source website. It should also block the individual content responsible for the malicious script injection, without overblocking. For example: only block facebook.com when it's facebook.com/example that contains the vulnerability.", "how":"Your security needs to scan the entire URL and website content for all users who access the internet", "descPopUp":"Cross-site scripting (XSS) attacks inject malicious code into an otherwise legitimate sites, in an attempt to exploit your browser and compromise your system. This test visits a Zscaler CDN website that simulates a compromise by malicious code and checks to see if it would have been able to exploit your web browser.", "loading":"Testing whether you're vulnerable to cross site scripting attacks" }, "VIRUS": { "enabled":"1", "weight":"10", "title":"Stop older known viruses", "description":"This test downloads just enough of the well-known Zbot virus in order to test your antivirus security, but not enough of it to cause harm.\n ", "fail":"If your system missed Zbot, it's likely you are vulnerable to a wide range of viruses. Be sure your security solution can inspect and block all malicious traffic, including content delivered by a CDN. If your security system is configured or able to only look at select files, it might be missing a large portion of threats.", "how":"You are vulnerable to the Zbot virus. Make sure your security infrastructure is always inline and inspecting all traffic, including content delivered by a CDN.", "descPopUp":"This test uses the well-known Zbot virus to test your antivirus engines. The test only downloads enough of the data to trigger your security; it stops the virus download before it can infect your system. All antivirus engines should detect and block this very common virus, whether delivered from a trusted or unknown CDN.\n", "loading":"Testing whether you're vulnerable to virus downloads" }, "ZIPPED": { "enabled":"1", "weight":"10", "title":"Block virus hidden in a zip file ", "description":"This test downloads a benign file containing an EICAR virus test file that is zipped multiple times. ", "fail":"Your security infrastructure did not detect a benign test virus that was contained in a triple-zipped file. Check your security solution to be sure it is unzipping and scanning all files. If you passed the previous \"Stop older known viruses\" test, be sure that you set your antivirus engine to unzip files if it has that capability. ", "how":"Check your security to make sure it is capable of unzipping and scanning all files being downloaded by your Internet users.", "descPopUp":"This test downloads a benign file containing an EICAR virus test file that is zipped multiple times. The test file is zipped using standard archivers and contains multiple benign files combined with the EICAR virus. The download is terminated if the inline network security allows most of the file.", "loading":"Testing whether you're vulnerable to zipped virus downloads" }, "EICAR": { "enabled":"1", "weight":"5", "title":"Prevent common virus from known malicious site", "description":"This basic and easily identifiable test downloads a benign file containing an EICAR virus test file from the official EICAR site. ", "fail":"You should make sure you have threat prevention tools deployed between you and your internet connection. You should also make sure these threat prevention tools are always in between you and the internet regardless of where and how you connect. While you may have protection on a corporate network, it does not mean you will have that same protection from home or other non-corporate connections. ", "how":"It is likely you have no threat prevention tools deployed or, if you do, your Internet traffic is not passing through them.", "descPopUp":"This is one of the most basic tests we perform. It checks for the existence of the most basic threat-prevention tools. This test downloads a benign file containing an EICAR virus test file from the official EICAR site. Most network defenses should easily block the download either by scanning the file and detecting the test pattern, or by blocking the destination based on reputation. ", "loading":"Testing whether you're vulnerable to EICAR test virus downloads" }, "ANO": { "enabled":"1", "weight":"4", "title":"Block access to anonymizing websites \n", "description":"This test tries to connect to an anonymizing website. Failing this test means you would have the ability to bypass company policy and access restricted content. ", "fail":"To be able to properly enforce company policy, you should set your security infrastructure to identify and block anonymizing website access. New anonymizer websites come online each day, so you should update your security infrastructure regularly with the latest list of anonymizer websites. To keep company data safe and help limit corporate liability, you should also confirm that mobile employees who are off network are also restricted from accessing anonymizer websites.", "how":"In order to properly enforce company policy, you should set your security infrastructure to identify and restrict access to anonymizing websites.", "descPopUp":"This test checks if you can access an anonymizing website. Employees often try to bypass company policy by using anonymizing proxies that allow them to visit blacklisted websites, view pornography, or access restricted content. These anonymizers can open a backdoor for malware, expose your company to litigation risk, and expose your data to untrusted third parties. \n", "loading":"Now testing your ability to access anonymizing websites" }, "REG": { "enabled":"1", "weight":"4", "title":"Block websites in embargoed countries", "description":"This tests your ability to access websites in countries that are embargoed by the United States and the European Union, such as North Korea ", "fail":"This test usually fails because your security infrastructure cannot block Internet connections by geography. You should be blocking IP ranges by geography in order to limit your end users exposure to threats.", "how":"You should enable your security devices to block IP ranges by geography.", "descPopUp":"This tests your ability to connect to websites in countries under embargo by Unites States and European Union, such as North Korea. Most companies will want to prevent users from connecting to websites in countries that are under embargo in order to comply with trade laws. Additionally, compromised websites are often hosted in countries that are hostile to the United States and the European Union, and/or they place a low priority on Internet security. ", "loading":"Now testing for your ability to access websites hosted in embargoed countries." }, "ADULT": { "enabled":"1", "weight":"4", "title":"Block access to adult websites", "description":"This test checks your ability to access an adult website by trying to visit a known adult website and download a benign icon. ", "fail":"You need to enable proper filtering on your security devices to detect and block adult websites. Additionally you should make sure that filtering is always enforced even when users are not on the corporate network.", "how":"You should enable filtering on your security devices to prevent access to adult websites.", "descPopUp":"This test checks your ability to access an adult website by trying to visit a known adult website and download a benign icon. Employees often violate company policy and try to visit blacklisted websites and view pornography. These sites act as common watering holes to propagate malware, and they may expose your company to litigation risk and your data to untrusted third parties.", "loading":"Now testing for your ability to access adult websites" }, "CC": { "enabled":"1", "weight":"33", "title":"Block credit card exfiltration\n", "description":"This test attempts to exfiltrate numbers out of your network that match the format of valid credit card numbers. ", "fail":"Many security systems are deployed in TAP mode and detect, but do not block, the leakage of sensitive information outside the organization. Consider a Data Loss Prevention system that monitors outbound traffic and blocks exfiltration attempts based upon pattern matches to sensitive data such as U.S. Social Security numbers, credit card numbers, or your company's intellectual property.", "how":"Consider a Data Loss Prevention (DLP) system that can find and block credit card pattern matches in outbound traffic.", "descPopUp":"This test attempts to exfiltrate numbers out of your network that match the format of valid credit card numbers. Your network security solution should easily identify this leakage.", "loading":"Checking whether you can leak credit card numbers" }, "SSN": { "enabled":"1", "weight":"33", "title":"Block Social Security number exfiltration.", "description":"This test attempts to exfiltrate numbers out your network that match the format of U.S. Social Security numbers. ", "fail":"Many security systems are deployed in TAP mode and detect, but do not block, the leakage of sensitive information outside of your organization. Consider a Data Loss Prevention system that monitors outbound traffic and blocks exfiltration attempts based upon pattern matches to sensitive data such as U.S. Social Security numbers, credit card numbers, or your company's intellectual property.", "how":"Consider a Data Loss Prevention (DLP) system that can block Social Security number pattern matches in outbound traffic.", "descPopUp":"This test attempts to exfiltrate numbers out of your network that match the format of U.S. Social Security numbers. Your network security solution should easily identify this leakage.", "loading":"Checking whether you can leak social security numbers" }, "IP": { "enabled":"1", "weight":"34", "title":"Block source code exfiltration", "description":"This test attempts to exfiltrate typical patterns found in source code. ", "fail":"Many security systems are deployed in TAP mode and detect, but do not block, the leakage of sensitive information outside your organization. Consider a Data Loss Prevention system that monitors outbound traffic and blocks exfiltration attempts based upon pattern matches to sensitive data, such as U.S. Social Security numbers, credit card numbers, or your company's intellectual property.", "how":"Consider a Data Loss Prevention (DLP) system that can find and block source code pattern matches in outbound traffic.", "descPopUp":"This test attempts to exfiltrate typical patterns found in source code. Stealing your intellectual property is the goal of some of the world's most dangerous hackers and state-sponsored actors seeking a competitive advantage. A leak of intellectual property can have profound consequences for your enterprise — from rewriting source code to re-issuing binaries.", "loading":"Checking whether you can leak intellectual property" } } }