WC-B-03Level 1 · Signal
Visits unauthorized websites
A risky Behavior signal from the web gateway (SSE, web.unauthorized.visited): this person visited sites in categories the acceptable-use policy forbids, such as pirated software or gambling.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.IR-01
- MITRE ATT&CK
-
None mapped
The definition, in detail
Definition
The visit breaks policy and invites malware.
Example
A warehouse supervisor spends lunch breaks on a pirated-film site from his work laptop; the proxy logs the category every day.
How it is measured
- Source
- Web, CASB & DLP
- Subject
- Person
- Event
- web.unauthorized.visited
- Risk domain
- Web, cloud and SaaS
- Provenance
- Framework research
How it is used
Programs count "Visits unauthorized websites" per person from Web, CASB & DLP and read it beside the other Web, cloud and SaaS signals; it feeds 0 cohorts, 0 sequences and 2 breach scenarios.
A "visits unauthorized websites" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0102Installs personal cloud backup tools on enterprise devices
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0171Uses multiple cloud services with overlapping functionality
- I.0180Downloads documents from unrecognized cloud platforms
- I.0384Violates security contract clauses
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0394Supplies or operates vulnerable software or platforms
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
Continue exploring
"Visits unauthorized websites" (WC-B-03), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/wc-b-03-visits-unauthorized-websites
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.