The Policy Review Board examined the grading policy for detections of multiple Potentially Exploited events in a single day. Bitsight’s Compromised Systems section measures outbound detections related to malware (Botnets, Potentially Exploited), spam or other suspicious activity (Spam Propagation, Unsolicited Communications), and servers that attempt to distribute malware (Malware Servers).
Compromised System events are graded based on their frequency and duration. Single-day events are considered to be remediated if no future detections can be observed, and carry the least impact in comparison to events detected over a 3-day span (or longer), with the impact continuing to scale as long as the infection continues to beacon out. Likewise, multiple infections detected on the same day can also have an increased negative effect on the rating.
The Policy Review Board decided not to make a change in policy at this time. Compromised Systems findings are used to draw statistical inference about the strength of any controls that might mitigate infections; for instance, if an antiviral software is lacking up-to-date definitions it may not recognize a malicious file. Additionally, different infections on the same user device may demonstrate different controls issues depending on the malware family.