C01 · HTTPS/TLSNo issue seen
No issue seen in the supplied evidence
- Observation
- HTTPS redirect and a valid certificate on the listed pages.
- Evidence
- Fictional certificate and redirect output.
- Limitation
- Only the listed pages. This is not a pass for the whole site.
- Next step
- Keep a named owner for certificate renewal.
C02 · SECURITY HEADERSCheck
Content-Security-Policy header is missing
- Observation
- The home page sends no Content-Security-Policy.
- Evidence
- Fictional response headers for one page.
- Limitation
- One page was supplied. A missing header doesn't show that an attack is possible.
- Next step
- Ask your website provider whether a policy fits the booking widget.
C03 · WEBSITE CONFIGURATIONCheck
One cookie is set without the Secure flag
- Observation
- A cookie on the booking pages lacks the Secure flag.
- Evidence
- Fictional cookie list.
- Limitation
- What the cookie is used for was not tested.
- Next step
- Ask your website provider what the cookie does and whether the flag can be set.
C04 · SOFTWARE/CMSCheck
The website discloses its CMS version
- Observation
- The page source shows a CMS name and version number.
- Evidence
- Fictional page source.
- Limitation
- A disclosed version is not proof of a vulnerability.
- Next step
- Ask who updates the website, and whether this version is current.
C05 · DOMAIN/DNSNo issue seen
DNS records match the supplied list
- Observation
- The records match what the hotel expected to find.
- Evidence
- Fictional DNS export.
- Limitation
- Who can change these records was not assessed.
- Next step
- Write down who holds the login for the domain.
C06 · EMAILPriority
DMARC policy is set to none
- Observation
- Record found, no enforcement.
- Evidence
- Fictional DNS record:
p=none.
- Limitation
- A DNS record alone doesn't show effective protection.
- Next step
- Review the reports with your mail provider.
C07 · PRIVACYCheck
The notice doesn't name the booking provider
- Observation
- The privacy notice lists the website host, but not the booking provider.
- Evidence
- Fictional privacy notice.
- Limitation
- A privacy policy does not establish GDPR compliance. This isn't legal advice.
- Next step
- Ask whoever maintains the notice to check the list of recipients.
C08 · LOGIN/ACCOUNTSPriority
A supplied policy and account exception need reconciliation
- Observation
- The policy says MFA applies to all accounts. The account list shows one exception.
- Evidence
- Fictional configuration snapshot.
- Limitation
- Runtime enforcement was not tested.
- Next step
- Confirm the intended policy with the responsible IT owner, and ask for supporting evidence before deciding on a change.
C09 · BOOKINGUnknown
Booking provider declared, not assessed
- Observation
- The hotel named one booking provider and one channel manager.
- Evidence
- Fictional provider list.
- Limitation
- Nothing about these providers was reviewed. Unknown evidence is not treated as a pass.
- Next step
- Ask who can log in to the extranet, and whether MFA is on.
C10 · EVIDENCE REVIEWReview
What connects these findings
- Observation
- The account in C08 uses the same mailbox that receives extranet messages from C09, which is why it comes first.
- Evidence
- C06, C08 and C09 read together.
- Limitation
- This connects findings. It is not a tenth technical scan.
- Next step
- Start with C08, then C06, and discuss C09 in the same conversation.
