Floors & Penalties

After the four factors are summed into a raw score, three post-processing mechanisms can raise the score further. These enforce minimum severity levels for dangerous patterns and add penalties for risky configurations. They are applied in the order listed below.

Floors are tied to the threshold tiers, so a floor always lands on the start of the intended tier. The numbers below are for the default thresholds (Low 0-25, Medium 26-50, High 51-75, Critical 76-100).

flowchart TD A[Raw Score] --> B{Zone Policy Floor?} B -- Deny → min 51 --> C B -- Review → min 26 --> C B -- No floor --> C C{Plaintext Protocol?} C -- Yes → enforce min 26 --> D[Apply +10 Penalty] C -- No --> E D --> E{Any-Any Combo?} E -- Yes --> F[Apply Any-Any Floor] E -- No --> G[Final Score] F --> G

1. Zone Policy floors

When a zone matrix is active, the zone-to-zone policy can enforce a minimum final score:

Zone Policy	Floor	Default	Effect
Deny	Start of tier 3	51	Forces at least a High rating
Review	Start of tier 2	26	Forces at least a Medium rating
Allow	-	-	No floor applied

If the raw score already exceeds the floor, it passes through unchanged. These floors only apply when a zone matrix is active. The floor detail text names the tier label in use (for example Deny policy enforces minimum "High" rating).

2. Plaintext protocol floor and penalty

Flows that include unencrypted protocols receive both a floor and an additive penalty. The check is protocol-aware: it triggers only when one of these services is in the port specification and the flow's protocol matches the service's protocol. A flow protocol of ANY matches every row; ICMP matches none.

Port	Protocol	Service
20	TCP	FTP Data
21	TCP	FTP
23	TCP	Telnet
69	UDP	TFTP
80	TCP	HTTP
110	TCP	POP3
143	TCP	IMAP
161	UDP	SNMP
162	UDP	SNMP Trap
389	TCP/UDP	LDAP
512	TCP	rexec
513	TCP	rlogin
514	TCP	rsh
514	UDP	Syslog

So TCP/80, ANY/80 and UDP/161 trigger it, while UDP/80, TCP/161, TCP/69 and UDP/23 do not. A range triggers it when it contains a matching row (TCP/20-25 does, UDP/20-25 does not).

When triggered:

Floor: The score is raised to at least the start of tier 2 (26, Medium, by default) if it was lower.
Penalty: +10 points are added on top of the current score. This penalty always applies, even if the score was already above the floor. It is a fixed 10 points and does not follow custom thresholds, so with very narrow custom tiers it can move a flow by more than one tier.

For example, a private host-to-host flow on TCP port 80 (HTTP) has a raw score of 15; it is first raised to 26 (floor), then increased to 36 (penalty). The same flow on UDP/80 neither triggers the check nor matches HTTP (port 80 counts as an unknown port), so it scores 8.

3. Any-Any combo floors

The most aggressive floor kicks in when both source and destination are any (any, 0.0.0.0/0, or any x.x.x.x/0). The floor depends on how specific the port and protocol are:

Condition	Floor
Any port + any protocol	100
Any port OR any protocol (but not both)	92
Specific port + specific protocol	88

ICMP has no ports, so it counts as a specific port: an any-to-any ICMP flow floors at 88, the same as any-to-any TCP/443.

An any-to-any flow with any port and any protocol receives the maximum possible score of 100 (Critical). Even with a specific service, the floor of 88 ensures these flows are always rated Critical. With custom thresholds, the any-any floor is never below the start of the top tier: the floor is max(100 | 92 | 88, start of tier 4).

Processing order

The three mechanisms are applied in sequence. A later floor can override an earlier one if it produces a higher value:

Zone Policy floor raises the score if needed.
Plaintext floor raises the score if needed, then the +10 penalty is added.
Any-Any floor raises the score if needed.

The result after all three stages is the final score used for labeling and display.

Zone Policy Thresholds