Private/Get-LinkRisk.ps1
|
function Get-LinkRisk { <# Turn a link's shape into a single risk word. The ladder, in plain terms: Anonymous "anyone with the link" is the worst starting point Organization "anyone in the company" is a real exposure but internal Users "specific people" is what sharing is supposed to be Edit is worse than View everywhere No expiry matters for org/anonymous links (they linger); it barely matters for a named-person link, so it is only penalised for the broad scopes An anonymous link with no password is a plain open door #> param( [string] $Scope, # Anonymous | Organization | Users [string] $LinkType, # View | Edit $Expiration, # $null when none set [bool] $HasPassword ) $score = 0 switch ($Scope) { 'Anonymous' { $score += 3 } 'Organization' { $score += 1 } default { $score += 0 } # Users / specific people } if ($LinkType -eq 'Edit') { $score += 2 } $broad = $Scope -in @('Anonymous', 'Organization') if ($broad -and -not $Expiration) { $score += 1 } if ($Scope -eq 'Anonymous' -and -not $HasPassword) { $score += 1 } if ($score -ge 5) { 'Critical' } elseif ($score -ge 3) { 'High' } elseif ($score -ge 1) { 'Medium' } else { 'Low' } } |