Improving Network Security: Essential Tips for Creating Effective Reports

REPORTING

Always Create a Report For third-party tests by penetration testing companies, the report is your leave-behind Two or three years from now, it is really the only evidence of the work you did The report may be used for a very long time So, focus on quality For in-house tests, you may think that a report is unimportant it is recommended that you create a report Convince management of its importance to show that you've exercised due diligence in securing your network

Don't Just Regurgitate Scan Results Don t cut and paste results from vulnerability scanner output Instead , review results and help interpret in light of the business of the target organization What do these vulnerabilities really mean to the business? How should fixes be prioritized? Adjust High, Medium, and low risk findings

Recommended Report Format Executive Summary Introduction Methodology Findings High-Risk Medium-Risk Low-Risk Conclusions (Optional) Appendices

Executive Summary The most important part of the report Should be 1 to 1.5 pages Very brief (2-3 sentences) summarize projects Date, goal, who, overview Then summarize overall risk posture identified during test Finally, include a bulleted list of three to six significant findings Explain their business impact Explain what management can pull to change the root causes that resulted in the finding Changes to organization structure Altered policies or procedures Changes to technology

Introduction Provides overview of test: Date range and time range Scope People associated with the test Include name, role, contact information, e-mail address and phone number Brief the most salient findings (often similar to executive summer)

Methodology Describe process used, listing results at each stage Recon Scanning Gaining Access - Exploitation This section is especially important if there aren't many major high-risk findings, to describe what the team did Scanning section should include an inventory of target systems Recommend a table: IP address, Name, Associated Business Unit (if known), Method of Discovery

Findings For each finding include: Vulnerable systems (ID by IP address and name if applicable) Risk level, (high, and medium, low) Difficulty of exploitation easily exploited, medium difficulty, very difficult to exploit Summery in business terms Detailed technical description In target business and technical environment Recommendation Possibly multiple way of dealing with the issues Screen shots are very helpful

Recommendations Consider recommendations that fall into one or more categories Applying patches Changing configuration /hardening systems Applying filters Altering architecture Changing processes Always consider this kind of recommendation Even for deeply technical issues, what process allowed the issue to arise, and how can we stop it from happening again? Make multiple recommendation Tradeoff between them considering Needed functionality and security Operational security Costs Ancillary benefits-new features Ancillary risks- new problems Don t feel compelled to make recommendation

Conclusions Don't break any new ground here Summarize when the project occurred Summarize the scope Summarize the overall security state of the target as identified in the project Summarize the findings, at a high-level (as in the Executive Summary)

Appendices Include lengthy items and lists here Detailed scan output Back-up documentation of the project Summary of memos communicating with third parties Other items as required