Chapter 8: Reporting and
Communication
Dr. Sarah Abu Ghazalah
Introduction
• After you completed Chapter 1, you made your way through Chapter 7
that helped you understand how to conduct a penetration test.
• These are all useful to the organization if the penetration testers are
able to effectively communicate the results of the testing to
management and technical staff.
Communication Triggers
• Set up a standing meeting with key stakeholders where the penetration testers and
clients discuss outstanding issues and provide updates on the progress of the test.
• Discovery of a critical finding. If the penetration test identifies a critical issue with
the security of the client’s environment, the testers should not wait for the
delivery of their final report to communicate this issue to management. Leaving a
critical vulnerability unaddressed may put the organization at an unacceptable
level of risk and result in a compromise.
• When penetration testers discover indicators of an ongoing or past compromise,
they should immediately inform management and recommend that the
organization activate its cybersecurity incident response process.
Structuring the Written Report
Executive Findings and
Methodology Conclusion
Summary remediations
Executive Summary
• It is being written for executives.
• These are not necessarily technologists. Executive summaries are
often shared with senior leaders, board members, and other people
who are busy and lack technical knowledge.
• The executive summary may be the first section to appear in the
written report, but it should be the last section that you write
Findings and Remediation
Critical: SQL injection vulnerabilities allow the exfiltration of sensitive information from
a business-critical database.
Example The web server located at [Link] contains an application named [Link] that
contains a SQL injection vulnerability in the firstName variable.
Users exploiting this vulnerability gain access to the backend database instance
“CorporateResources” with administrative privileges.
The testers demonstrated the ability to use this vulnerability to gain access to employee
Social Security numbers, confidential sales figures, and employee salaries.
The risk associated with this vulnerability is somewhat mitigated because the web server
is not externally accessible, but it poses a critical risk for insider attacks.
To reproduce this risk, visit the following URL:
[Link]
We recommend to remediate this vulnerability by enforcing an
Remediation input validation policy on the firstName variable in the
[Link] application.
Methodology
• Explain the types of testing that you performed, the tools that you used, and the
observations that you made.
• The audience for this section of the report consists of the technologists who will
be reviewing your results and taking actions based upon your findings.
While your methodology section should get into technical detail,
it’s not a good idea to include lengthy code listings, scan reports
Conclusion
• The conclusion is your opportunity to wrap things up in a tidy package for the
reader.
• You should summarize your conclusions and make recommendations for future
work.
• The conclusion is also a good place to compare the risk ratings identified in the
report with the organization’s risk appetite
Post-Engagement Cleanup
• Penetration testers use a wide variety of tools and techniques as they work their
way through a client network.
• During the engagement, testers should clearly document any changes they make
to systems.
• The three important post-engagement cleanup activities:
■■ Removing shells installed on systems during the penetration test
■■ Removing tester-created accounts, credentials, or back doors installed during the
test
■■ Removing any tools installed during the penetration test
• The basic principle that testers should follow when conducting post-engagement
cleanup is that they should restore the system to its original, pre-test state.
Lessons Learned
• The lessons learned session is the team’s opportunity to get together and discuss
the testing process and results without the client present.
• Team members should speak freely about the test and offer any suggestions they
might have for improvement.
• The lessons learned session is a good opportunity to highlight any innovative
techniques used during the test that might be used in future engagements.
• It’s often helpful to have a third party moderate the lessons learned session. This
provides a neutral facilitator who can approach the results from a purely objective
point of view without any attachment to the work.
Sample
• [Link]
[Link]