- [Instructor] A penetration testing report
is very important
because it is the final deliverable of your engagement.
It is what you're actually paid to produce
as a result of your penetration testing efforts.
You should always create a report,
even if you're only conducting an internally-only evaluation
for your own company.
The results of your testing
should be fully documented for several reasons.
You should also include evidence of what you actually found
in the penetration testing report.
Now, another thing is that the penetration testing report
must be clear and detail the outcome of the test,
and in most cases, include recommendations
on how to mitigate the vulnerabilities
that you actually found.
Now, the audience will vary.
You're gonna have people that are executives,
that are not probably that technical,
and you probably also have part of your audience
a very technical crew,
like part of the IT crew for your company
or whoever you're doing the pen testing for.
So, that's why you should always include
an executive summary that will be read by senior management
and then the technical details,
you can leave it at the second portion of the report
and that will be read by the IT
or the information security stakeholders.
Now, these are the high-level
pen testing report development stages.
You start with the report planning, information collection,
your first draft, then you review and finalize
and of course, deliver that pen testing report.
So, starting with report planning,
you have to consider the audience
as I mentioned to you before.
Their need for the report,
whether it's operational planning,
resource allocation, approval, et cetera.
Also, the knowledge of the report and the topic. Right?
And you also have to know potentially
the personal demographics.
And also, who are the people that will have some authority
to implement the recommendations that you are suggesting
in the pen testing report.
You also have to think about report classification.
You have to be aware that the pen testing report
will include sensitive information.
And as a best practice, you should always ask
the people that actually hire you, right,
or it can be your boss, how the report should be classified
based on the underlying organization's information security
or information classification policies.
One of the best practices is also to clearly document
how the report will be distributed
and the type of report delivery.
Like, for example, if you're sending the report
over an encrypted email via PGP, or S/MIME,
or you're actually printing hard copies of the report,
and how many copies you actually printed it,
who do you actually give that report to?
And you should perform due diligence
to ensure the confidentiality of the test results.
Make sure that you collected all the information
in all stages.
The systems used, the tools, the evidence of exploitation,
how you potentially did post-exploitation techniques
to move laterally within the organization,
or exfiltrate information, and so on.
You should take notes.
You should capture screenshots.
You should log all activities.
And the information collection
should start from the beginning.
From the moment that you actually start
doing the pen testing, all the way to the end.
When you're done with your testing,
write a rough draft report using the relevant information
that you gathered in the information collection stage.
Now, in the review and finalization phase,
peer review is very important.
If you are actually just doing this by yourself
and doing pen testing as a self employee,
make sure that you actually either hire somebody
to proofread your report and that somebody is trusted
and you actually have a proper
non-disclosure agreement or NDAs
because the report is actually a sensitive matter.
In many cases, you actually will not
be able to hire somebody.
It all depends on the scenario.
It depends on the environment.
Also, make sure that you include risk ratings
and at least use things like CVSS,
the Common Vulnerability Scoring System,
to provide some level of urgency
or to at least rank how important
or severe are the vulnerabilities
that you actually have found.
If you're not familiar with CVSS,
I'm sharing a link in here from FIRST.org which is actually
the Common Vulnerability Scoring System standard
and the specification document.