Vulnerabilities are typically referred to as findings in a report.
When we document them,
we need to convey enough information to allow those
technical people to fix them effectively.
A pen test report will go to a technical team that might have some
understanding of security, but they won't always have the depth of
understanding that our pen tester Kim has.
We can't make assumptions about that level of security knowledge, so we have
to consider that when we write up findings. Too much information is better
than too little, although not all of that information has to be in the report.
Links to websites are certainly useful.
Parts of this also target the management side too.
It's essential to get across how important each finding is to the business.
What sort of details do we need in a finding?
Well, that takes us right back to our three high‑level goals.
We want the detail of vulnerabilities, state the mitigations,
and highlight the risks. Starting with Chris, our project
manager, there isn't much in the findings section for him.
Looking at the title of a finding,
this might be something that Chris would see in a summary.
That means it would be good if someone less technical has a chance of
understanding it. Also, don't forget that even some technical people might
struggle with the detailed findings in a report.
For example,
weak stream ciphers in use versus weak cryptography in use could
make a lot of difference to someone who is technical, but
doesn't have much security experience.
The severity will be displayed with each finding, but also reflected in
other areas of the report. This can be scores such as CVSS or DREAD.
Their main job is to get across the severity of a finding and help the
business decide how important it is.
This can also be quite good at giving transparency
of how the score was achieved.
If we're telling someone a finding is critical,
it's good to tell them how we came to that conclusion.
This is to do with trust. We're proving that we're not
just making up a severity rating.
We've also got a risk score.
This is different to severity.
We want to help the business see what risks a vulnerability might bring.
One way of doing that is looking at likelihood multiplied by impact.
We're going to look at some findings in a moment to see what that looks like.
Okay, let's look at Kim's report.
We've got the Navigation view in Word here just so it's
easy to see where we are in the document.
Currently, we're looking at an introduction to findings,
the part of the report where we tell the reader what to expect from them.
Here,
we're talking about the Common Vulnerability Scoring System, CVSS. We're
calling out the fact that we're using CVSS to aid transparency.
The reader can use that to help them understand the scores
they're given. Transparency is the important part here. Exactly
how that's achieved is less relevant.
So if you use something other than CVSS, such as DREAD, then that's fine.
We've added a link that goes into much more detail about
CVSS than we ever could in the report.
If the reader wants to get some depth, then the linked
website will give them that. If not, then we've kept this
short and easy going for the reader.
We've got a table to map scores to ratings, which is easy to read and absorb.
These are properties we should be keeping in mind throughout the report.
There should be enough depth, but still be easy to read.
There's a section on risk scores and how we're calculating them. Again,
we're thinking transparency, helping the reader to understand how we
decide scores. To a degree, some scores come from expert opinion, but
it's useful if someone can see how we arrived at them. That'll give them
more trust in what we say.
If we move to the Finding Summary,
we can see the information from findings that's aimed at someone like
our project manager, Chris. We've got the titles, which aren't too
technical, and we've got color‑coded scores so we can easily see how
important each of the findings are.
Chris is starting to get a picture of how well or badly this test went.
We'll cover some other parts of the report that are
aimed at Chris in the next module.