So now we're thinking about the Test Details section. Here,
we're communicating high‑level information about the test.
Why does this section exist?
It's there to give context to the test. It helps the
reader understand why it was performed,
what was tested, and perhaps also what wasn't tested.
Scope is part of the test details.
Hopefully, before the pen test happened,
there was a scope document that detailed what was going to be
tested. In this case, an agreement between Globomantics and Carved
Rock about what was being tested and when. Any information from that
document should be repeated here.
The whole report is about the vulnerabilities found during the test,
so we have to be very clear exactly what was tested, and we
shouldn't need the other document to do that.
It's also important to include dates the test took place.
There may be logs that the business can look at to identify what happened
and when. Dates could be useful to separate genuine malicious activity
from activity performed for the pen test. Here is where you might want to
mention any testing methodologies.
Kim doesn't like too much detail at the start of the report, instead using
web links and referring to the appendices where relevant.
We'll get to those later.
If this was a web application pen test, for example,
then Kim has checklists like the Application Security
Verification Standard. They can easily be added, giving further
transparency to what happened during the test.
That level of detail is often best saved for the appendices.
It's common to list the pen testers involved in a test.
Why?
Partly as a point of contact.
So, if the Carved Rock team wants further technical input,
then they know who was involved. Again, this is about transparency too.
So we're detailing what rule the pen tester holds
and perhaps their qualifications.
Did someone perform the test who was in a junior position, or have
they got lots of experience and perhaps qualifications to back
that up? As an extension to the scope,
it might be necessary to detail caveats. If Kim was
testing according to the scope,
but there was a reason why it wasn't followed completely,
then the report has to say this.
If we didn't test something, but don't tell the client,
there may be vulnerabilities they would expect this test to
uncover. That could have consequences.
Remember, the goal is to highlight business risks.
Well, if something isn't tested,
then this could still be a risk. Test limitations.
This section is similar to caveats.
This is often used to just say that pen testing isn't an exact
art. Timescales mean testing isn't exhaustive, and security
itself can often be a moving target, so the results only
reflect a single point in time.
Again, this is talking to the goal of highlighting risks to the business.
We can't guarantee that results would be the same even weeks after the test.
New and sometimes novel vulnerabilities appear constantly, so you're never
completely free of risk. Back to the report. First,
the front cover,
which has basic details, who the test is for, what
type of test, and, importantly, the word Confidential.
It's good to make it clear from the start that this
report has a restricted audience.
Moving on, there's a table of contents, which is hyperlinked for easy navigation.
Most people will use an electronic version of the document, so
easy navigation is good. Into the test details,
Kim has a brief introduction and the scope, including the area of the
network being tested and the dates of the test.
We can see the team involved, in this case,
just Kim with her job title and email address.
She's a senior tester, and that should give confidence that this test
was thorough. Caveats. Here, a single computer on the network was
identified as being fragile with vulnerabilities already known by the
team. That was taken out of scope.
The business already knows this is a risk,
but we're ensuring this is in the report just in case there are
questions about why Kim didn't detail those vulnerabilities.
Finally, test limitations.
This is often templated text just to clarify that while testing was done,
there may be still risks that the business doesn't know about.