Now we're looking at summaries,
so how the findings are being used to present
further information to Carved Rock.
The executive summary is the single most important section in the
report to get across risks to the business.
What risks do those technical vulnerabilities present?
Here,
we want to convey an understanding of what all of the
findings in the report actually mean.
Findings stand on their own and describe individual issues.
Here, though, we're drawing conclusions from those findings,
putting them together to see what kind of picture they
paint of the business security posture.
What does this all mean to the business?
Because we're aiming at a less technical audience and we want to
remove as much technical detail as we can,
we're doing a number of things in this section.
First,
we want to give a view of what a genuine attacker
could do based on the findings.
If there are lots of findings,
then we want to focus on those that are the most impactful.
Then,
if it was possible to link a number of findings
together to produce a much greater impact,
we want to discuss that.
Finally, we want to help the business understand the potential repercussions.
If this attack was to happen to the business, what might the results be?
Is customer privacy impacted?
Could ransomware be put on the network?
And would these things result in embarrassment for the company,
potential fines, or something worse?
This is very different to the rest of the report because we're not
trying to technically describe how something happens.
Instead,
we're trying to detail the path an attacker could take
to do serious damage to the business.
Why do we have this section?
We're telling the business the key risks that they have,
the importance of fixing them, and the direction they should take on mitigation.
We're actually hitting all three of our goals in this section.
We're describing the vulnerabilities,
but here in terms of their impact to the business.
We're stating mitigations,
although focusing on the key areas the business should look at.
And we're very clearly stating the risks to the business,
what could an attacker do and how might that hurt the business.
Looking at Kim's executive summary, right at the start,
we're highlighting what was possible due to the vulnerabilities found.
We're calling out without technical details what an
attacker would be able to do, gain access to a server without credentials,
retrieve a password to that server,
and retrieve a password for read‑only access to the company's website.
Kim is getting straight to the point here, which is a good idea in any report.
The following paragraphs then give more detail about the most
important findings and any chaining that can happen.
Anything technical is explained in a way more likely to be understood.
For example, here Kim talks about the SMB protocol,
but first, she's saying what it is.
It's used to share files.
She's getting across likelihood of attack by saying how there are
freely available tools for attacking this vulnerability and this
granted local administrator access.
Kim is helping the reader see what the impact was.
Continuing the chain of events,
Mimikatz was used to extract encrypted credentials,
again, a popular tool, that's likelihood.
Exactly how it works and what it does isn't important here.
Talking about password cracking,
this explains what it is without getting too technical.
It's just guessing passwords, but really quickly.
Likelihood is explained by saying how easy it was to
crack the password in this instance.
Finally, after Kim mentions read‑only access to the Carved Rock website,
there's clear indication what the impacts could be,
with loss of reputation or even regulatory fines.
Moving on,
Kim shows some of the most important recommendations based on the results.
Again, all non‑technical.
They can be understood without the reader being a security or IT expert.
Decision makers in the business get a good idea of what's needed to go from
their current security posture to a much stronger one.
Think of this as a piece of the report that someone
could show to anyone in the business,
and they would immediately understand the risks that are being highlighted.
Next, a brief summary of the findings.
This is an extension of the executive summary.
It's confirming what the findings are and the risks associated with them.
There are only a few findings in this report,
so they were all mentioned in the executive summary.
All of the findings should appear in the findings summary to give
a brief but complete picture of the results.
Here we can see there's color‑coding again,
both in the table of findings and the graph. Kim has used the
same colors consistently throughout the report.
Findings in this report are ordered by CVSS score,
which is typically a more technical reading. And we've
included the less technical reading too.
This can be useful to both technical and non‑technical readers.
Document control is a very small but still important part of a report.
This is an audit trail of what happened, so any changes and
their reasons can be logged. Here we see that a QA process has
taken place to check the report for problems, and we've got
dates to say when that happened.
We can also see someone other than Kim did this.
It is, after all,
very difficult to review your own work. Again, this comes
back to transparency. Chris likes the fact that someone
checked the report for errors.
It was his budget that paid for it after all.