A pen test report is a formal document to give independent
validation about vulnerabilities and risks to a business.
It can cost a lot of money to get this report, so it should
be good. In this module, we're going to cover some of the
finer points of report writing.
We've considered what goes into a report.
We've looked at why those things are there.
Now, we're looking at how we put them in the report.
How do we decide the words we're going to use?
We'll also look at some common mistakes that I've personally seen in the past.
Let's take a look at Kim's viewpoint on writing reports.
For Kim, the part she enjoys the most is the actual test, the technical
challenge of finding vulnerabilities and seeing what they expose.
Let's face it, very few pen testers,
very few people in general, enjoy writing reports.
Kim knows that the whole point of the pen test is to
get those vulnerabilities fixed.
To do that, they need to be communicated in a way that makes fixing them easy.
Communication is an important part of the job.
When anyone reads a document, they're not just reading the words,
they're getting intent from what those words say. Every time you write a report,
you're getting across your way of doing things.
If a report is full of mistakes,
then it can be difficult for the reader to trust it.
If there were lots of mistakes,
were there also lots of mistakes in the test you performed? People will
make assumptions based on what they read in your report.
We want those assumptions to be positive. Quality assurance, or QA, is the
process of checking that something meets a set of requirements. In Kim's
report, another person performed QA checks on it.
No matter how good you are at writing reports, there will always be mistakes.
We're only human, after all. This makes the QA
process an important part of a report.
Our aim is to have as few problems as possible come back from QA.
So what should QA look for? First, it really is important that we've met
our high‑level goals of detailing vulnerabilities,
stating mitigations, and highlighting risks.
That's a good start, but there's definitely more. After that, there are
further properties that are important in a report.
Some of the most important properties are to be accurate,
clear, and concise in everything that's written.