Writing reports really is a lot of work, and we want
to reduce that as much as possible.
That means we spend more time finding vulnerabilities and
less time reporting. Sounds good. In this module, we're
going to try to do just that.
We're going to look at using templates for reports,
which should reduce a lot of repetition.
We're then going to look at automated reporting solutions and how they can help.
If you're doing a lot of reports, then this will really help.
Finally,
we've got a few more tips on reducing the effort while
still getting quality in your reports.
Kim is our guide to streamlining the process of pen testing.
What she wants is to be able to make as few mistakes as
possible in her pen test reports whilst taking as little
time as possible to do them.
She uses templates to help with both of these things.
At Globomantics, they're in the early days of producing pen test
reports and have started to create templates.
Let's see Kim's guidance. Templates are a simple step
towards reducing reporting time.
We've got two things we'll want to make templates for.
First, the structure of the report,
so everything from the cover sheet to appendices.
Then, we'll want to template individual findings, so pre‑written text for any
vulnerability we'll commonly find. In any template, there are things that stay
the same and things that change. The static parts,
those that stay the same, we're talking about things that really change
between pen tests. They might occasionally get an update,
but they're largely static.
This is often generic information in the report,
such as detailing how and why we have risk scores and severity
ratings. For things that change in templates, the dynamic areas,
we're thinking about parts of the report that are often specific
to an individual pen test, so the detail of a finding or the executive summary.