The final result of a pen test is the report.
So, why do we produce one?
Why should a report have certain pieces of information in it?
How do we reduce the time it takes to write it.
Welcome to Pen Testing: Reporting, from Pluralsight. My
name is Gavin Johnson‑Lynn, and we're about to answer all
of those questions and more.
The main goal of this course is to understand what a good pen
test report looks like and how you create one. At a high level,
we need to think about who's going to receive the report and what
they're going to do with it.
That drives everything we put in there.
We also need to think about bringing efficiency to report writing.
If you're writing a lot of reports with similar content,
then you shouldn't write every sentence from scratch.
Good content takes a lot of effort, so it can take a lot of time.
In this course, we're going to see an example pen
test report for an internal network.
There are other types of pen tests, such as web
application or mobile application tests.
This course is intended to be useful no matter what
type of test you've performed.
There are very few differences when it comes to the report. In this module,
we're going to cover how we document vulnerabilities
that have been found during a pen test.
We're going to use the term pen test throughout this course instead of
penetration test. Pen test rolls off the tongue a little better.
The vulnerabilities are the main part of the report, so
before we start to look at anything else,
we look at them. We're going to look at everything we want to get
across from a vulnerability in this report.
That means we need to think about who's reading it and what
information is going to be useful to them.
First,
we need to introduce our pen test. We're working for
Globomantics who have a cybersecurity division.
They perform pen tests for third parties, and, as is usual,
they provide a report at the end detailing the vulnerabilities that were found.
Kim works as a senior pen tester for Globomantics and has
extensive experience. Over at Carved Rock,
we have our senior security engineer, Vincent,
who is part of a small team responsible for keeping the network secure.
Chris is also at Carved Rock and is an IT manager with his last
technical role being many years ago. He arranged this pen test and is
nervously looking forward to the results.
So, why did Chris arrange this test?
He wants to assess the security posture of the network
to see what unknown risks it has.
This helps to understand if the business might need to put more
focus on security or even get more budget to help.
We also have to remember that the business might decide not to
fix all of the vulnerabilities in the report.
There are lots of factors in that decision,
including complexity to fix them and exactly what risks they present.
He's hoping to get some of that information from Kim's report.
Vincent, on the other hand,
is keen to understand any technical vulnerabilities so they can be fixed.
He needs to understand how the vulnerabilities work and,
if necessary, how to replay attacks from them.
It's important that Vincent can know when they're fixed.
Chris and Vincent are all stakeholders, and they each want
different things from the report, so we'll have to keep them in mind.