2KKUU7ita

In This Chapter
Chapter 16
Reporting Your Results
▶ Bringing your test data together
▶ Categorizing vulnerabilities you discover
▶ Documenting and presenting the results
I f you’re wishing for a break after testing, now isn’t the time to rest on your
laurels. The reporting phase of your ethical hacking is one of the most
critical pieces. The last thing you want to do is to run your tests, find security
problems, and leave it at that. Put your time and effort to good use by thoroughly
analyzing and documenting what you find to ensure that security vulnerabilities
are eliminated and your information is more secure as a result.
Reporting is an essential element of the ongoing vigilance that information
security and risk management requires.
Ethical hacking reporting includes sifting through all your findings to determine
which vulnerabilities need to be addressed and which ones don’t really
matter. Reporting also includes briefing management or your client on the
various security issues you find, as well as giving specific recommendations
for making improvements. You share the information you’ve gathered and
give the other parties guidance on where to go from there. Reporting also
shows that the time, effort, and money invested in the ethical hacking tests
were put to good use.
Pulling the Results Together
When you have gobs of test data — from screenshots and manual observations
you documented to detailed reports generated by the various vulnerability
scanners you used — what do you do with it all? You need to go
through your documentation with a fine-toothed comb and highlight all the
areas that stand out. Base your decisions on the following: