2KKUU7ita

322
Part VI: Ethical Hacking Aftermath
Table 16-1 Prioritizing Vulnerabilities
High
Impact
Medium
Impact
Low
Impact
High Likelihood Medium Likelihood Low Likelihood
Sensitive information
stored on
an unencrypted
laptop
Unencrypted
e-mails containing
sensitive
information
being sent
Outdated virus
signatures on a
standalone PC
dedicated to
Internet browsing
Tape backups taken
offsite that are not
encrypted and/or
password protected
Missing Windows patch
on internal server that
can be exploited using
Metasploit
Cleaning crew personnel
gaining unauthorized
network access
No admin password
on a SQL
Server system
No passwords
required on several
Windows
administrator
accounts
Weak SSL
encryption being
exploited on
e-commerce site
The vulnerability prioritization shown in Table 16-1 is based on the qualitative
method of assessing security risks. In other words, it’s subjective, based
on your knowledge of the systems and vulnerabilities. You can also consider
any risk ratings you get from your security tools — just don’t rely solely on
them, because a vendor can’t provide ultimate rankings of vulnerabilities.
Creating Reports
You may need to organize your vulnerability information into a formal document
for management or for your client. This is not always the case, but it’s
often the professional thing to do and shows that you take your work seriously.
Ferret out the critical findings and document them so that other parties can
understand them.
Graphs and charts are a plus. Screen captures of your findings — especially
when it’s difficult to save the data to a file — can add a nice touch to your
reports and show tangible evidence that the problem exists.
Document the vulnerabilities in a concise, nontechnical manner. Every report
should contain the following information:
✓ Date(s) the testing was performed
✓ Tests that were performed