2KKUU7ita

✓ Summary of the vulnerabilities discovered
Chapter 16: Reporting Your Results
✓ Prioritized list of vulnerabilities that need to be addressed
✓ Recommendations and specific steps on how to plug the security holes
found
If it will add value to management or your client (and it often does), you can
add a list of general observations around weak business processes, management’s
support of IT and security, and so on along with recommendations for
addressing each issue.
Most people want the final report to include a summary of the findings — not
everything. The last thing most people want to do is sift through a 5-inch-thick
stack of papers containing technical jargon that means very little to them.
Many consulting firms have been known to charge an arm and a leg for this
very type of report, but that doesn’t make it the right way to report.
Many managers and clients like receiving raw data reports from the security
tools. That way, they can reference the data later if they want but aren’t mired
in hundreds of hard-copy pages of technical gobbledygook. Just make sure
you include the raw data in the Appendix of your report or elsewhere and
refer the reader to it.
Your list of action items in your report might include the following:
✓ Enable Windows security auditing on all servers — especially for logons
and logoffs.
✓ Put a secure lock on the server room’s door.
✓ Harden operating systems based on strong security practices from the
National Vulnerabilities Database (http://nvd.nist.gov), the Center
for Internet Security Benchmarks/Scoring Tools (www.cisecurity.
org), and Network Security For Dummies.
✓ Harden your wireless access points by using the techniques and recommendations
presented in Hacking Wireless Networks For Dummies.
✓ Use a cross-cut paper shredder for the destruction of confidential hardcopy
information.
✓ Require strong PINs or passphrases on all mobile devices and force
users to change them periodically.
✓ Install personal firewall/IPS software on all laptops.
✓ Validate input in all web applications to eliminate cross-site scripting
and SQL injection.
✓ Apply the latest vendor patches to the database server.
323