2KKUU7ita

324
Part VI: Ethical Hacking Aftermath
As part of the final report, you might want to document employee reactions
that you observe when carrying out your ethical hacking tests. For example,
are employees completely oblivious or even belligerent when you carry out
an obvious social engineering attack? Does the IT or security staff completely
miss technical tip-offs, such as the performance of the network degrading
during testing or various attacks appearing in system log files? You can also
document other security issues you observe, such as how quickly IT staff or
manager services providers respond to your tests or whether they respond
at all.
Guard the final report to keep it secure from people who are not authorized to
see it. An ethical hacking report and the associated documentation and files in
the hands of a competitor, hacker, or malicious insider could spell trouble for
the organization. Here are some ways to prevent this from happening:
✓ Deliver the report and associated documentation and files only to those
who have a business need to know.
✓ When sending the final report, encrypt all attachments, such as documentation
and test results, using PGP, encrypted Zip format, or secure cloud
file-sharing service. Of course, hand delivery is your most secure bet.
✓ Leave the actual testing steps that a malicious person could abuse out of
the report. Answer any questions on that subject as needed.