We've been over how to take notes, make sure that all of our time stamps are
aligned.
Basically, we're building out references for our final executive summary.
Now, I want to point out that in executive summary, you will not have all the
nitty-gritty details of every vulnerability exploit or problem that was found
throughout
the course of our pen test. An executive summary is really just for the C-suite
or
anybody in charge of the organization or network that we're actually doing the
pen test on.
It's a synopsis or a very brief summary of what's actually happened throughout
the course
of our pen test. Key bullet points is the topic here. We don't want to
overwhelm everybody
throughout the executive summary, and we want to try to keep it as short as
possible.
Now, generally, executive summaries are going to be a page or two. That should
be enough information
right there to tell you that only the most important information is only going
to be inside of the
executive summary. Now, as we go through this, I kind of want to point out a
couple of different
areas real quick, and that is, first, starting off, we need to have an
engagement overview.
This will basically be the opening paragraph of our executive summary that
explains
what exactly happened and when did it happen. So, how long did our pen test
take?
When or who did we pen test against and what were we looking for? Followed
right after that are
going to be our key findings. Just for me, and you may be a little bit
different based on
space available within your executive summary or how detailed you want to go,
I generally try to keep this between three and four of the biggest points taken
away from
the actual pen test itself. Again, we're not trying to get too far into the
weeds of what
actually happened, but let's say throughout the course of our pen test that we
discovered that
there was a serious password breach on a critical server within the
organization that were pen
test against. That's something that needs to be highlighted, especially if it
has something to do
with PII or information that is federally regulated, like HIPAA or FERPA or
something along those lines.
And inside of those different three or four areas, we want to bring out the
biggest things that
need to be addressed. Along with those could be like, let's say we did a
username and password
test on the actual network itself against active directory and we found that a
bunch of default
passwords were being utilized or that there were some weak passwords all across
the network,
so easily guessed and things like that. It might be something that you want to
bring up. So many
accounts, XX accounts had the weak passwords that were able to be penetrated
and exploited and
basically just key points. We don't want to go too deep on this one. This is
going to be followed
by our risk assessment and this is just a quick paragraph of where do we as pen
testers see the
overall organization, not one particular system, not an idea of multiple
systems,
but the overall organization itself, low, medium, high, critical, whatever the
case may be, because
it's also possible that you can run a NASA scan and find a high or critical
vulnerability within
the organization and this is an accepted risk by that network or system owner
that's already been
identified as an exception inside of our scope and rules of engagement. If that
's the case,
then that shouldn't really be included here. We just want to have a quick, hey,
where do we see
the organization? Overall, I rate you as medium. There are a couple of
different things on there
that you should take a look at and that should really be it. We're then
followed up by the
recommendations section. What are some quick tidbits that the C-suite can
identify to issue out
orders to the tech team to be able to remediate issues that were found within
the course of our
pen test? These would be very quick and to the point. You don't want to go into
the actual technical
details. For example, let's say those passwords that we were talking about
earlier, we just want
to be able to identify that as a recommendation, maybe users should go in and
strengthen up their
passwords. Maybe the administration team can implement a policy of minimum
strength passwords,
something along those lines, not the actual CB or the configuration idea inside
of the system
itself. Lastly, we wrap up with the conclusion and this is going to be a quick,
this is what happened.
We revealed many different things that were wrong with your organization and we
're going to recommend
a follow-up or not and when that follow-up should take place. For me, on my
executive summaries,
I'm always going to have an included section at the very bottom as well. This
is basically an old
DoD habit because for memorandums for record or anything like that, you'll
always have an
included section at the bottom. Now it's good to have an executive summary be a
synopsis of
everything that happened really quick but also include the detailed information
such as the
vulnerability assessment such as the actual network scan that we did throughout
the pen test itself
and some of the CDE reports of the different things that we found that were
causing or are
raising attention to earlier on in our executive summary. Now all this is
pretty much straightforward
and I will give you an example in the challenge because I just wanted to go
over some of the
different things that we needed to consider when it comes to executive summary
and that's
going to take us into our challenge.