Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.

Examples:

We do express grave concern at the overall security posture of that webserver and the possible exposure to $client

In general, it is our feeling that $client is a low-profile, yet high-value target for attack. The public information available about the value of funds managed by the company combined with the number of 3rd party vendors and weakness of the company website might motivate an attacker, with awareness of the company.

Is that language appropriate to include?

share|improve this question
    
Isn't this question itself asking for opinions? ;-) –  Iszi Feb 1 '12 at 22:08
add comment

2 Answers

up vote 10 down vote accepted

In general, the three most valuable layers of penetration test reporting are:

  • Technical - What the problem is, how to repeat it, and how to fix: this is what the IT/Dev team will require and should be in technical language
  • Business - What does each vulnerability mean to the organisation in terms of business risk, impact, loss etc. - this needs to be in language a risk officer, FD or CIO can understand
  • Experience - This is the bigger picture based on experience with the client, in the industry, and in looking at long term trends and new threats. This should be aimed at the board and should provide strategic guidance

Opinion is usually too strong a word, as it can mean something quite strong, especially in an audit setting, which may mean you take on a high liability!

In your specific example, without further context, I would say the wording seems reasonable, and can help to raise the profile of an area they may have overlooked, and at least get on the radar from a risk perspective (what they then do with it is a business decision)

share|improve this answer
2  
Rory is absolutely right, in this context this looks like a reasonable response. Whomever you are doing the service for is undoubtedly using you for your experience/expertise. In my experience, only sharing objective results usually turns into "How critical is it?" followed by "How do we fix it?" Your expert guidance is being requested. Answering these within your deliverables will look good. –  Purge Feb 1 '12 at 19:37
add comment

The opinion of an expert is generally given more weight than a non-expert. Since they (presumably) hired you to perform a pen-test, any opinions you offer should be held to the same degree as any other analysis. An opinion is weakened if not backed up by facts and other supporting analytical evidence to lend credence to its validity.

With that said, I assume this analysis is in place and the language in the snippet is fine. The only thing that may need additional attention are the definitions for low-profile and high-value. This kind of language leaves, I feel, too much room for interpretation. As it is, I'm not sure if you've tackled the "low"-profile side of things. Low-profile may mean that there is little information about the company which appears to conflict with your statement about "public information about the company". It may also mean that with less public scrutiny or knowledge, the security environment may be more lax (or both).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.