Should a pentest report include the tester's opinion?

Question

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.

Examples:

We do express grave concern at the overall security posture of that webserver and the possible exposure to $client

In general, it is our feeling that $client is a low-profile, yet high-value target for attack. The public information available about the value of funds managed by the company combined with the number of 3rd party vendors and weakness of the company website might motivate an attacker, with awareness of the company.

Is that language appropriate to include?

Answer 1

In general, the three most valuable layers of penetration test reporting are:

• Technical - What the problem is, how to repeat it, and how to fix: this is what the IT/Dev team will require and should be in technical language
• Business - What does each vulnerability mean to the organisation in terms of business risk, impact, loss etc. - this needs to be in language a risk officer, FD or CIO can understand
• Experience - This is the bigger picture based on experience with the client, in the industry, and in looking at long term trends and new threats. This should be aimed at the board and should provide strategic guidance

Opinion is usually too strong a word, as it can mean something quite strong, especially in an audit setting, which may mean you take on a high liability!

In your specific example, without further context, I would say the wording seems reasonable, and can help to raise the profile of an area they may have overlooked, and at least get on the radar from a risk perspective (what they then do with it is a business decision)

Answer 2

The opinion of an expert is generally given more weight than a non-expert. Since they (presumably) hired you to perform a pen-test, any opinions you offer should be held to the same degree as any other analysis. An opinion is weakened if not backed up by facts and other supporting analytical evidence to lend credence to its validity.

With that said, I assume this analysis is in place and the language in the snippet is fine. The only thing that may need additional attention are the definitions for low-profile and high-value. This kind of language leaves, I feel, too much room for interpretation. As it is, I'm not sure if you've tackled the "low"-profile side of things. Low-profile may mean that there is little information about the company which appears to conflict with your statement about "public information about the company". It may also mean that with less public scrutiny or knowledge, the security environment may be more lax (or both).