1. CSC300 Offensive Security Dr. Ronny L. Bull, Ph.D. Executive Summary

2. Overview Executive Summary Background Overall Posture General Findings
Recommendation Summary
Strategic Roadmap

3. Executive Summary
Intended to provide a high level overview for non- technical executives in charge of:
Oversight of corporate affairs
Strategic vision of organization
Security program
Operations
Financial aspects

4. Executive Summary Should contain the following sections: Background
Overall Posture
Risk Ranking/Profile
General Findings
Recommendation Summary
Strategic Roadmap

5. Executive Summary Background Section
Should identify the overall purpose of the test
Should contain information based on pre-engagement relating to:
Risks
Countermeasures
Testing Goals
These help reader connect to overall test objectives and results

6. Executive Summary Background Section (Cont)
If any objectives were changed during the test they should be highlighted in the background section so they can be identified up front.

7. Executive Summary Overall Posture Section
Narrative of the overall effectiveness of the test
Did the pen-testers satisfy all of the goals identified during pre-engagement?
Brief descriptions of issues identified through testing process (high level)
Ability to achieve access to goal information and identify risks to the business

8. Executive Summary Risk Ranking/Profile Summary
How does the organization rank in terms of Risk
Scoring mechanism should be identified in pre- engagement, so that it is understood when presented at the end of the test
Low, Moderate, Elevated, High, Extreme
Use numeric value ranges to indicate risk level

10. Executive Summary General Findings Section
Provides a synopsis of the issues found during the penetration test
Basic and statistical formats
Graph representations
Targets tested
Testing results
Processes
Attack scenarios
Success rates

12. Executive Summary Recommendation Summary
Provide a high level understanding of the tasks needed to resolve the risks identified
General level of effort required to implement each resolution
Give them an idea of the resources it will require
Prioritization of tasks in order of risk by weight
What should the organization fix now
What can wait

13. Executive Summary Strategic Roadmap
Should include prioritized plan for remediation of risks found
Weighted against business objectives and level of impact
Break up into per-defined time/objective based goals
Will help to create a plan to follow for remediation

17. Example

18. Your Task Search for some other example Executive Reports
Evaluate them based upon the criteria set forth in these slides as well as at:
Do they follow the guidelines?
Do they provide any extra information not listed in the guidelines?
Was this information necessary, or does it just add more confusion for non-technical individuals?

19. Some Fun For This Week https://www.hackthissite.org/
Sign up for an account
Start going through the basic missions
See how far you can get by the end of class on Thursday
If you get through the basic missions feel free to start on the Realistic ones
No report due next week!