Building the Final Report
With the analysis complete, it's now time to document the results in an official report. The final report is designed to be read by senior management. Its purpose is to help them make operational, technical, and managerial changes. The report should describe threats and vulnerabilities and provide recommendations for controls to reduce risk. The finished document should not read like an audit or investigational report, because that is not what it is. An assessment is a systematic, analytical methodology to assessing vulnerabilities. It is not looking for wrongdoing or to hold individuals accountable for specific actions.
To document your findings and propose solutions, make sure to give those who will be reading the report enough information to make a decision and take action. Writers with a traditional, scientific background often write very precisely, whereas those from other backgrounds sometimes have a more fluid style. No matter what your background is, establish a style that is concise in its approach but allows for more descriptive paragraphs when needed. The last thing you want is for your assessment to not be taken seriously because of a problem with the written report. Common documentation problems include the following:
- Information is hard to scan and grasp quickly.
- Organization is poor or cumbersome.
- Logic leading to conclusions is unclear.
- Conclusions and recommendations are not spelled out.
- Document focus is unclear.
- Sentences are poorly constructed.
- Word choice is imprecise.
- Too much jargon is used.
- Document is poorly constructed.
- Documents are too long.
Avoiding these pitfalls will help ensure that your report gets the time and consideration it deserves. You goal is to communicate effectively the knowledge and information that you have gained by performing this assessment. From a technical context, this report has two major goals:
- It clarifies your findings for the reader.
- It conveys critical information.
Introduction to Assessing Network Vulnerabilities
- Introduction to Assessing Network Vulnerabilities
- What Security Is and Isnt
- Process for Assessing Risk
- Four Ways in Which You Can Respond to Risk
- Network Vulnerability Assessment
Foundations and Principles of Security
- Foundations and Principles of Security
- Basic Security Principles
- Security Requires Information Classification
- The Policy Framework
- The Role Authentication, Authorization, and Accountability Play in a Secure Organization
- Encryption
- Security and the Employee (Social Engineering)
Why Risk Assessment
- Why Risk Assessment
- Risk Terminology
- Laws, Mandates, and Regulations
- Risk Assessment Best Practices
- Understanding the IT Security Process
- The Goals and Objectives of a Risk Assessment
Risk-Assessment Methodologies
- Risk-Assessment Methodologies
- Risk-Assessment Terminology
- Quantitative and Qualitative Risk-Assessment Approaches
- Best Practices for Quantitative and Qualitative Risk Assessment
- Choosing the Best Risk-Assessment Approach
- Common Risk-Assessment Methodologies and Templates
Scoping the Project
- Scoping the Project
- Defining the Scope of the Assessment
- Reviewing Critical Systems and Information
- Compiling the Needed Documentation
- Making Sure You Are Ready to Begin
Understanding the Attacker
- Understanding the Attacker
- Who Are the Attackers?
- What Do Attackers Do?
- Reducing the Risk of an Attack
- How to Respond to an Attack
Performing the Assessment
- Performing the Assessment
- Introducing the Assessment Process
- Level I Assessments
- Level II Assessments
- Level III Assessments
Tools Used for Assessments and Evaluations
- Tools Used for Assessments and Evaluations
- A Brief History of Security Tools
- Putting Together a Toolkit
- Determining What Tools to Use
Preparing the Final Report
- Preparing the Final Report
- Preparing for Analysis
- Ranking Your Findings
- Building the Final Report
- Contents of a Good Report
- Determining the Next Step
- Audit and Compliance
Post-Assessment Activities
- Post-Assessment Activities
- IT Security Architecture and Framework
- Roles, Responsibilities, and Accountabilities
- Security Incident Response Team (SIRT)
- Vulnerability Management
- Training IT Staff and End Users
Appendix A. Security Assessment Resources
Appendix B. Security Assessment Forms
- Information Request Form
- Document Tracking Form
- Critical Systems and Information Forms
- Level II Assessment Forms
Appendix C. Security Assessment Sample Report
- Appendix C. Security Assessment Sample Report
- Notice
- Executive Summary
- Statement of Work
- Analysis
- Recommendations
- Conclusions
Appendix D. Dealing with Consultants and Outside Vendors
- Appendix D. Dealing with Consultants and Outside Vendors
- Procurement Terminology
- Typical RFP Procurement Steps
- Procurement Best Practices
Appendix E. SIRT Team Report Format Template
EAN: 2147483647
Pages: 138
