Just wanted to remind you all that I'll be needing your WSU material and
write-ups. I'm working on the base template for the reports this year
and will send that out when I have it ready. I'll taking some of the
things I liked about the format last year and making some new changes as
well.
If you had a SANS control, please follow last year's format of:
MATURITY SCORE: w/ reference to last year's score and any change
ASSESSMENT FINDINGS:
TESTS AND METRICS:
RECOMMENDATIONS:
REFERENCES:
COMMENTS (optional): Any editorializing or other information you wish to
offer the
institution that doesn't fit in the above sections.
Otherwise, please just organize your pen-test findings, screenshots,
tool reports, etc.
Maybe something like:
FINDINGS: ie, what you were able to do, get to, etc.
TESTS: How you did it.
RECOMMENDATIONS: w/ a tie-back to specific SANS controls that would
mitigate your attack vector.
Thanks,
Andrew
