Reporting

Reporting is a crucial component of a cybersecurity audit. Think of it as a clear, comprehensive summary that details how secure an organization’s digital environment is, where the weak spots are, and how to fortify them. The goal of a cybersecurity engineer is to run scans, find vulnerabilities, and prepare a report for the client to help them mitigate their risks. The final report aims to provide a clear picture of the organization’s cybersecurity posture, highlighting areas of strength and those needing improvement.

Why is reporting important?

• Snapshot of security health: The report provides a clear snapshot of the current state of an organization’s cybersecurity, making it easier for decision-makers to understand vulnerabilities and threats.

• Action points: A good report doesn’t just highlight problems; it provides actionable recommendations on how to fix or mitigate them.

• Accountability: The report establishes a record, ensuring there’s clarity on what needs to be done, who is responsible, and the timeframe.

• Compliance check: For organizations subject to specific regulations, the report demonstrates whether they’re compliant and, if not, where they fall short.

• Basis for future strategy: By understanding the current security landscape, organizations can plan future cybersecurity strategies more effectively.

Structure of an audit report

Here’s how a pen-testing audit report is structured:

Date: [Date of the submission of the report]

Audited System: [Server/IP]

Conducted by: [Your company name]

Executive summary

Explain in detail the objective, methodology, and tools used to perform this audit.

Network profile

• Include open ports and services.

• Include service version details.

Identified vulnerabilities

List the vulnerabilities found during the audit.

Recommendations

List mitigation strategies.

Conclusion

Summarize the audit report and recommendations.

Let’s look at a sample audit report conducted by Educative Inc. on September 25, 2023, on the scanme.nmap.org server.

Sample audit report

Date: September 25, 2023
Audited System: Server - scanme.nmap.org
Conducted by: Educative Inc.

Executive summary

A cybersecurity audit was conducted on scanme.nmap.org to assess the current state of the server’s security posture. The main objectives of the audit were to identify vulnerabilities in the ports, protocols, and services running on the server, assess the risk associated with these vulnerabilities, and provide recommendations to address these vulnerabilities.

Network profile

• Open ports and protocols:

  • Port 22: SSH (Secure Shell)

  • Port 80: HTTP (web service)

• Service version details:

  • SSH: OpenSSH 7.9p1 (OpenSSH)

  • HTTP: Apache httpd 2.4.38 (Apache Struts)

Identified vulnerabilities

• CVE-2022-12345: Apache Struts remote code execution vulnerability
  
  Port affected: 80 - Service: HTTP (Apache Struts)
  
  Severity: Critical
  
  Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apache Struts. A flaw exists because the software mishandles file upload.
  
  Impact: If exploited, this vulnerability could allow an attacker to gain full control over the affected system.
  

• CVE-2022-67890: OpenSSH user enumeration weakness
  
  Port Affected: 22 - Service: SSH (OpenSSH)
  
  Severity: Medium
  
  Description: Due to a flaw in OpenSSH, attackers can potentially determine if a particular username exists on a system.
  
  Impact: This vulnerability could aid an attacker in their reconnaissance phase and further attacks.

Recommendations

• Regularly update software: Ensure that all services, especially those exposed to the internet, are up to date. Vulnerabilities are often found in older versions of software, so regular updates are crucial.

  • Update OpenSSH to the latest stable version to patch any potential vulnerabilities.

  • Ensure the Apache httpd server is also updated to its latest version.

• Restrict unnecessary ports:

  • Limit the exposure of services to the internet:

    • If SSH is not required to be accessed from the internet, consider closing port 22 or limiting access to a specific set of IPs.

  • Implement a firewall to restrict access to necessary ports only.

• Server hardening:

  • Ensure that default configurations are modified, for instance, by changing default credentials, removing unnecessary software, and disabling unnecessary services.

  • Implement a security configuration standard like the Center for Internet Security (CIS) benchmarks.

Conclusion

We recommend that the organization take immediate steps to address the identified vulnerabilities. Regular audits and proactive monitoring are crucial to ensure the continued security and compliance of your IT infrastructure.

Reporting in cybersecurity audits is crucial because it provides a detailed assessment of the organization’s security posture, identifying vulnerabilities and noncompliance issues. It helps us make informed decisions, enabling stakeholders to prioritize remedial actions and allocate resources efficiently. Moreover, thorough reporting demonstrates accountability and compliance with regulatory bodies, potentially averting legal complications and fostering trust among clients and partners.