Scribd Logo
Upload

Welcome to Scribd!

  • 44 views

    Sans 1231

    Uploaded by

    Sandro Melo
    This document provides tips for creating an effective information security assessment report, including analyzing data collected during the assessment, prioritizing risks and recommendations, documenting the methodology and scope, including relevant findings and remediation guidance, and creating an executive summary highlighting key results. It stresses involving colleagues, using templates from prior reports, safeguarding sensitive report contents, and providing value beyond just presenting existing data.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Sans 1231

    Uploaded by

    Sandro Melo
    44 views1 page
    This document provides tips for creating an effective information security assessment report, including analyzing data collected during the assessment, prioritizing risks and recommendations, documenting the methodology and scope, including relevant findings and remediation guidance, and creating an executive summary highlighting key results. It stresses involving colleagues, using templates from prior reports, safeguarding sensitive report contents, and providing value beyond just presenting existing data.

    Original Description:

    Analyzing Malicious Documents Cheat Sheet

    Original Title

    SANS 1231

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides tips for creating an effective information security assessment report, including analyzing data collected during the assessment, prioritizing risks and recommendations, documenting the methodology and scope, including relevant findings and remediation guidance, and creating an executive summary highlighting key results. It stresses involving colleagues, using templates from prior reports, safeguarding sensitive report contents, and providing value beyond just presenting existing data.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    44 views1 page

    Sans 1231

    Uploaded by

    Sandro Melo
    This document provides tips for creating an effective information security assessment report, including analyzing data collected during the assessment, prioritizing risks and recommendations, documenting the methodology and scope, including relevant findings and remediation guidance, and creating an executive summary highlighting key results. It stresses involving colleagues, using templates from prior reports, safeguarding sensitive report contents, and providing value beyond just presenting existing data.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 1

    TIPS FOR CREATING AN INFORMATION Fill in the gaps in your understanding with follow-up Provide practical remediation path,

    Provide practical remediation path, accounting for


    scans, document requests and/or interviews. the organization’s strengths and weaknesses.
    SECURITY ASSESSMENT REPORT
    This cheat sheet presents recommendations for Involve colleagues in your analysis to obtain other Qualities of a Good Assessment Report
    creating a strong report as part of an information people’s perspectives on the data and conclusions. Starts with a strong executive summary that a non-
    security assessment project. Assessment Methodology Documentation technical reader can understand
    Document the methodology used to perform the Provides meaningful analysis, rather than merely
    General Approach to Creating the Report presenting the output of assessment tools
    assessment, analyze data and prioritize findings.
    1. Analyze the data collected during the security
    assessment to identify relevant issues. The methodology’s description need to demonstrate Includes supporting figures to support the analysis
    a systemic and well-reasoned assessment approach. Describes assessment methodology and scope
    2. Prioritize your risks and observations; formulate
    remediation steps. Clarify the type of the assessment performed: Looks professional and is without typos
    penetration test, vulnerability assessment, etc.
    3. Document the sections of the report detailing Offers remediation guidance beyond merely pointing
    the assessment methodology and scope. If applicable, explain what security assessment tools out security problems
    were used and how they were configured.
    4. Document the sections of the report describing Is structured in logical sections to accommodate the
    your findings and recommendations. If applicable, describe what approach guided the different groups who’ll read and act upon it
    questions you asked during interviews.
    5. Attach relevant figures and raw data to support Additional Assessment Report Tips
    the main body of the report. Describe the criteria used to assign severity or
    Create templates based on prior reports, so you
    criticality levels to the findings of the assessment.
    6. Create the executive summary to highlight the don’t have to write every document from scratch.
    key findings and recommendations. Refer to the relevant frameworks you used to guide Safeguard (encrypt) the report when storing and
    the assessment efforts (PCI DSS, ISO 27001, etc.). sending it, since its contents are probably sensitive.
    7. Proof-read and edit the document.
    Scope of the Security Assessment Use concrete statements; avoid passive voice.
    8. Consider submitting the report’s draft to weed
    Specify what systems, networks and/or applications
    out false positives and confirm expectations. Explain the significance of the security findings in the
    were reviewed as part of the security assessment.
    9. Submit the final report to the intended recipient context of current threats and events.
    State what documentation was reviewed if any.
    using agreed-upon secure transfer mechanism. Put effort into making the report as brief as possible
    10. Discuss the report’s contents with the recipient List the people whom you interviewed, if any. without omitting important and relevant contents.
    on the phone or in person. Clarify the primary goals of the assessment project. More Security Assessment Tips
    Analysis of the Security Assessment Data Discuss what contractual obligations or regulatory 6 Qualities of a Good Information Security Report:
    Your analysis should provide value beyond requirements were accounted for in the assessment. http://j.mp/m3AK9r
    regurgitating the data already in existence. Document any items that were specifically excluded 4 Tips for a Strong Executive Summary of a Security
    Consider what information provided to you is from the assessment’s scope and explain why. Assessment Report: http://j.mp/jsT669
    incomplete or might be a lie or half-truth. Documenting Conclusions Security Assessment Report as Critique, Not Criticism:
    Group initial findings based on affected resources, Include both negative and positive findings. http://j.mp/m6e6p0
    risk, issue category, etc. to look for patterns. Account for organization’s industry, business model 4 Reasons Why Security Assessment
    Identify for trends that highlight the existence of and compliance requirements where appropriate. Recommendations Get Ignored: http://j.mp/irFHRa
    underlying problems that affect security. Stay consistent with the methodology and scope. Dealing with Misinformation During Security
    If examining scanner output, consider exploring the Prioritize findings related to security risks. Assessments: http://j.mp/jv8jxz
    data using spreadsheets and pivot tables.

    Authored Lenny Zeltser, who writes a daily security blog at blog.zeltser.com; you can also find him on Twitter as @lennyzeltser. This cheat sheet was reviewed by Dave Shackleford and John
    Strand. It’s distributed according to the Creative Commons v3 “Attribution” License. You’re looking at version 1.0 of this document. For more security cheat sheets see http://j.mp/mrGgHJ.

    You might also like