A Review of Standardization for Penetration Testing Reports and Documents

Abstract

Penetration testing or pen test is a simulated cyber-attack conducted to find the vulnerabilities and weaknesses in a computer system. The test is conducted by professionals hired by the organization that produces a report to the organization for further actions. However, the report produce varies according to the different tester. This is because there is no standardized format of a pen test report approved by any security organization or bodies. Each tester would submit a report based on the findings on their company’s policy. We analyse eight pen test report available online to find any similarities or pattern so that we can come out with a standardized format which comprises of components we think is needed in the report. The proposed format will also cater to the understanding of both security system personnel and the upper management of the organization. This is due to the fact that technicality of the report may not be clear to the top management, which results in them taking less consideration upon the issues of vulnerabilities in their system. This standardized report will cater to the needs of both system security personnel and the upper management by taking further actions upon improving the security of their network, servers, computers, firewalls and all of the access channels of their system.