Internet and Web Application Security, 3rd Edition

Preparing a Vulnerability and Security Assessment Report

Reporting can be the most difficult part of performing a vulnerability or security assessment. Often, numerous audiences—with varying levels of technical knowledge—need the results of the assessment. In some cases, there may be a need to present the data from different perspectives, such as a report focused on risk versus one focused on compliance. The general structure for an assessment report includes the following:

• Executive summary

• Summary of findings

• Details of the vulnerability assessment

• Details of the security assessment

• Recommended remediations

Many of the vulnerability and security assessment tools on the market, particularly the commercial programs, have the ability ...