Announcement

Collapse
No announcement yet.

[resource] vulnerability report writing resources

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • [resource] vulnerability report writing resources

    So here I am getting carpal tunnel again trying to write page after page of recommendations and I'm thinking to myself, I bet those swell fellows over at defcon.org/forums have done this tons of times as well. So I got to thinking, has anyone ever tried to set up a semi-private kind of boiler plate repository of "best practices" write ups for the typical corporate environment. I have some previous reports that can be used for a kind of best practices report for just about any environment (that runs windows/cisco/generic storage/vmware/etc)

    I figure keeping this kind of thing "semi public" would help to protect anyone posting information from violating any confidentiality agreements, or exposing any company to malicious activity. It would obviously be very important to sanitize everything, any identifiable data could be disastrous. The ideal is to really kind of compare notes on the types of reports you produce and hopefully improve everyone's ability to provide a valuable services to their clients.

    After all, how fun is it compiling best practices from multiple sources time and time again, or just changing the names on huge sections of the same report you turn out time and time again?

    There has to be a better way right?

    Thoughts?
    Network Jesus died for your SYN

  • #2
    Re: [resource] vulnerability report writing resources

    Check out TechRepublic.com. They have a lot of templates along those lines.
    Thorn
    "If you can't be a good example, then you'll just have to be a horrible warning." - Catherine Aird

    Comment


    • #3
      Re: [resource] vulnerability report writing resources

      I was thinking of the kinds of things that typically aren't shown in the templates at places like techrepublic, things like NTLM settings, using reversible encryption, account lockout durations settings, the use of port security, dynamic arp inspection, IP DHCP snooping, etc etc

      things that people around here have picked up over the years, a kind of "real world" best practices thing if that makes any sense. Thanks for the tip though

      I thought it might be a bit more valuable than just the typical template
      Network Jesus died for your SYN

      Comment


      • #4
        Re: [resource] vulnerability report writing resources

        value?
        What values?

        Comment

        Working...
        X