Capstone: Security Assessment Report

Writing Effective Findings

A security assessment is only as valuable as the report it produces. Technical findings that leadership can't understand, that engineers can't reproduce, or that don't prioritize effectively are wasted effort. The capstone report must bridge the gap between technical detail and business action.

The anatomy of a finding

Every finding must answer five questions:

1. What is the vulnerability? — A clear, specific description
2. Where is it? — The affected assets, systems, or configurations
3. How do I reproduce it? — Step-by-step instructions
4. What is the impact? — The business consequence if exploited
5. How do I fix it? — Specific remediation guidance

finding:
  id: VULN-001
  title: Unauthenticated API endpoint exposes user PII
  severity: Critical
  cvss_score: 9.1
  category: Broken Access Control
  affected_assets:
    - api.company.com/v2/users
    - api.company.com/v2/orders
  description: >
    The /v2/users endpoint returns full user records (including email, phone,
    and address) without requiring authentication. Any unauthenticated user
    can enumerate all user records by incrementing the user ID parameter.
  reproduction_steps:
    - step: 1
      action: "Send GET request to https://api.company.com/v2/users/1"
      expected: "401 Unauthorized"
      actual: "200 OK with full user record including PII"
    - step: 2
      action: "Increment user ID: GET https://api.company.com/v2/users/2"
      expected: "401 Unauthorized"
      actual: "200 OK with second user record"
    - step: 3
      action: "Automate enumeration with a loop over user IDs 1-10000"
      expected: "All requests rejected"
      actual: "All 10,000 user records retrieved in 45 seconds"
  evidence:
    - screenshot: api-response-with-pii.png
    - http_request: "GET /v2/users/1 HTTP/1.1\nHost: api.company.com"
    - http_response: "HTTP/1.1 200 OK\nContent-Type: application/json\n\n{\"id\":1,\"email\":\"user@company.com\",\"phone\":\"+1-555-0100\"}"
    - burp_suite_project: api-enumeration.burp
  business_impact: >
    An attacker can enumerate the entire user database without any credentials.
    This exposes PII for all 10,000+ users, creating GDPR/CCPA compliance violations
    and potential regulatory fines. The data could also be used for targeted
    phishing attacks against users.
  remediation:
    - action: "Add authentication middleware to the /v2/users endpoint"
      effort: "2 hours"
      priority: P1
    - action: "Add rate limiting to prevent automated enumeration"
      effort: "4 hours"
      priority: P1
    - action: "Audit access logs for evidence of prior exploitation"
      effort: "8 hours"
      priority: P2
    - action: "Review all API endpoints for similar authentication gaps"
      effort: "16 hours"
      priority: P2
  references:
    - "OWASP API Security Top 10: API2 2019 Broken User Authentication"
    - "CWE-306: Missing Authentication for Critical Function"

Severity ratings

Use a consistent severity framework. CVSS (Common Vulnerability Scoring System) is the industry standard:

Writing for multiple audiences

A security assessment report serves two distinct audiences:

Technical audience (engineers, security team):

• Detailed reproduction steps
• HTTP requests and responses
• Specific file paths and line numbers
• Technical remediation guidance

Business audience (leadership, board):

• Business impact in financial terms
• Risk ratings and trends
• Remediation costs and timelines
• Compliance implications

The report must serve both. Technical findings go in the body; business impact goes in the executive summary.

Executive Summary and Business Translation

The executive summary is the most important section of the report. Most readers — especially leadership — will only read this section. It must translate technical findings into business language that drives action.

The executive summary structure

## Executive Summary

### Overall Risk Rating: HIGH

This assessment identified 23 vulnerabilities across the production
environment: 4 Critical, 7 High, 8 Medium, and 4 Low. The most urgent
finding is an unauthenticated API endpoint that exposes PII for all
10,000+ users — a GDPR/CCPA compliance violation requiring immediate
remediation.

### Key Findings

1. **Unauthenticated API exposure (Critical)**: An attacker can enumerate
   the entire user database without credentials. This is a reportable
   data breach under GDPR. Estimated regulatory exposure: €2M-4M.
   Remediation cost: $3,000. **Recommend immediate remediation.**

2. **Over-privileged cloud IAM roles (High)**: Three service accounts have
   permissions far beyond their operational needs. If compromised, an
   attacker could access production databases. Remediation cost: $8,000.
   **Recommend remediation within 30 days.**

3. **Unpatched internet-facing servers (High)**: Two web servers are missing
   critical security patches. Known exploits exist in the wild.
   Remediation cost: $2,000. **Remediate within 7 days.**

### Business Impact

| Finding | Regulatory Risk | Financial Exposure | Reputational Risk |
|---|---|---|---|
| API exposure | GDPR/CCPA violation | €2M-4M fines | High — customer PII |
| IAM over-permission | SOC 2 finding | Audit failure | Medium |
| Unpatched servers | — | $500K if exploited | Medium |

### Remediation Investment

Total estimated remediation cost: $47,000
Recommended timeline: 90 days
ROI: Prevents potential €4M+ regulatory exposure and breach costs

### Trend

Compared to the previous assessment (6 months ago):
- Critical findings: 4 (down from 7) — improving
- High findings: 7 (down from 12) — improving
- Mean time to remediate: 21 days (down from 34 days) — improving
- Overall posture: Moderate (down from High risk) — improving

Translating technical to business

The key skill is translating technical findings into business consequences:

The risk matrix

Plot findings on a likelihood/impact matrix for visual communication:

           │ Low Impact │ Med Impact │ High Impact │ Critical Impact
───────────┼────────────┼────────────┼─────────────┼────────────────
 Likely    │            │  Unpatched │  IAM roles  │  API exposure
           │            │  servers   │             │
───────────┼────────────┼────────────┼─────────────┼────────────────
 Possible  │            │  Weak      │  Missing    │  No encryption
           │            │  passwords │  WAF        │  at rest
───────────┼────────────┼────────────┼─────────────┼────────────────
 Unlikely  │  Info      │  Verbose   │  Default    │
           │  disclosure│  errors    │  creds      │

The remediation roadmap

The report should include a prioritized remediation timeline:

Week 1-2:  Critical findings (API exposure, unpatched servers)
Week 3-4:  High findings (IAM roles, missing WAF)
Month 2: Medium findings (password policy, verbose errors)
Month 3:  Low findings and hardening (default creds, info disclosure)

Each phase includes:
- Specific findings to remediate
- Estimated effort
- Responsible team
- Verification method

The roadmap turns the report from a static document into an action plan.

Remediation Tracking and Verification

A report that isn't tracked is a report that's forgotten. The capstone doesn't end with the report — it ends when every finding is remediated and verified. This requires a structured tracking process.

The remediation lifecycle

Identified → Assigned → In Progress → Remediated → Verified → Closed

Each finding moves through these states:

1. Identified: The finding is documented in the report
2. Assigned: A named owner is responsible for remediation
3. In Progress: Work has begun
4. Remediated: The fix has been implemented
5. Verified: An independent party confirms the fix is effective
6. Closed: The finding is resolved and documented

The remediation tracking matrix

findings:
  - id: VULN-001
    title: Unauthenticated API endpoint
    severity: Critical
    owner: api-team@company.com
    status: In Progress
    assigned_date: 2026-09-30
    due_date: 2026-10-07
    remediation_effort: 8 hours
    verification_method: "Re-run enumeration script, expect 401 for all requests"
    notes: "Authentication middleware deployed to staging, pending production rollout"

  - id: VULN-002
    title: Over-privileged IAM roles
    severity: High
    owner: cloud-team@company.com
    status: Assigned
    assigned_date: 2026-09-30
    due_date: 2026-10-14
    remediation_effort: 16 hours
    verification_method: "IAM Access Analyzer shows no external access, permission boundaries in place"
    notes: ""

  - id: VULN-003
    title: Unpatched web servers
    severity: High
    owner: infra-team@company.com
    status: Remediated
    assigned_date: 2026-09-15
    due_date: 2026-09-22
    remediation_effort: 4 hours
    verification_method: "Vulnerability scan shows 0 critical CVEs on patched servers"
    notes: "Patches applied during maintenance window 2026-09-20"
    verified_by: security-team@company.com
    verified_date: 2026-09-21

Verification: the critical step

Remediation without verification is just a claim. Every finding must be independently verified:

# Verification checklist
def verify_finding(finding):
    checks = {
        'reproduction': attempt_reproduce(finding),
        'fix_effective': not attempt_reproduce(finding),  # Should fail now
        'no_regression': run_regression_tests(finding),
        'evidence_documented': has_verification_evidence(finding),
    }
    
    if all(checks.values()):
        return "VERIFIED"
    else:
        return f"FAILED: {[k for k, v in checks.items() if not v]}"

# Example: verify API authentication fix
result = verify_finding(VULN-001)
# 1. Reproduction: GET /v2/users/1 → expect 401 (was 200)
# 2. Fix effective: Enumeration script returns 401 for all IDs
# 3. No regression: Authenticated requests still return 200
# 4. Evidence: Screenshot of 401 response attached

Metrics that matter

Track remediation progress with metrics:

metrics:
  total_findings: 23
  by_severity:
    critical: 4
    high: 7
    medium: 8
    low: 4
  by_status:
    identified: 2
    assigned: 5
    in_progress: 8
    remediated: 3
    verified: 3
    closed: 2
  mean_time_to_remediate: 14.5 days
  mean_time_to_verify: 2.1 days
  overdue_findings: 3
  sla_compliance: 87%

Key performance indicators:

• Mean time to remediate (MTTR): How quickly findings are fixed
• SLA compliance: Percentage of findings remediated within the target timeframe
• Overdue findings: Findings past their due date — these need escalation
• Reopen rate: Findings that were verified but later regressed — indicates fix quality issues

The continuous improvement loop

The capstone assessment is not a one-time event — it's part of a continuous improvement cycle:

Assess → Report → Remediate → Verify → Monitor → Assess

Each assessment should show improvement over the last:

• Fewer critical/high findings
• Faster remediation times
• Higher verification pass rates
• Better overall posture score

The trend is more important than any single assessment. A company that shows consistent improvement — even if the absolute numbers aren't perfect — demonstrates a mature security program.