In this lesson,
we will discuss the attestation of findings.
Attestation is a process that involves the formal validation
or confirmation provided by an entity
that is used to assert the accuracy
and authenticity of specific information.
This process is crucial in various contexts,
particularly in conducting both internal and external audits
where it serves as a foundation for asserting
the reliability and integrity of data,
systems, and processes.
Now, attestation of findings is essentially a way to prove
that the penetration test actually occurred
and it signifies that the findings are actually valid
based on the evidence you presented.
These attestations of the findings is something required,
depending on an organization's reason
for conducting a penetration test.
If you conducted a penetration test simply
because the organization wanted it,
then you might not be required to provide
an attestation of your findings.
But if they're doing it for compliance
or regulatory reasons like making sure they're compliant
with the GLBA, HIPAA, Sarbanes and Oxley, or PCI DSS,
then the organization may require a letter of attestation
from your penetration testing firm to show
that this is an official record
that the penetration test was completed.
If you're asked to provide a letter of attestation
or attestation of your findings,
then you want to make sure that you include
a summary of the findings as well as proof
that you have conducted the security assessment
during a given period of time for the organization.
This way, the organization can take the letter
and show it as proof to a third party
to show that they have conducted a security assessment
by using the firm for the penetration test.
Now, often, we get asked,
what's the difference between the attestation of findings
and the report that a penetration tester may deliver
to the organization at the end of engagement?
Well, the big difference
is the attestation of findings also includes evidence.
So, for example, if you provided a finding
that said they were not using multi-factor authentication
and you're able to bypass their system
by using standard username and password,
now you're going to provide them evidence to show
that exploit actually happened
and they're not just taking your word for it.
This might be a thing where you're going to sit down
with them and go over all the details from the report
and pull out your evidence to show them what you did
and how you did it.
This might include bringing out detailed reports,
data, logs, explanations, or even some of your exploit code
to show them the risk that they have
and how you are able to go about exploiting them.
When it comes to attestation though,
sometimes you will not leave the evidence
with the organization.
For example, if you show them some of your custom code
that you use to be able to exploit that network,
you do not have to leave a copy of that with them,
but you will show it to them
during your attestation meeting.
This is in contrast to the report
that you actually delivered
that will show them the findings
and a remediation that you recommend,
but not necessarily
the way you exploited that vulnerability.
This is a key difference
when you're talking about attestation.
Now, normally, you're going to hear people talk about
a letter of attestation when it comes to the attestation
of your findings.
This may be more about the fact that you can prove
that the penetration test actually happened
and prove that to a third party who may be interested
in the security of the network of the organization
that you are hired to target in your penetration test.
But that is really going to depend on a target organization
that you're doing a penetration test for
and why they hire you to conduct a penetration test
in the first place.
Now, you may also hear about attestation
in terms of software attestation, hardware attestation,
and system attestation as well.
But these are more for integrity checking
of your organization
than what is usually conducted during a penetration test.
Software attestation involves validating the integrity
of software by checking that it hasn't been tampered with
or altered maliciously.
For instance, by installing a software update,
a system might use cryptographic techniques
to verify the update's digital signature.
If the signature is valid,
it attests that the update is authentic
and hasn't been tampered with since it was signed
by the software vendor.
Hardware attestation involves validating the integrity
of hardware components.
For example, a Trusted Platform Module, or TPM,
can be used to attest
that a computer hasn't been tampered with.
The trusted platform module can store measurements
of the computer's hardware and firmware configurations,
and these measurements can be checked at boot time
to ensure that they haven't changed unexpectedly.
System attestation involves validating
the security posture of a system.
For instance, a cloud service provider
might provide attestation
that its services meet certain security standards,
such as being ISO 27001 or SOC 2 compliant.
This attestation gives customers confidence
that their data is being handled securely.
An internal audit's attestation plays a significant role
in evaluating organizational compliance
and the effectiveness of the internal controls.
For instance, the internal auditor may provide attestation
on the accuracy of financial records,
the effectiveness of risk management strategies,
or adherence to internal policies and procedures.
This process helps to ensure that the organization
is operating effectively and efficiently,
and that is compliant with all the relevant laws,
regulations, and standards.
External audits, on the other hand,
are conducted by an independent third party entity.
These external audits often involve the attestation
of financial statements, regulatory adherence,
and operational efficiency
by the trusted third party assessor.
For example, if an external auditor
may provide attestation
on a company's annual financial statements
to confirm that they present a true and fair view
of the company's financial position,
this attestation is crucial for stakeholders,
such as investors, creditors,
and regulators who rely on these statements
to make informed decisions.
Regardless of the type of audit being conducted,
attestation remains a big component in strengthening trust,
enhancing transparency, and ensuring accountability
within an organization.
By providing a formal validation
of accuracy and authenticity of information,
attestation helps to build confidence among stakeholders,
promote transparency in business operations,
and ensure that the organization is held accountable
for its actions.
So remember, attestation is a formal validation process
that asserts the accuracy
and authenticity of specific information
and it plays a crucial role
in both internal and external audits,
serving as a foundation for asserting the reliability
and integrity of data, systems, and processes.
Regardless of the audit type,
attestation is key in strengthening trust,
enhancing transparency,
and ensuring accountability within the organization.
It builds confidence among stakeholders,
promotes transparency in operations,
and ensures organizational accountability.