Question

A junior technician in an organization's IT department runs a penetration test on a corporate web application. During testing, the technician discovers that the application can disclose a SQL table with all user account and password information. How should the technician notify management?

A. Document the findings with an executive summary, recommendations, and screenshots of the web application disclosure.
B. Connect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management.
C. Notify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company.
D. Request that management create an RFP to begin a formal engagement with a professional penetration testing company.

Answer 1

The junior technician should document the findings and notify management through a detailed report with screenshots of the web application disclosure. Connecting to the SQL server and changing passwords is not recommended.

Step-by-step explanation:

The junior technician should notify management by documenting the findings with an executive summary, recommendations, and screenshots of the web application disclosure. This provides clear evidence of the vulnerability and communicates the seriousness of the issue. It is important to inform management through a professional and detailed report to ensure they understand the potential risks and can take appropriate actions.

Connecting to the SQL server and changing passwords is not recommended as it can be seen as unauthorized and unethical access. Instead, the focus should be on reporting the issue to management so they can address it properly. Notifying the development team of the discovery and suggesting input validation is a good step, but the technician should ultimately inform management to ensure the vulnerability is addressed on a broader scale. Requesting management to create an RFP to engage with a professional penetration testing company can be an additional step to enhance security measures and protect the organization's data.