Read on Twitter
We always say that the most important part of delivering security services is reporting. I agree. If you can& #39;t get your message across, the value of your service drops immensely. A thread.
(1) In essence, you& #39;re telling a story. Your report has a beginning, a middle, and an end. Let& #39;s call it the exec summary, the findings, and the conclusions. Pro-tip 1 : don& #39;t lose that structure. Stick to it like glue. Anything that doesn& #39;t fit in "the story" -> appendix.
(2) Exec Summary : target audience = non technical. They likely won& #39;t read the rest of the report. Be succinct, be direct, be authorative. (Give kudos where kudos are due). Use graphs, but ask yourself if your audience can "get them" at a glance.
(2 cntd.) If they can& #39;t ... change the graphs. Ground rule : no pie charts. Like for real, keep the pie for dessert.
(3) The Findings. Audience is likely technical. These people will have to work with what you put here. They don& #39;t deserve bullshit. Respect them. Provide as much detail as possible. Be accurate, be detailed. A baller exec summary with a mediocre set of findings is meh.
(4) Conclusions :) aka, the end. Everything you say here needs to be supported by your findings. Don& #39;t make assumptions. If you don& #39;t know, ask. Or drop it. Use references. Make your stuff easy to navigate.
(5) Note that all three parts tie together. Yes, you can have varying levels of detail across the 3 main components but your story must be consistent. If it isn& #39;t, you will be challenged. Got a box of $100 words? Shove it under the desk. You& #39;re aiming at grade 8 reading level.
(6) This is not a drawing book. Be conscious about using color. Be consistent in colors across charts. NO default color schemes. Remember that the colors you use have to mean something. If they don& #39;t, use gray scale.
(7) By the way : Some of your readers might be color-blind. They& #39;ll hate you forever if you ignore them. Kidding, they& #39;re used to being ignored but that doesn& #39;t mean you should not try to be better.
(8) Fonts : Again, consistency. One standard font. Use bold, italic, etc. for emphasis. Use a mono-spaced font for code. etc. etc. You don& #39;t pick fonts because they& #39;re attractive, pick them to support the story you want to tell. Your game is visual.
(9) Language : avoid repetition! (... the service. The service ...) Don& #39;t! It& #39;s a capital sin. Again, short sentences. Learn synonyms ... A LOT of them! I& #39;ve made it a game to keep my texts interesting that way. It& #39;s actually fun.
(10) ground truth : "The hardest part about writing is deleting". When you feel you& #39;re finished, go back and cull anything that is superfluous. If you can delete, you can write. Make it tight. FIN.
(11) Avoid suggestive language! "we would recommend". Wtf? You& #39;re being paid a lot of money for this work. We don& #39;t wanna know what you "would" do, we want to know what you "will" do.
(12) Best exercise : go back to reports from 2-3 years ago and rewrite them based on your current experience. Past you is your best teacher.
