A water plant asks whether cracked passwords should appear in cleartext in the main report. What handling is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Handing out cracked passwords in a PDF is like taping spare keys to the front gate. Prove you got them—mask them, use a locked appendix if RoE allows—but don’t spray secrets around. The report should reduce risk, not multiply it.
Full Explanation
For a water plant engagement, cracked passwords should not appear in cleartext in the main report. Appropriate handling protects recovered secrets—prove knowledge with redaction or a controlled appendix per RoE instead of spreading cleartext passwords. Printing every cracked password in the executive summary maximizes urgency theater while maximizing insider and distribution risk for plant staff. Emailing the full cleartext list to all plant staff so they can “change casually” broadcasts secrets and encourages insecure transmission. Destroying all evidence of recovered passwords so the finding cannot be verified removes the audit trail the utility needs to trust the result. Exam caveat: evidence sufficiency and secret hygiene are both required; CPTS-style professionalism favors controlled proof over dump-everything reporting. Operational check: store recoveries in an encrypted vault, show partial redaction or hash-of-secret proof in the main finding, limit appendix access to named recipients, and confirm rotation completed before wider distribution of any residual material. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.