A water plant asks whether cracked passwords should appear in cleartext in the main report. What handling is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Handing out cracked passwords in a PDF is like taping spare keys to the front gate. Prove you got them—mask them, use a locked appendix if RoE allows—but don’t spray secrets around. The report should reduce risk, not multiply it.
Full Explanation
Recovered credentials are sensitive artifacts. Deliverables should demonstrate possession and impact while minimizing further exposure through redaction, partial reveals, or controlled appendices aligned with client RoE and data-handling rules. Publishing full cleartext lists in broadly distributed reports increases insider and external risk. Secure handling is part of professional password-attack practice after technical success.