This document summarizes two case analyses of hacking incidents at ABC company and provides recommendations. Case 1 involved a phishing attack that obtained admin passwords. Case 2 detailed how hackers used Airmon-ng to access the internal network, nmap to scan servers, and Metasploit to steal passwords and access the SQL database. Recommendations included updating security awareness training, implementing SPF, monitoring networks for malicious activity, disabling LM hashes, enabling account lockouts, and testing disaster recovery plans.

1. ISACA Scholarship Competition
E-Squared
Junho Lee
Jongmin Lee
Wookyung Youn
Sol Han

2. Agenda
• Case Analysis 1 – Phishing Attack
• Case Analysis 2 – Metasploit Attack
• Recommendation

3. Case Analysis 1
• The hackers obtained ABC company’s Windows server’s Admin
Password by Phishing Attack (Possibility 1)

4. Problem & Suggestion
• Problem
-Based on the security assessment report:
• Security awareness training for employees is outdated
• Suggestion
-Updating Information Awareness Training (User education)
+ Additional Suggestion - SPF (Sender Policy Framework)

5. • Hackers gain an access to ABC company’s internal network using Airmon-ng
• Hackers scanned ABC company’s Windows server’s IP Address by nmap
• Hackers exploit Hash table in order to snatch Admin Password by Metasploit
• Hackers accessed ABC company’s admin user account through remote desktop
• Hackers exploit Hash table again in order to snatch SQL server’s password
• Hacked ABC company’s database to compromise information
Case Analysis 2

6. Proof
Hackers access internal network by using Airmon-ng

7. Proof
Hackers scan Window Server’s IP Address by using nmap

8. Proof
Hackers snatched Windows Server admin password by using Metasploit

9. Proof
Hackers access Admin user account through remote desktop

10. Problem & Suggestion
• Problem
• The security assessment report indicates that the company does not keep
eyes on the network for malicious activities
• Suggestion
•Human Resource
The system administrators should be informed of the specific tasks which they
should carry out.
• Vulnerability Testing
• Back up Procedures
• Configuration Documentation
• Monitoring the systems

11. Problem & Suggestion
Additional Suggestion
• Prevent Password Cracking
• Disable LM password hashes
- Make the password at least 15 characters long
• Enable Account Lockouts
- Set the account lockout threshold
- Set the account lockout counter after
- Set the account lockout duration
• Disable LAN Manager / NTLM authentication

12. Disaster Recovery Plan
• Based on the security assessment report:
• Disaster recovery plan has been provided but not tested yet
• Solutions
•Prepare contingency organization chart, showing the name of the
contingency manager and coordinator
• Develop customized up-to-date recovery plan and test it
• Provide security copies of vital records and store these off-site
• Nurture the ability to restore critical information within acceptable time period