It's solution time and I wanted to show you the executive summary that I've
come up with based on the information that we had in the challenge.
Remember, we had the bullet points above and some of the key information in the
actual challenge video itself.
So let's take a look at how I attack this one.
Here we are in my executive summary PDF version of this below so that way you
could use it as a template.
I don't mind.
And there are many other templates out there that you could take a look at.
But the key factor here is that we have all five areas discussed and we start
out with our overview, which is between one May in 14 May 2025.
We did a pen test on CBT nuggets and we basically just gave a five W's of what
happened there.
We move on into the key findings and that was exactly what I put inside of the
challenge bullet points.
And again, you don't have to word them the exact same way I do and I don't want
them the exact same way anybody else does just whatever fits based on the
organization and whatever templates that you require to use or maybe achieve
your preference.
Who knows.
But these are the four areas that we found and after that we put together a
risk assessment and this one I rated it as high.
And the reason for this is mostly due to the vulnerability inside of the web
facing web server along with the amount of user credentials that were either
simple or default passwords.
Now, I do want to take a side here real quick and point something out and that
on the DoD you know who you are.
There are many systems of record that are implemented that have default
passwords assigned to them and whenever I conduct pen testing for DoD or when I
actively did it full time for the army.
This was always a major problem. So if you're with the DoD and you are using
let's say CPC or any kind of command and control software change the default
password because I'm tired of popping them.
So yeah, take that, but our risk assessment is overall high due to those
default passwords and that vulnerability on the web server, which leads us into
the recommendations on how we would actually go about changing this up.
Now these are quick and to the point how I would actually go through
immediately patch.
Go in and take care of that insecure code that's inside of that web server, put
in a group of policy or just find a way to enforce those strong passwords
within the organization.
And then we wrap everything up with our conclusion and my conclusion is that
several areas required our new intention to strengthen the organizations
security posture are needed and I want to come back in 90 days.
And my signature block along with on the bottom left and what's in there
included network scan report vulnerability assessment user and password report.
That way, if after the executive summary is presented to the C suite upstairs
that way the folks in the tech office and I can pull to a side and go into some
of the nitty gritty nerd talk that goes along with this.
Now this isn't trying to insult anybody inside the C suite, but most of times
when we put together an executive summary or do any kind of tech work for an
organization that has a C suite involved.
More often than not that C suites not going to be to in the weeds are hip to
what it is that we as techies do within the organization.
Anyways, you ever form. So it's always good to make sure that the executive
summary is written to where anybody can pick it up within any organization and
understand the base principles of what it is that needs to be done or addressed
inside of that organization after we're done with our pen test.
So now that we have all of our note taken out of the way and have an
understanding of what it is that the baseline is for the rest of this course.
And we know how to properly record it up to those executives upstairs. Let's
start getting into some of the breaking of testing of things as we continue out
through pin 200. I hope this has been a formative for you and I'd like to thank
you for viewing.
[BLANK_AUDIO]