Using a Web browser, search for any information security policies used at your academic institution. Compare them to the ones discussed in this chapter. Are there sections missing? If so, which ones?E

Using a Web browser, search for any information security policies used at your academic institution. Compare them to the ones discussed in this chapter. Are there sections missing? If so, which ones?

Exercise 1-2

Using a Web browser, go to w­w­w­.­g­o­c­s­i­.­c­o­m­ and download the latest CSI Computer Crime and Security Survey. What threats are currently the most dangerous? Which threats represent problems for your home computer? For your lab computer?

Exercise 1-3

Using a Web browser, go to h­t­t­p­:­/­/­c­v­e­.­m­i­t­r­e­.­o­r­g­. What type of site is this,and what information can it provide? Change the URL to h­t­t­p­:­/­/­c­v­e­.­m­i­t­r­e­.­o­r­g­/­c­v­e­, click Search, and enter IP Validation Vulnerability in the search field. Click Search again. What information are you provided with? How would this be useful? Go to the URL noted in the CVE description for the Microsoft reference. What additional information are you provided? How would this be useful?

Exercise 1-4

Using a Web browser, go to w­w­w­.­s­e­c­u­r­i­t­y­f­o­c­u­s­.­c­o­m­. What information is provided under the BugTraq tab? Under the Vulnerabilities tab? On the Vulnerabilities tab, select Microsoft as the Vendor and Windows Messenger as the title. Look for a PNG Buffer Overflow vulnerability. What information is provided under the Exploit tab? What does it mean? How could an attacker use this information? How could a security manager?

Exercise 1-5

Using a Web browser, go to h­t­t­p­:­/­/­c­s­r­c­.­n­i­s­t­.­g­o­v­. Click the Special Publications (800 Series) link. Find SP 800-100. Review the HTML version. What critical information could a security administrator or manager gain from this document? What other documents would be of value to the security manager or technician?