• http://csrc.nist.gov/publications/nistpubs/800-26/sp800-26.pdf
• http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf
• http://csrc.nist.gov/ispab/2004-06/ross_2004_06_ispab.pdf
• http://www.asisonline.org/guidelines/guidelines.htm
• http://www.gao.gov/special.pubs/ai99139.pdf
• http://www.cert.org/octave/methodintro.html
• http://isecom.securenetltd.com/osstmm.en.2.1.pdf

• http://isc.sans.org/index.php (for up-to-the-minute coverage of new attacks)
• http://www.sans.org/newsletters/risk/ (for the weekly consensus of the most critical new vulnerabilities)
• http://icat.nist.gov/icat.cfm (the best source for finding the vulnerabilities in any software)
• http://cve.mitre.org
• http://xforce.iss.net
• https://cirdb.cerias.purdue.edu/coopvdb/public/
• http://www.securityfocus.com/bid/
• http://www.osvdb.org/

• http://www.securityfocus.com/infocus/1504
• http://www.microsoft.com/athome/security/default.mspx
• http://www.cert.org/tech_tips/home_networks.html
• http://www.g4techtv.com/screensavers/features/46958/Top_10_Ways_to_Fight_Malicious_Code.html

1. Web servers & services
2. Workstation service
3. Windows remote access services
4. Microsoft SQL Server
5. Windows authentication
6. Web browsers
7. File-sharing applications
8. Window's Local Security Authority Subsystem Service risks
9. Mail client
10. Instant messaging

• http://www.sans.org/resources/policies
• http://www.email-policy.com/
• http://www.security.kirion.net/securitypolicy/
• http://www.iso-17799.com/index.htm
• http://www.network-and-it-security-policies.com/
• http://www.information-security-policies-and-standards.com/

• http://www.sans.org/whatworks
• http://ibg.networkcomputing.com/
• http://www.scmagazine.com/
• http://www.nss.co.uk/labs.htm

1. Run one of the high-profile vulnerability scanning tools (commercial or open source) against a small number of systems on your network.
2. Install a Windows system with default settings and document how long it takes to get infected with a virus or other malware.
3. Run a Google search for confidential documents from your organization that may be available on the Internet.
4. Run a sniffer on the internal network for a short period of time, and tally the number of username / password pairs you were able to capture.
5. Audit a small number of your high profile systems, and calculate te number of active accounts for employees / users who are no longer wit your organization.

Information Building Blocks