CSC358H5: Principles of Computer Networks

You will be likely doing many Google searches for this assignment. 

If you Google "spear phising" you will get pages of results.  Here are two that appear authoritative and are likely informative:

• Spear Phishing: Scam, Not Sport from Norton
• Spear Phishing Email: Most Favored ATP Attack Bait by Trend MICRO Inc.
  

How do you know whether an article you found online is authoritative?

Check the following to get a sense of where the article comes from, and what may have been the authors' motivation:

• The origin of the source and its web "neighborhood" (more help with this issue from the Ohio State University guide - be sure to scroll below the first activity to read about the web neighbourhood).

• Information about the author, publisher or company (more from the Ohio State tutorial). Because you will be dealing with industry reports and articles, assume that there will be attempts to sell product suites or security solutions, so focus on the size and reputation of the companies based on the copyright statements on article pages or About Us pages.
  

• The degree of bias (remember you will be dealing with industry sources). Is the information contributing to your understandig of spear phishing and security threats, or is it focused on selling you a solution?

• Recognition of the source or author from others, and the degree of corroboration of information between different authors and sources. Look especially for other sources cited or used by your report. If no external sources are cited at all, ask yourself: "Could the author(s) really write this without consulting other sources?" What does it tell you about the auhtority of your source if you suspect the process and sources of data?

• Thoroughness, comprehensiveness and clarity of the content.

• Currency of the content. Look carefully at the first and last page of web articles and reports. The Trend MICRO article, for example, includes information about the company and report date (2012) on the last page.

Since you are writing this assignment as if you were a Security Officer (SO), using insustry-focused publications is a good idea.

A good way to get a cross-section of industry sources is by doing a Google search of this phrase: "Internet security threat report."

An awareness of the companies involved in security work is also a bonus. Try these links to get a sample of industry sources:

• Symantec ISTR (Internet Security Threat Report)
• McAfee Threat Report 2013
  

Always try to differentiate salesmanship from trustworthy information.  Please see the box to the left of this one for what to look for when evaluating web sources.