Attached is the assignment instructions, also copy and pasted:On your local computer, open a new Internet browser window.In the address box of your Internet browser, type the URL http://cve.mitre.org and press Enter to open the Web site.On the Web site’s left side, click the Search CVE link. In the box on the right titled CVE List Master Copy, click View CVE List. In the Search Master Copy of CVE box at the bottom of the page, type User Domain into the By Keyword(s) area and click Submit. Search the resulting list of articles for entries related to the User Domain. In your Lab Report file, identify the risks, threats, and vulnerabilities commonly found in the User Domain. (Name at least three risks/threats.)In the address box of your Internet browser, type the URL http://www.sans.org/reading_room/whitepapers/threa... and press Enter to open the Web site. Scroll through the list of articles to find articles on threats and vulnerabilities in the User Domain. Choose two articles that discuss two of the risks or threats you listed in step 10. In your Lab Report file, discuss how these articles explain how to mitigate risks or threats in the User Domain. In the address box of your Internet browser, type the following URLs and press Enter to open the Web sites: In your Lab Report file, list the main components of each of the acceptable use policies (AUPs) documented at each of these sites.In your Lab Report file, explain how a risk can be mitigated in the User Domain with an acceptable use policy (AUP). Base your answer on what you discovered in the previous step.Consider the following fictional organization, which needs an acceptable use policy (AUP): Health care: http://it.jhu.edu/policies/itpolicies.htmlHigher education: http://www.brown.edu/information-technology/comput...U.S. federal government: https://www.jointservicessupport.org/AUP.aspxThe organization wants to implement this policy for all the IT assets it owns and to incorporate this policy review into its annual security awareness training.The organization is a regional XYZ Credit Union/Bank that has multiple branches and locations throughout the region.Online banking and use of the Internet are the bank’s strengths, given its limited human resources.The customer service department is the organization’s most critical business function.The organization wants to be in compliance with the Gramm-Leach-Bliley Act (GLBA) and IT security best practices regarding its employees.The organization wants to monitor and control use of the Internet by implementing content filtering.The organization wants to eliminate personal use of organization-owned IT assets and systems.The organization wants to monitor and control use of the e-mail system by implementing e-mail security controls.Using the following AUP template, in your Lab Report file, create an acceptable use policy for the XYZ Credit Union/Bank organization (this should not be longer than three pages):XYZ Credit Union/BankPolicy NamePolicy Statement{Insert policy verbiage here.}Purpose/Objectives{Insert the policy’s purpose as well as its objectives; include a bulleted list of the policy definition.} Scope{Define this policy’s scope and whom it covers.Which of the seven domains of a typical IT infrastructure are impacted?What elements, IT assets, or organization-owned assets are within this policy’s scope?}Standards{Does this policy point to any hardware, software, or configuration standards? If so, list them here and explain the relationship of this policy to these standards.}Procedures{In this section, explain how you intend to implement this policy throughout this organization.}Guidelines{In this section, explain any roadblocks or implementation issues that you must overcome and how you will overcome them per the defined policy guidelines.}

1. Why is it important to prioritize your IT infrastructure risks, threats, and vulnerabilities? 2. Based on your executive summary produced in the Performing a Qualitative Risk Assessment for an IT Infrastructure lab in this lab manual, what is the primary focus of your message to executive management? 3. Given the scenario for your IT risk-mitigation plan, what influence did your scenario have on prioritizing your identified risks, threats, and vulnerabilities? 4. What risk-mitigation solutions do you recommend for handling the following risk element: User inserts CDs and USB hard drives with personal photos, music, and videos on organization-owned computers? 5. What is a security baseline definition? 6. What questions do you have for executive management to finalize your IT risk-mitigation plan? 7. What is the most important risk-mitigation requirement you uncovered and want to communicate to executive management? In your opinion, why is this the most important risk-mitigation requirement? 8. Based on your IT risk-mitigation plan, what is the difference between short-term and long-term risk-mitigation tasks and ongoing duties? 9. For which of the seven domains of a typical IT infrastructure is it easy to implement riskmitigation solutions but difficult to monitor and track effectiveness? 10. Which of the seven domains of a typical IT infrastructure usually contains privacy data in systems, servers, and databases? 11. Which of the seven domains of a typical IT infrastructure can access privacy data and also store it on local hard drives and disks? 12. Why is the Remote Access Domain the most risk-prone of all in a typical IT infrastructure? 13. When considering the implementation of software updates, software patches, and software fixes, why must you test the upgrade or software patch before you implement it as a risk-mitigation tactic? 14. Are risk-mitigation policies, standards, procedures, and guidelines needed as part of your longterm risk-mitigation plan? Why or why not? 15. If an organization under a compliance law is not in compliance, how critical is it for your organization to mitigate this noncompliance risk element?