Investigation should include research to identify threats to computer systems (e.g., spam, malicious software, theft) and the methods for guarding against such threats, including