Investigation should include research to identify threats to computer systems (e.g., spam, malicious software, theft) and methods for guarding against such threats, such as