CIW Community - Get caught in the Web!

For some time, instructors and CIW community members have asked for CIW to provide "war stories" concerning all things Web. This page presents case studies culled from our partners around the world. These case studies are designed to help instructors give students examples of how the concepts taught in CIW courseware are used in the field.

Case Study 1: The right tool for the right job?

Gayle Alvstead and Brad Jensen are both Web designers who do freelance work. They were both asked to create Web pages for two respective companies. Gayle used Adobe Dreamweaver. Brad uses the Firefox browser supplemented with several add-ons that turned the browser into a Web development environment.

While both individuals were able to create high-quality Web pages and get paid for it, Brad was able to do it using free (as in beer) open source software. Gayle had to shell out over $600.00 for the software she used. While she could have used a version of Adobe licensed for academic purposes, she understood that the End User License Agreement (EULA) for the academic version expressly forbids the use of academic software for commercial use. While Gayle can easily earn more clients and money to reduce the impact of her software purchase and gain more ROI, Brad isn't burdened with this concern. Both Gayle and Brad were able to finish their projects on time, so using open source software didn't slow Brad down.

The above case study brings up some important considerations:
* While open source software may be less expensive or even free of charge, it may also be less easy to use and may not contain time-saving features. Some technical features may also be missing (e.g., Flash). Open source software may also require more technical proficiency than commercial tools. As a result, you may not be able to work as quickly or efficiently. You may also not be able to add features that clients ask for.
* Proprietary, fee-based software increasingly carries the burden of the "vendor treadmill." How often will Adobe update its software, and why? If you adopt software from Adobe, Microsoft or others, when will you be able to stop upgrading? And if you miss one upgrade, many times you get punished a year or so down the road by having to purchase a brand new product. Such considerations can not only affect your bottom line, they can also distract you from obtaining key technical skills. As a result, you may not grow as a designer and developer.

Special thanks to Brian Sarka of the Alaska Vocational Technical Center for valuable input concerning this case study

Case Study 2: What does an audit report look like?
The CIW Security Analyst certification has become popular because it focuses on practical auditing steps. Recently, members of the CIW community in China have asked for a "live" audit report. We were able to obtain one in PDF form. This file is given in a list at the bottom of the page, as well.

The audit report provided here was the result of 6.5 hours of work. The security analyst used various types of proprietary and open source software to conduct the audit. The Nessus auditor was used, as it is not only a relatively inexpensive tool, it is also considered to be one of the most accurate. The auditor was able to charge $125.00 an hour for this report.

The scanning activity was conducted over a period of time. Scans occurred during the day, as well as at night. Attempts at social engineering were also made, though they are not found in this report.

The element of a high-quality, written audit report include:

• An executive summary: A simple but precise overview of the main issues discovered in the audience. This summary is meant to be read by management and executives who are not necessarily technically minded, but who have to receive essential information quickly. Managers and executives will use this information to make important decisions.
• Information presented in both narrative and pictorial form: Sometimes it's necessary to tell a thousand words. Sometimes, a picture will do. Many times, you need both.
• A report of vulnerabilities discovered: Give a report that explains the vulnerability as well as an estimate of its severity.
• A list of next steps: No one - especially your clients - want to just see a list of problems without a solution. Remember, these people are paying you; don't let them down. Notice that the report given recommends solutions. In this particular case, the company was willing to pay additional money for the auditor to solve some of these problems. Other problems were solved by the company's internal employees.