Efforts were placed on the identification  and exploitation of security weaknesses that c ould allow a remote attacker to gain unauthorized access to organizational data. The attacks were conducted with the level of access that a general Internet user would have.  The assessment was conducted in accordance with the recommendations outlined in NIST SP 800-115 with all tests and actions being conducted under controlled conditions.