An administrator wants to perform a risk assessment without using proprietary company information. Which of the following methods should the administrator use to gather information?

Open-source intelligence (OSINT) involves collecting information from publicly available sources. This method allows an administrator to gather data relevant to potential threats and vulnerabilities without accessing or exposing proprietary company information, as the data is already public. Network scanning and penetration testing directly interact with the company's internal systems and would involve proprietary information. Configuration auditing also involves examining internal system configurations, which are proprietary.