MBA _IT

: The value of assets gradually reduces on account of use. Such reduction in value is known asdepreciation. Different authors have given different definitions of depreciation, such as:"Depreciation may be defined as the permanent continuous diminution in the quality, quantity or value on an asset."  (By Pickles)"Depreciation is the gradual permanent decrease in the value of an asset from any cause."  (By Carter)"Depreciation may be defined as a measure of the exhaustion of the effective life of an asset from any cause during a given period." (By Spicer & Pegler)Depreciation is the diminution in intrinsic value of an asset due to use and/or the lapse of time."  (By Institute of Cost and Management Accountants, England)

"Depreciation is the reduction in the value of a fixed asset occasioned by physical wear and tear, obsolescence or the passage of time."  (Northcott & Forsyth)"Depreciation is the diminution in the value of assets owing to wear and tear, effluscion of time, obsolescence or similar causes."  (Cropper)From the above definitions, it follows that an asset gradually declines on account of use and passage of time and this causes permanent reduction in the value and utility of asset. Such reduction in the value or utility of asset is called depreciation. In other words, expired cost or utility of asset is depreciation.

The main causes of depreciation may be divided into two categories, namely:

1.        Internal Cause and

2.        External Causes

Internal Causes:

Depreciation which occurs for certain inherent normal causes, is known as internal depreciation. The main causes of internal depreciation are:

Wear and Tear:

Some assets physically deteriorate due to wear and tear in use. More and more use of an asset, the greater would be the wear and tear. Physical deterioration of an asset is caused from movement, strain, friction, erasion etc. An obvious example of this is motor car which rapidly wears out. Other assets like this are building, plant, machinery, furniture, etc. The wear and tear is general but primary cause of depreciation.

Depletion:

Some assets declines in value proportionate to the quantum of production, e.g. mine, quarry etc. With the raising of coal from coal mine the total deposit reduces gradually and after sometime it will be fully exhausted. Then its value will be reduced to nil.

External Causes:

Depreciation caused by some external reasons is called external depreciation. The main external causes are as follows:

Obsolescence:

Some assets, although in proper working order, may become obsolete. For example, old machine becomes obsolete with the invention of more economical and sophisticated machine whose productive capacity is generally larger and cost of production is therefore less. In order to survive in the competitive market the manufacturers must must install new machines replacing the old ones. Again, it may happen that the articles produced by old machine are no longer saleable in the market on account of change of habit and taste of the people. In such a case the old machine, although in good working condition, must be discarded and the new one purchased.

Efflux of Time:

Some assets diminish in value on account of sheer passage of time, even though they are not used e.g., leasehold property, patent right, copyright etc. Suppose we take a lease of a house for 10 years for $10,000. Its annual depreciation will be $1,000 (10,000/10), irrespective of the the whether the house has been used or not. Because with the end of lease after 10 years, the house will go out of possession.

Accident:

Assets may be destroyed by abnormal reasons such as fire, earthquake, flood etc. In such a case the destroyed asset must be written off as loss and a new one purchased.

Ans2: Front office quantitative analyst

In trading and sales operations, quantitative analysts work to determine prices, manage risk, and identify profitable opportunities. strategic level. Although highly skilled programmers, FOQs are often bound by time constraints, and hacking complex tasks together

Quantitative investment management

Quantitative analysis is used extensively by asset managers. Some, such as AQR or Barclays, rely almost exclusively on quantitative strategies while others, such as Pimco, Blackrock or Citadel use a mix of quantitative and fundamental methods. Virtually all large asset managers and hedge funds rely to some degree on quantitative methods.Library quantitative analysis Major firms invest large sums in an attempt to produce standard methods of evaluating prices and risk. These differ from front office tools in that Excel is very rare, with most development being in C++, though Java and C# are sometimes used in non-performance critical tasks. LQs spend more time modelling ensuring the analytics are both efficient and correct, though there is tension between LQs and FOQs on the validity of their results. LQs are required to understand techniques such as Monte Carlo methods and finite difference methods, as well as the nature of the products being modelled.

Algorithmic trading quantitative analyst

Often the highest paid form of Quant, ATQs make use of methods taken from signal processing, game theory, gambling Kelly criterion, market micro structure, econometrics, and time series analysis.Algorithmic trading includes statistical arbitrage, but includes techniques largely based upon speed of response, to the extent that some ATQs modify hardware and Linux

Risk management

This has grown in importance in recent years, as the credit crisis exposed holes in the mechanisms used to ensure that positions were correctly hedged, though in no bank does the pay in risk approach that in front office. A core technique is value at risk, and this is backed up with various forms of stress testing and direct analysis of the positions and models used by

Innovation

In the aftermath of the financial crisis, there surfaced the recognition that quantitative valuation methods were generally too narrow in their approach. An agreed upon fix adopted by numerous financial institutions has been to improve collaboration through continuous improvement and thought leadership. This has led to the creation of collaborative environments in order to produce the most robust statistical models available. Through working with a large pool of some of the world's most talented quantitative analysts, economists and mathematicians from the financial industry and academia, transparency continues to be improved, leading to constant improvement.^{[weasel words]}

Model validation

MV takes the models and methods developed by front office, library, and modelling quants and determines their validity and correctness. The MV group might well be seen as a superset of the quant operations in a financial institution, since it must deal with new and advanced new models and trading techniques from across the firm. However, the pay structure in all firms is such that MV groups struggle to attract and retain adequate staff, often with talented quantitative analysts leaving at the first opportunity. This gravely impacts corporate ability to manage model risk, or to ensure that the positions being held are correctly valued. An MV quantitative analyst will typically earn a fraction of quantitative analysts in other groups with similar length of experience.

Quantitative developer

Quant developers are computer specialists that assist, implement and maintain the quant models. They tend to be highly specialised language technicians that bridge the gap between IT and quantitative analysts.

Techniques

A typical problem for a numerically oriented quantitative analyst would be to develop a model for pricing, hedging, and risk-managing a complex derivative product. Mathematically-oriented quantitative analysts tend to have more of a reliance on numerical analysis, and less of a reliance on statistics and econometrics. These quantitative analysts tend to be of the psychology that prefers a deterministically "correct" answer, as once there is agreement on input values and market variable dynamics, there is only one correct price for any given security (which can be demonstrated, albeit often inefficiently, through a large volume of Monte Carlo simulations).

A typical problem for a statistically oriented quantitative analyst would be to develop a model for deciding which stocks are relatively expensive and which stocks are relatively cheap. The model might include a company's book value to price ratio, its trailing earnings to price ratio, and other accounting factors. An investment manager might implement this analysis by buying the underpriced stocks, selling the overpriced stocks, or both. Statistically-oriented quantitative analysts tend to have more of a reliance on statistics and econometrics, and less of a reliance on sophisticated numerical techniques and object-oriented programming. These quantitative analysts tend to be of the psychology that enjoys trying to find the best approach to modeling data, and can accept that there is no "right answer" until time has passed and we can retrospectively see how the model performed. Both types of quantitative analysts demand a strong knowledge of sophisticated mathematics and computer programming proficiency.

One of the principal mathematical tools of quantitative finance is stochastic calculus.

Ans3 The Dividend Decision is a decision made by the directors of a company. It relates to the amount and timing of any cash payments made to the company's stockholders. The decision is an important one for the firm as it may influence its capital structure and stock price. In addition, the decision may determine the amount of taxation that stockholders pay.

There are three main factors that may influence a firm's dividend decision:

§                    Free-cash flow

§                    Dividend clienteles

§                    Information signalling

The free cash flow theory of dividends

Under this theory, the dividend decision is very simple. The firm simply pays out, as dividends, any cash that is surplus after it invests in all available positive net present value projects.

A key criticism of this theory is that it does not explain the observed dividend policies of real-world companies. Most companies pay relatively consistent dividends from one year to the next and managers tend to prefer to pay a steadily increasing dividend rather than paying a dividend that fluctuates dramatically from one year to the next. These criticisms have led to the development of other models that seek to explain the dividend decision.

Dividend clienteles

A particular pattern of dividend payments may suit one type of stock holder more than another; this is sometimes called the clientele effect. A retiree may prefer to invest in a firm that provides a consistently high dividend yield, whereas a person with a high income from employment may prefer to avoid dividends due to their high marginal tax rate on income. If clienteles exist for particular patterns of dividend payments, a firm may be able to maximise its stock price and minimise its cost of capital by catering to a particular clientele. This model may help to explain the relatively consistent dividend policies followed by most listed companies.

A key criticism of the idea of dividend clienteles is that investors do not need to rely upon the firm to provide the pattern of cash flows that they desire. An investor who would like to receive some cash from their investment always has the option of selling a portion of their holding. This argument is even more cogent in recent times, with the advent of very low-cost discount stockbrokers. It remains possible that there are taxation-based clienteles for certain types of dividend policies.

Information signalling

A model developed by Merton Miller and Kevin Rock in 1985 suggests that dividend announcements convey information to investors regarding the firm's future prospects. Many earlier studies had shown that stock prices tend to increase when an increase in dividends is announced and tend to decrease when a decrease or omission is announced. Miller and Rock pointed out that this is likely due to the information content of dividends.

When investors have incomplete information about the firm (perhaps due to opaque accounting practices) they will look for other information that may provide a clue as to the firm's future prospects. Managers have more information than investors about the firm, and such information may inform their dividend decisions. When managers lack confidence in the firm's ability to generate cash flows in the future they may keep dividends constant, or possibly even reduce the amount of dividends paid out. Conversely, managers that have access to information that indicates very good future prospects for the firm (e.g. a full order book) are more likely to increase dividends. According to Grullon (2002) the information value lies in the fact that a dividend increase signals a decrease in systematic risk (a decrease in discount rate), the correlation between dividend changes and earnings changes has not been proofed.

Investors can use this knowledge about managers' behaviour to inform their decision to buy or sell the firm's stock, bidding the price up in the case of a positive dividend surprise, or selling it down when dividends do not meet expectations. This, in turn, may influence the dividend decision as managers know that stock holders closely watch dividend announcements looking for good or bad news. As managers tend to avoid sending a negative signal to the market about the future prospects of their firm, this also tends to lead to a dividend policy of a steady, gradually increasing payment.

Conclusion

In a fully informed, efficient market with no taxes and no transaction costs, the free cash flow model of the dividend decision would prevail and firms would simply pay as a dividend any excess cash available. The observed behaviours of firm differs markedly from such a pattern. Most firms pay a dividend that is relatively constant over time. This pattern of behavior is likely explained by the existence of clienteles for certain dividend policies and the information effects of announcements of changes to dividends.

The dividend decision is usually taken by considering at least the three questions of: how much excess cash is available? What do our investors prefer? and What will be the effect on our stock price of announcing the amount of the dividend?

Ans4 There are many tasks every business needs to do if it is going to succeed. Each of these tasks is described as being a function of a business. The following is a brief introduction to each of these functions:

·                                 Human Resources - ensures the business has the best staff for the job and that they are able to work effectively in a safe environment;

·                                 Finance - will keep a record of all money coming in and going out of the business. They have responsibility for securing finances for future expansion and paying staff and suppliers;

·                                 Administration and ICT support - ensure the smooth running of the business on a day-to-day basis. They have responsibility for clerical duties, cleaning, computer and software support, security and health and safety;

·                                 Operations - have the task of producing the goods or service in the most efficient way. This is done by making best use of the business's staff, machinery, building and raw materials;

·                                 marketing and sales - will try and maximize the level of sales by carrying out market research and promoting the goods or service through a motivated sales team;

·                                 Customer Service - will help the customer before and after a sale has been made by providing information, giving advice, providing credit facilities, delivering goods and providing after-sales support;.

The proper role of government provides a starting point for the analysis of public finance. In theory, under certain circumstances, private markets will allocate goods and services among individuals efficiently (in the sense that no waste occurs and that individual tastes are matching with the economy's productive abilities). If private markets were able to provide efficient outcomes and if the distribution of income were socially acceptable, then there would be little or no scope for government. In many cases, however, conditions for private market efficiency are violated. For example, if many people can enjoy the same good at the same time (non-rival, non-excludable consumption), then private markets may supply too little of that good. National defense is one example of non-rival consumption, or of apublic good.

"Market failure" occurs when private markets do not allocate goods or services efficiently. The existence of market failure provides an efficiency-based rationale for collective or governmental provision of goods and services. Externalities, public goods, informational advantages, strong economies of scale, and network effects can cause market failures. Public provision via a government or a voluntary association, however, is subject to other inefficiencies, termed "government failure."

Under broad assumptions, government decisions about the efficient scope and level of activities can be efficiently separated from decisions about the design of taxation systems (Diamond-Mirlees separation). In this view, public sector programs should be designed to maximize social benefits minus costs (cost-benefit analysis), and then revenues needed to pay for those expenditures should be raised through a taxation system that creates the fewest efficiency losses caused by distortion of economic activity as possible. In practice, government budgeting or public budgeting is substantially more complicated and often results in inefficient practices.

Government can pay for spending by borrowing (for example, with government bonds), although borrowing is a method of distributing tax burdens through time rather than a replacement for taxes. Adeficit is the difference between government spending and revenues. The accumulation of deficits over time is the total public debt. Deficit finance allows governments to smooth tax burdens over time, and gives governments an important fiscal policy tool. Deficits can also narrow the options of successor governments.

Public finance is closely connected to issues of income distribution and social equity. Governments can reallocate income through transfer payments or by designing tax systems that treat high-income and low-income households differently.

The Public Choice approach to public finance seeks to explain how self-interested voters, politicians, and bureaucrats actually operate, rather than how they should operate.

Public finance management

Collection of sufficient resources from the economy in an appropriate manner along with allocating and use of these resources efficiently and effectively constitute good financial management. Resource generation, resource allocation and expenditure management (resource utilization) are the essential components of a public financial management system.

Public Finance Management (PFM) basically deals with all aspects of resource mobilization and expenditure management in government. Just as managing finances is a critical function of management in any organization, similarly public finance management is an essential part of the governance process. Public finance management includes resource mobilization, prioritization of programmes, the budgetary process, efficient management of resources and exercising controls. Rising aspirations of people are placing more demands on financial resources. At the same time, the emphasis of the citizenry is on value for money, thus making public finance management increasingly vital. Taxes

Taxation is the central part of modern public finance. Its significance arises not only from the fact that it is by far the most important of all revenues but also because of the gravity of the problems created by the present day heavy tax burden. The main objective of taxation is raising revenue. A high level of taxation is necessary in a welfare State to fulfill its obligations. Taxation is used as an instrument of attaining certain social objectives i.e. as a means of redistribution of wealth and thereby reducing inequalities. Taxation in a modern Government is thus needed not merely to raise the revenue required to meet its ever-growing expenditure on administration and social services but also to reduce the inequalities of income and wealth. Taxation is also needed to draw away money that would otherwise go into consumption and cause inflation to rise.^[5]

§                    A tax is a financial charge or other levy imposed on an individual or a legal entity by a state or a functional equivalent of a state (for example, tribes, secessionist movements Debt

Foreign currency reserves and gold minus external debt based on 2010 data from CIA Factbook.

Governments, like any other legal entity, can take out loans, issue bonds and make financial investments. Government debt (also known as public debt or national debt) is money (or credit) owed by any level of government; either central or federal government,municipal government or local government. Some local governments issue bonds based on their taxing authority, such as tax increment bonds or revenue bonds.

As the government represents the people, government debt can be seen as an indirect debt of the taxpayers. Government debt can be categorized as internal debt, owed to lenders within the country, and external debt, owed to foreign lenders. Governments usually borrow by issuing securities such as government bonds and bills. Less creditworthy countries sometimes borrow directly fromcommercial banks or international institutions such as the International Monetary Fund or the World Bank.

Most government budgets are calculated on a cash basis, meaning that revenues are recognized when collected and outlays are recognized when paid. Some consider all government liabilities, including future pension payments and payments for goods and services the government has contracted for but not yet paid, as government debt. This approach is called accrual accounting, meaning that obligations are recognized when they are acquired, or accrued, rather than when they are paid.

Ans5 Economic growth is the increase in the amount of the goods and services produced by an economy over time. It is conventionally measured as the percent rate of increase in real gross domestic product, or real GDP. Growth is usually calculated in real terms, i.e.inflation-adjusted terms, in order to net out the effect of inflation on the price of the goods and services produced. In economics, "economic growth" or "economic growth theory" typically refers to growth of potential output, i.e., production at "full employment," which is caused by growth in aggregate demand or observed output.

As an area of study, economic growth is generally distinguished from development economics. The former is primarily the study of how countries can advance their economies. The latter is the study of the economic aspects of the development process in low-income countries.

As economic growth is measured as the annual percent change of gross domestic product (GDP), it has all the advantages and drawbacks of that measure. Economic growth versus the business cycle

Economists distinguish between short-run economic changes in production and long-run economic growth. Short-run variation in economic growth is termed the business cycle. Briefly, the business cycle is made up of booms and busts in production that occur over a period of months or years. The most recent example of a business cycle was the global boom starting in approximately 2002 that ended with the late-2000 recession|bust of 2008–9. As discussed in the article on the business cycle, economists attribute the ups and downs in the business cycle to a number of causes including: overproduction of goods followed by large inventories that can't be readily sold, overexpansion of credit resulting in piling up of debt that inhibits purchasing; speculative bubbles, and shocks—like wars, political upheavals, and so on.

In contrast, the topic of economic growth is concerned with the long-run trend in production due to basic causes such as industrialization. The business cycle moves up and down, creating fluctuations in the long-run trend in economic growth.

Historical sources of economic growth

Main article: Productivity improving technologies (historical)

Increases in productivity are the main factor responsible for economic growth, especially since the mid 19th century. Most of the economic growth since that time been due to reduced inputs of labor, materials, energy, capital and land per unit of economic output (less input per widget). The balance of growth has come from using more inputs overall because of the growth in output (more widgets).^[1]

Opening up new territories was considered a growth factor in the past, being important since the late 19th century and in limited cases in the 20th century, such as the Amazon.

During colonial times, what ultimately mattered for economic growth were the institutions and systems of government imported through colonization. There is a clear reversal of fortune between the poor and wealthy countries, which is evident when comparing the method of colonialism in a region. Geography and endowments of natural resources are not the sole determinants of GDP. In fact, those that were blessed with good factor endowments experienced colonial extraction which only provided limited rapid growth; whereas, countries that were less fortunate in their original endowments experienced European settlement, relative equality, and demand for rule of law. These initially poor colonies end up developing an open franchise, equality, and broad public education, which helps them experience greater economic growth than the colonies that had exploited their economies of scale.

During the Industrial Revolution, mechanization began to replace hand methods in manufacturing and new processes were developed to make chemicals, iron, steel and other products.

Since the Industrial Revolution, a major factor of productivity was the substitution of energy from, human and animal labor, water and wind power to electric power and internal combustion. Since that replacement, the great expansion of total power was driven by continuous improvements in energy conversion efficiency.^[2] Other major historical sources of productivity were automation, transportation infrastructures (canals, railroads, and highways),^[3] new materials (steel) and power, which includes steam and internal combustion engines and electricity. Other productivity improvements includedmechanized agriculture and scientific agriculture including chemical fertilizers and livestock and poultry management, and the Green Revolution. Interchangeable parts made with machine tools powered by electric motors evolved into mass production, which is universally used today.

Productivity lowered the cost of most items in terms of work time required to purchase. Real food prices fell due to improvements in transportation and trade, mechanized agriculture, fertilizers, scientific farming and the Green Revolution.

Great sources of productivity improvement in the late 19th century were the railroads, steam ships, horse-pulled reapers and combine harvesters, and steam-powered factories. The invention of processes for making cheap steel were important for many forms of mechanizationand transportation. By the late 19th century, power and machinery were creating overproduction, which eventually caused a reduction of the hourly work week. Prices fell because less labor, materials, and energy were required to produce and transport goods; however, workers real pay rose, allowing workers to improve their diet and buy consumer goods and better housing.^[4]

Mass production of the 1920s created overproduction, which was arguably one of several causes of the Great Depression of the 1930s.^[5]Following the Great Depression, economic growth resumed, aided in part by demand for entirely new goods and services, such as householdelectricity, telephones, radio, television, automobiles, and household appliances, air conditioning, and commercial aviation (after 1950), creating enough new demand to stabilize the work week.^[6] Building of highway infrastructures also contributed to post World War II growth, as did capital investments in manufacturing and chemical industries. The post World War II economy also benefited from the discovery of vast amounts of oil around the world, particularly in the Middle East.

Economic growth in Western nations slowed after 1973, but growth in Asia has been strong since then, starting with Japan and spreading to Korea, China, the Indian subcontinent and other parts of Asia. The Japanese economic growth has slowed down considerably since late 1980s.

Economic growth per capita

Often, the concern about economic growth focuses on the desire to improve a country's standard of living—the level of goods and services that, on average, individuals purchase or otherwise gain access to. It should be noted that if population has grown along with economic production, increases in GDP do not necessarily result in an improvement in the standard of living. When the focus is on standard of living, economic growth is expressed on a per capita basis.

Economic growth per capita is primarily driven by improvements in productivity, also called economic efficiency. Increased productivity means producing more goods and services with the same inputs of labour, capital, energy, and/or materials. For example, labour and land productivity in agriculture were increased during the Green Revolution. The Green Revolution of the 1940s to 1970s introduced new grain hybrids, which increased yields around the world.

However, there is not necessarily a long term one-to-one relationship between improvements in productivity and improvements in average standard of living.^[7] Among other factors that might prevent a long-term improvement in standard of living despite economic growth is the potential for population growth matching or outstripping productivity improvements. When increased food supplies spur population growth rather than an improvement in the standard of living, people are said to be caught in the "Malthusian trap," named for Thomas Robert Malthus, the first observer to detail out this dilemma. There is considerable controversy, for example, as to whether the Green Revolution resulted in long-term improvements in the standard of living as it was accompanied by rapid population growth creating population sizes that may be unsustainable.^[8]

Economic growth can also be of interest without reference to per capita changes in standard of living. An example of this is the economic growth in England during the Industrial Revolution. Certainly, per capita increases in productivity occurred due to the replacement of hand labour by machines. However, economic growth during this period was in large part so dramatic because England's population simultaneously increased very rapidly (1700 A.D. – 1860 A.D.). The two factors together, more production per worker combined with many more workers, resulted in a sixfold increase in production between 1700 and 1860. Population growth alone accounted for most of this increase.^[9]

Measuring economic growth

Economic growth is measured as a percentage change in the Gross Domestic Product (GDP) or Gross National Product (GNP). These two measures, which are calculated slightly differently, total the amounts paid for the goods and services that a country produced. As an example of measuring economic growth, a country which creates $9,000,000,000 in goods and services in 2010 and then creates $9,090,000,000 in 2011, has a nominal economic growth rate of 1% for 2011.

In order to compare per capita economic growth among countries, the total sales of the countries to be compared may be quoted in a single currency. This requires converting the value of currencies of various countries into a selected currency, for example U.S. dollars. One way to do this conversion is to rely on exchange rates among the currencies, for example how many Mexican pesos buy a single U.S. dollar? Another approach is to use the purchasing power parity method. This method is based on how much consumers must pay for the same "basket of goods" in each country.

Inflation or deflation can make it difficult to measure economic growth. If GDP, for example, goes up in a country by 1% in a year, was this due solely to rising prices (inflation) or because more goods and services were produced and saved? To express real growth rather than changes in prices for the same goods, statistics on economic growth are often adjusted for inflation or deflation.

For example, a table may show changes in GDP in the period 1990 to 2000, as expressed in 1990 U.S. dollars. This means that the single currency being used is the U.S. dollar with the purchasing power it had in the U.S. in 1990. The table might mention that the figures are "inflation-adjusted" or real. If no adjustment were made for inflation, the table might make no mention of inflation-adjustment or might mention that the prices are nominal.

INTRUSION DETECTION SYSTEMS

UNIVERSITY OF LONDON

MIDDLESEX UNIVERSITY (HENDON CAMPUS)

BY: GURBINDER SHARMA

ID: 00331464

                                                                                                                           

Malicious Web: PART 1.

Avoiding and Detecting Web-based Attacks.

A  Dissertation submitted in partial satisfaction of the requirements for the degree of Masters in Network Security in Computer Science.

I am very much pleased to name my professor’s, who guide me to complete this difficult task by their Generous Support and the output is beyond my expectations.

I am thankful to Mr. Florian Kammuler Professor of Cryptography and Network Security.

Mr. Purav Shah Professor & researcher in Wireless Networks.

Mr. Abu baker (course Leader) Specialist in Computers.

Dissertation is approved By:

Mr. Florian

Mr. Purav Shah

Mr. Abu Baker

Mr. Armando

Acknowledgements

I would like to acknowledge the following people, without their support this dissertation would not have been possible.

I want to thank my advisor, Mr. James who sparked my interest in the field of computer security and motivated me to pursue research work in this area. I am grateful for his continuous inspiration and support before and throughout my Research work.

Apologies to those that I may have unintentionally omitted. Thanks to my parents for their constant support during my academic career and before.

Finally, my special thanks to Emma for coming and staying there with me, and for her love, support, and patience.

Research Interests: My primary research interest is in providing defenses against web-based attacks. One line of research has focused on avoiding and detecting attacks against web applications by using a combination of static analysis techniques.

 Data-Analysis, String modeling and dynamic analysis techniques (statistical learning).

 A second line of research I am investigating is the detection of attacks against web clients, such as drive-by download attacks and malicious ash-based advertisements.

Other research interests include electronic voting, security, malware analysis, and intrusion detection.

Standard Operating Procedure

Investigative Protocol -- Hacking and Intrusions

1 Apr 2012

Investigating Cyber Crime/Hacking and Intrusions

Framework for Conducting an Investigation of a Computer Security Incident.

What is the threat? How proficient does the "hacker" need to be?

•Computers are easily manipulated and easily "trapped" to intentionally destroy data.

• You do not need to be a "computer wizard" to seize a computer to destroy data and wreak havoc.

Hacker tools are readily available on the Internet, as well as complete instructions and plans.

• Hackers can usually uncover ways of circumventing firewalls.

• When you have an ongoing intrusion, you don't know initially whether it's just somebody's kid

Engaged in hacking for the fun or it or a precursor to a much more sophisticated, destructive attack.

You have to investigate them all as though they were potentially the most serious case possible, and

Pray they are not.

• Most intrusions are kids hacking

•Log files reveal expertise

• Beginner

• Intermediate

•Advanced

•Hacker pyramid

•On the bottom are the “bottom feeders” – 97%.

•Anyone can do; like putting together a swing set with instructions

•When spotted, put these folks in the “watch” file and track them if they try it repeatedly

•2-percenters: Take Internet exploits that extra step; persistent

• 1 per centers: The folks you won’t see in log files. Never caught.

How can a hacker work his wiles and cover his tracks?

• The hacker may start his hunt with a vulnerability scanner such as SATAN and other commercially

Available programs. Since SATAN has been widely publicized, "in-the-know" systems administrators

Have run SATAN against their own systems and fixed vulnerabilities they found. But others have not,

And there are other products continually produced that circumvent previously known safeguards.

• The proficient hacker (and, again, he doesn't have to be a computer genius, but merely follow a few

Simple instructions!) Telnets from his current hacked account into another of his pirated accounts, then telnets from that location to yet another account that he has hacked, remotely logging on to it in preparation to run port scans looking for targetable systems. This process forces investigating law enforcement to obtain search warrants in a number of different jurisdictions, immensely complicating the investigation.

• Knowing that almost every large corporation has at least one unauthorized modem on its network, the hacker sets up a war-dialer program that will call each of the extensions to the phone system at the company until it pulls up the modem, giving him a login screen to the company's computer system. A war dialer searches ranges of telephone numbers to find those phone numbers specifically connected to a computer.

• Using a "brute force" program, he repeatedly hammers the system, trying to "guess" passwords for

"Root," a top-level account that has the run of the system and controls the computer. These programs

keep working automatically until they exhaust every word in an unabridged dictionary, all names in an encyclopedia, and each entry from a local phone book, for example. The hacker "secures his beachhead," using FTP (file transfer protocol) to plant a root kit and sniffer onto his latest victim. He sets the program to capture and record everything typed in at the systems administrator console, as well as any log-on session from any computer on the network.

• The hacker next goes on a hunt for a password file, hoping that some of the passwords he finds will

Also work on other machines inside the company's network.

• The hacker locates the password file, but discovers only "x" characters where the encrypted passwords should have been. The information the hacker seeks is contained in a shadowed file. Even so, he easily runs the ftp program and tricks it into crashing, causing a "core dump." The legitimate purpose of a core dump is to allow programmers to perform an autopsy on the digital remains in search of clues to a program's failure. But, as the hacker knows, a core dump has other uses, such as placing encrypted passwords in the shadowed file into RAM (Random Access Memory), where he can easily harvest them.

• Using other software, the hacker creates a root shell, from which he can then run other commands and programs.

• The root kit the hacker installed will hide evidence of his activities only from the time when the

Program was activated, so the hacker must mop up by deleting previous actions of his busy night by

Deleting entries in the computer system's logs. At this point, the hacker "owns" the company.

Three possible courses of action for companies and corporations

• Completely handle the incident internally

• Take civil action

• Report the incident to authorities

Do you want to involve law enforcement?

• Law enforcement can do things you can't Subpoenas to look for things that you can't without allegations of invading privacy

•Search warrants to seize and impound computers indefinitely

• Tap phone lines

• Begin surveillance

• Use undercover officers and operations to investigate

• Question employees, detain suspects, and examine company records

But…

• Does the local agency have the training, budget or manpower?

To see the investigation through to the end?

• The company loses control of its investigation; it becomes law enforcement's investigation. Law

Enforcement operates by different rules, and is not bound to protect any company's interest, but works to protect the public's interest. It becomes a state matter, not a private matter, and the criminal justice system kicks in. Law enforcement officers will almost always work hard to do what is in your organization's best interests, as long as it doesn't conflict with their official duties and objectives.

• For the investigator to be effective, he must have your FULL cooperation. Investigators can't create cases out of thin air.

• Be prepared to air "dirty laundry" in public, if it comes to that.

It is ALWAYS A GOOD IDEA to call law enforcement in when your case involves:

• Cyber terrorism

• Corporate espionage

• Financial fraud

Likelihood of success in these investigations is low -- FBI estimates

• Typical computer criminal has a 99% probability of getting away with his or her crime;

Only 1% of all computer crimes are successfully prosecuted.

• CBI States that, they are bound to rules & in India There is no Specific Cyber-Law Enforced.

Fewer than 10% of all computer crimes result in a successful investigation

• 10% or less of that number are prosecuted

• Only about 10% of that number is actually punished

• One reason: Electronic evidence can be created, altered, stored, copied, and moved with

Unprecedented ease. Many perpetrators are skillful at covering their digital tracks.

• You may never catch the culprit because:

• The trail was cold -- too much time passed since the incident, and the digital evidence evaporated Logging was incomplete or nonexistent, The investigation cost more than the loss, and there was no point in continuing

• The universe of possible perpetrators was too large

• The event was inconclusive -- it may or may not have been a security incident

• You couldn't conclusively point to a suspect

• You didn't have enough evidence to prove your case beyond a reasonable doubt

•Political pressure stopped the investigation (This is a real scenario; I faced It so many times)

• Cover-up

Laws that apply

Colorado Computer Crimes statute

 18-5.5-102 - Computer crime.

 (1) Any person who knowingly uses any computer, computer system, computer network, or any

Part thereof for the purpose of devising or executing any scheme or artifice to defraud; obtaining

Money, property, or services by means of false or fraudulent pretenses, representations, or promises;

Using the property or services of another without authorization; or committing theft commits computer crime.

(2) Any person who knowingly and without authorization uses, alters, damages, or destroys any

Computer, computer system, or computer network described in section 18-5.5-101 or any computer

Software, program, documentation, or data contained in such computer, computer system, or

Computer network commits computer crime.

(3) If the loss, damage, or thing of value taken in violation of this section is less than one hundred

Dollars, computer crime is a class 3 misdemeanor; if one hundred dollars or more but less than five

Hundred dollars, computer crime is a class 2 misdemeanor; if five hundred dollars or more but less

Than fifteen thousand dollars, computer crime is a class 5 felony; if fifteen thousand dollars or more,

Computer crime is a class 3 felony.

Federal case :

There are various federal laws if it is a "federal interest" computer:

• Computers involved in crimes that cross state lines

• Computers materially involved in any crime that is a federal crime (gambling, kidnapping)

• Threats or attacks a federal government computer system (HUD, Air Force)

• Computers involved in banking

Federal laws that might apply:

• Fraud and Related Activity in Connection with Computers, 18 U.S.C. Sections 1030. The

Latest amendment is found in the National Infrastructure Protection Act of 1996. Section 1030

is the main anti-intruder law. Includes language such as "intentionally accesses or exceeds

Authorized access to a computer." Violations are felonies.

• …"accused knowingly caused the transmission of a program, information, code or command,

And by doing so, caused damage to a protected computer." Protected computer could be one

Used by financial institution or U.S. government, or "any computer used in interstate or

Foreign commerce or communication." Enacted in response to the Morris Internet worm.

This measure also covers possession of unauthorized passwords, computer extortion, etc. See

Language on Page 49 of Computer Crime Investigator's Handbook for AFOSI on people fired

Who damaged private systems?

If federal, FBI and Secret Service have jurisdiction…but…

• These agencies are understaffed in this area, so they are naturally more concerned with

National security threats and federal system computers. They may not have the wherewithal

To respond even to a federal interest computer case.

• Does another agency, perhaps a local agency, have a "claim" in the case?

Managing Intrusions

Four-step process

•Avoidance

• Testing

• Detection

• Investigation

What are the company’s information security policies, standards, and practices?

Consider the following:

•Investigating and prosecuting computer-related crime is expensive and time-consuming.

• Need to proceed with great care in case you need to defend yourself against wrongful termination,

Invasion of privacy, or discrimination.

• If law enforcement is involved, there are rules of evidence, issues of privacy, and burdens of proof that must be born.

Prevention tools

• TCP/IP attack simulator

• Safe Suite

• Performs more than 100 different attacks typical of hacker attacks.

Detection

• What capabilities do you have to detect intrusions in real-time? (like military ASIMS systems)

• A watchdog system that sits in the background and oversees all activities

Involving the device under surveillance.

• Best tools allow extensive, robust logging, protected from tampering. They also allow for

Responses from the system under attack that may be able to gather information about the

Attacker that can assist you during the investigation.

• Intruder Alert

• Everywhere an intruder goes, he or she leaves tracks.

• Real Secure

•Automated Security Incident Measurement (ASIM)

•AFCERT system (Air Force Computer Emergency Response Team), Kelly AFB, Texas

•ASIM systems are placed where base networks connect through gateways to external

Networks.

• Sniffer that monitors computer communications traffic passing through the gateway

• Programmed to detect changing hacker threats

• AFCERT sends info from this system to AFOSI DETs and they review for suspicious activity

That may cause them to initiate an intrusion investigation

• Reports to DET include date, POC, description of incident, recommended actions to improve

Security, warning level

• Many of the commercially available intrusion and abuse detection tools are excellent, but they

Can be expensive. However, you can download a very good basic tool, called Tripwire, free

From the Internet.

Investigation – Intrusion management defaults to investigation when all other measures failed to prevent an attack. But investigations may be futile unless luck and circumstances are with you.

Investigative process

• Legal coordination

• Checking records, such as system documentation and logs, as well as information about suspects

• Interviewing informants

• Does the suspect frequent hacker newsgroups such as Cypherpunks, Bugtraq, Best-of-

Security?

• Conducting system surveillance

• Preparing a search warrant

• Searching the suspect’s premises

• Seizing evidence

If we had to be reactive…

• Eliminate the obvious – not every computer failure from now on will be your suspect taking

Action. Computers fail for a variety of reasons.

• Hypothesize the attack

• Map all possible vectors, access routes into the victim computer

• Analyze access controls

• Many computer systems contain many security features that people simply don't

Realize are there. In most cases, all systems administrators have to do is turn them on. For example, account lockout features are critical for good security. Are they turned on?

•Analyze logs

•One great advantage are systems that run what is called a mirror log. Each time your

Audit program creates a log entry; an identical entry is created in a separate computer. When attackers attempt to erase their tracks, they will delete the entries in the primary log, but the mirrored log remains unchanged. You will be able to see virtually every step they took.

• Evaluate known exploits in this system

• Reconstruct the crime

• Perform a trace back to the suspected computer

• Analyze the source, target, and intermediate computers

• Collect evidence, including, possibly, the computers themselves

• Follow up on findings and prepare evidence

Log Files

The “smoking gun” in intrusion investigations. Nearly all that come to AFOSI are ASIM logs. But also

Firewall log files, router log files. By default, many systems log files are not turned on. Some sys admins think they slow a system down; may be true. NT installations often don’t have the log files turned on. UNIX and Linux have an out-of-the-box logging capability.

ASIM logs are socket or packet layering logs. Decode every single byte that goes through the network

Looking for strings that are threatening. Generates a log file, or an alert (real-time or logging alert). Transcript logs – everything that went on in that system. Connection logs show you the connections that took place, and the strings that hit and alerted ASIMS. Depending on the warning level, 1-10, it will actually record what happened. Initiating transcript log shows where the bad guy came from and the commands he typed. Compare to destination transcript log to see commands as well as the output. Commands will not match exactly because packets are dropped as recording the information, an echo on the system (echoes extra characters back to the terminal).

Full transcript logs give you the commands in context of everything else going on in the system.

You have to ask AFCERT for the transcript logs to go along with the initiating and destination logs they

Provide. To get a sniffer on a suspect, 52 request, like a wiretap, to put Sniffy, their sniffer, to check for only those suspect IP addresses in the investigation.

• Information to gather:

• How would the intruder enter the system?

• What type of security do you have on direct-connect maintenance modems on critical

Host computers? (For PCs and NT computers, there is a wealth of remote access

Programs, such as PCAnywhere, Lap Link, Reach Out, and Carbon Copy that an intruder

Can use to "drive" your system.)

• Do you have weak password accounts that can be easily hacked into with a password cracker?

• Do you have back doors in your UNIX or NT operating system?

• Will let the intruder back into the computer system even if systems administrator changes all the passwords.  Often allows the hacker the run of the system without being logged.  What would we need to justify trap and trace of the phone line the intruder would use?

• Once the attacker has dialed in and is online, you don't have any options for tracing that

Don’t involve the phone company, which requires law enforcement, a court order, and

Trap and trace. Would it be less troublesome, less costly and more effective to strengthen defenses in advance?

• How would we gather evidence of the intrusion in progress?

• How would you document damage to your system in order to explain its extent?

• Would you be able to document effort you spend in investigating this incident and

Determining the damage?

Analyzing a computer involved in an intrusion

• Boot from a sterile DOS investigative disk

• Take a physical image of the hard drive

• Look at the last date of change on critical files

• Examine configuration and start-up files for things that don't seem right

• Look for hacking tools (password crackers, copies of passwords, etc.)

• Examine the password file for unauthorized accounts

• Search the mirror image of the hard drive for keywords appropriate to the incident. Include hidden

Areas, slack space, and cache.

• Look for changes to files, critical file deletions, and unknown new files

• Use the NTI tool IPFilter to collect a list of all e-mail addresses, FTP sites and URLs, visited from

The computer and use DM or Excel to calculate the number of times they were visited Cyber Forensics

• KEY QUESTION: DO YOUR SYSTEMS ADMINISTRATORS HAVE ADEQUATE

LOGGING PRACTICES TO CAPTURE ATTACK ATTEMPTS?

Log examination is probably the single most productive part of the investigation, IF logs are

Kept properly.

• Search an electronic copy for user IDs (password is invariably nearby)

• Search for target word or phrase unique to the investigation

• Times of login and logout --use LASTLOG

• Anomalies in the LASTLOG (use CHKLASTLOG)

• Source IP address --use SYSLOG or other logs that record IP addresses.

• Capture attacks with a sniffer (record every transaction involving IP addresses)

Target-Hardening

• Does your company see itself as a possible target for information warriors?

• Does your company have a cyber security section?

• Protective measures you can take:

• Plug into threat-warning networks (e.g., NIPC)

• Analyze intrusions -- Cybercrime requires study and a great degree of coordination;

Be willing to share "dirty laundry”.

• Put in place a good security policy that defines what is and is not allowed in terms of

Network and Internet access.

• Establish several hardened firewalls.

• Train systems admins in security, and how to plug holes and investigate intrusions. To protect an

Organization completely, sys admins must audit the network on a regular basis.

• Install a good quality intrusion detection system (IDS). The firewalls guard your perimeter, while

IDS monitors what is happening on your network, guarding against slip-ups by the firewall, as

Well as internal mischief. Network administrators should use one product from each of the

Following categories:

• Vulnerability Scanners -- "Hacker in a box" programs the systems administrator can use to

Probe his or her network resources proactively.

• Host-based IDS -- Use an agent that scrutinizes logs, critical system files and auditable

Resources looking for unauthorized changes or suspicious patterns of activity. Whenever

Anything out of the ordinary is spotted, alerts are "sounded" and traps raised automatically.

• Network-based IDS --Monitor traffic on the computer in real time, examining packets in

Detail to spot denial of service attacks or dangerous packet payloads before they reach their

Destination and do damage. This network-based scanner should be capable of both raising

Alerts and terminating the offending connection immediately.

• Pull the plug on perpetrators

• Have them investigated, arrested, prosecuted and convicted -- ruins the "reward system"

Good reading for the corporate security investigator.

• "Investigating Computer-Related Crime" by Peter Stephenson "Corporate Security," by Ira Winkler

Other Resources: Visit web sites, and join them for latest updates:

•Computer Security Institute (CSI)

•International Computer Security Association (ICSA)

•National Infrastructure Protection Center (NIPC)

• Newsgroups dedicated to hackers:

• Cypherpunks

• Best-of-Security

• Bugtraq

• www.onlinefraudwatchers.com

   www.hackingresources.com

MAJOR LIMITATIONS OF IDS:

1. False alarming

2. Data Mining (Deep Digging into the databases for satisfactory results).

3. Took Huge Time to investigate a hacking case.

4. Very Very Expensive.

5. Legal Complexities.

6. No well defined Cyber Crime Law System.

7.  97% culprits find it very easy to escape from Legal Procedures.

8. We Lack experts to tackle these serious/critical cases.

HOW TO COLLECT/SIEZE THE EVIDANCES IN DIGITAL FORENSICS

This is the most important step towards caughting a culprit and bring him/her into the court of law.

Computers are very sensitive to interference of some objects/metals & environments, like moisture

Iron, magnets, static electricity etc.

STEPS INVOLVING:

1. Never entered in to the crime scene without a search warrant.

2. Do not touch anything with bare hands; it may erase the bio-metrics evidences like fingerprints.

3. Always bear gloves while collecting the evidence because humans have good source of static current.

And if you touch a disk surface or other electronic devices leads to the destruction of the evidence.

4. Take pictures of the crime scene and every evidence you collected by a good quality camera and an expert person in taking the shots of digital evidences.

5. Collect everything very carefully because most of the cases you found the damaged machines, burnt pieces of papers used by the culprits. They try their best to destroy every possible information that can go against them.

6. Note down every single evidence you collect in to your diary serial wise for instance hard disks/tape drives/cell phones/printers/usb device and papers or documents.

7. Do not put ,any form of evidence into plastic bags because plastic contains static current and may damaged the digital evidence you collected rather use wooden blocks and put the evidences into wooden boxes carefully and seal every box with a paper sheet attached on it describing the contents in the box. Keep one copy with yourself.

8. Never open the boxes once sealed and turn on the cell phone in open, because these are easily controlled via satellites and may erased every record or number stored in the cell phones.