Why is it important to have disaster recovery and business continuity policy?

Business continuity plan (BCP) is the way in which an organization should recover and restore its organizational function within a predetermined time frame after a total or partial disturbance to its services during a disaster. These disasters can be earthquake, flood, natural disaster, terrorist attack, or any major event which cause a catastrophic event to the organization. In simple terms, BCP is a method of planning strategically to prevent or if possible manage the consequences of a disaster, as a result reduce the consequences to a limit that businesses can absorb.

BCP manual is a printed manual which is stored in a safe place (remote site) which contains names, contact numbers, crisis management staff and other staff details, venders, clients and details of offsite backup site to operate, other important legal documents and business documents, etc. Organizations should make sure their BCP manual is realistic and easy to follow in a crisis situation without adding another burden.

Disaster Recovery Plan is a map of how an organization gets recovered in the event of a major disaster and continues its business. This is a key component in an organizational business continuity planning. Business continuity plan has a broader scope than disaster recovering planning in an IT perspective.

We cannot predict what disaster will happen next and what impact that will have on our business or the patterns in which those disasters are occurring. Businesses have to continue with minimum interruption to survive in the industry. Suppose an organization is faced with a disaster, as a result its network and the communication went down. How can you operate the organization in a situation like this? This is where you see the practicality of investing for a BCP and DRP to backup plan to guide you how to operate in a disaster situation and how to get out of the disastrous situation. BCP guides you during this difficult situation how to find the resources and operate with business till you recover fully from the disaster. DRP is more towards the technology and how to build the normal operation after the disaster is over, while BCP helps to operate the business functions during the disaster’s period.

Project Processes which should be followed when implementing IT Security projects

IT security project require well defined processes because omission and errors can leads to huge security holes. There are quite a lot of processes should define to implement a IT security project. These processes are briefly discussed below.

Acceptance criteria - These is predefined results which can be expected during the security project. These results are agreed y discussing with key stakeholders of the IT security project.

Risk management - you conduct a thorough risk assessment and threat assessment to identify the risk associated with the security project and define in which way those risk can be avoided, mitigate or transfer during and after the project.

Change management - Errors and omissions in security project is hard to avoid but keeping proper track of what went wrong, when, where, how and what measures you take should be properly documented to avoid countering or solve the risk and problems that could occur in future.

Communication procedure - Most importantly the communication has to be managing properly. Project’s key stakeholders and sponsors have to keep informed about the milestones of the project throughout the security project. The process of when, how, who to keep update and at what frequency should to known when starting the security project. Otherwise project manager and team will have a tough time what, when and whom to inform when the security project underway.

Quality management - Quality measured through testing and this should be clearly defined in your quality management procedure. What test methodologies to use, what modules to test, when to test, etc have to be defined in advance. Level of testing required for IT security projects is solely depend on the type of the security project and the severity of the impact to the organization.

Status reporting - Status of the project should be updated to project sponsors and key stakeholders when needed. This frequency of reporting can be agreed during the project requirement phase, where you can discuss the report type required and what frequency they needed.

Escalation procedure - If the issues cannot solved through the normal channels, you need to pass the issue to the next level in the escalation hierarchy to reach a solution. These escalation paths have to be identified accurately and defined clearly in case of an emergency to follow without causing any delay for the project.

Documentation - Every aspect of the project should be clearly documented. This documentation will greatly help in future when managing, monitoring and troubleshooting some errors in the project.

Approval procedures - Approval procedure should include who has the authority to approve for changes in the project. Mostly this will be the project sponsor who makes the decision about the security project. You cannot run here and there to see who should approve the changes in urgent situation. If these procedures are clearly defined, the unwanted delays could be avoided.

Deployment - Deployment procedure should include when and how the deployment should happen. Before the deployment all the affected parties must be informed in advance to avoid unwanted systems problems, this can be address in the communication plan.

Operational procedures - How the security system is monitored during the day to day activities and who is responsible for the maintenance and monitoring of the implemented system is mentioned in the operations procedure. It includes how to manage the security system and to whom to contact in case of any emergency, etc.

Training procedure - Users of the security system should be adequately trained to get the maximum use of the implemented security system. Through training you increase the awareness level of the users and make them responsible for the system, where they can report any suspicious activity.

Capturing Nature - Sky

These pictures were captured during 2006-2007 using Nokia 6230i.

Data Compression Algorithm - Lampel Ziv

This is a universal lossless data compression algorithm designed by A. Lampel, Jacab Ziv, and Terry Welch, which was published by T. Welch in 1984 as an enhanced version of LZ78 algorithm. Lempel Ziv algorithm is mostly used in compression like gzip, GIF, and V.42 modem standard. There are two algorithms derived from Lempel Ziv algorithms , they are LZ77 and LZ78.

Most data carry a pattern, for instance in an article some letters appear more often than others, data compression techniques uses this method to compress data by replacing repeated letters by adding different short value to it and get a small size than the original data. Reproducing the original data is possible in this lossless data compression method. Lempel Ziv uses an adaptive dictionary; this is created in while the data being encoded. On the other hand it is not required to transmit or store the dictionary since decoder is capable of building the dictionary. The dictionary size can increase infinitely large in theory, although it practice it increased to certain extend and stop. Recommended size of a dictionary is 4096.

What is Data Hiding Analysis ?

Data hiding analysis is the method or the process of searching for the hidden data in the system or the hard disk. Cybercriminals hide the information in the system by thinking that it would not be detected by searching queries or advance forensic data analyzing tools used by forensic investigators. They will use different methods to hide the information or the application that they infect, intend to damage or trying to steal in hidden format inside the hard disk using many varieties of data hiding methods such as using tools like Invisible software or simple method of adding the hidden flag in Windows file system or by adding the hidden attribute (-h) in DOS prompt. In some other cases cybercriminals change the file format of the data so that it appears different to other users. For instance a cybercriminal who is trying to pass out a confidential business data file (MS excel file) might rename it as a picture file and nobody would suspect since this is a totally different file than it looks. Later the cybercriminal will rename the file extension back to the excel format and use it.
On the other hand cybercriminals use steganography techniques to hide data from the authorized users. For example in MS PowerPoint slide add a picture of a “duck” and insert a confidential document and minimize it as much as possible then change the font colour of the words to white and group with the “duck” picture and save and send via e-mail. Everyone will think that sender is transferring a picture of a duck to a friend, but the actual scenario is the cybercriminal is transferring confidential data without anyone noticing any difference.

Windows XP boot Process

When switch on the power of a PC, system clock send clock ticks to start the CPU, then the CPU checks the startup program in ROM BIOS and starts the POST (Power On Self Test) which is tests all the hardware devices functionality of the PC and check whether the PC is good condition to operate. If the POST completed successfully it finishes the initialization of the CPU. During the POST process it checks whether this power on process occurred due to soft/warm or hard/cold start. (Cold start is when the machine start occurs with an in proper shutdown, whereas soft start happens when the machine is restarting with proper execution of commands when it is on) If it is a cold start POST perform a full test and if it is a warm start it omit the memory test part during the POST.

BIOS check the disk and load the MBR (Master Boot Record) to the memory, and then MBR take over the boot process. Boot Loader in the MBR searches the partition table for active partition and reads first sector to locate Boot Record. NTLDR (NT Loader) is a system file which is stored in the system root start the XP loading in following phases;

Initial Boot Loading – Processor is turned to real mode from the protected mode and switched on the memory paging. NTLDR will detect and load Boot.ini into memory.

Operating System selection – Boot.ini check whether it has more than one operating systems configured in the system and if it identified two or more it stops the process and allow user to select a OS.

Hardware detection – When XP is selected, NTLDR loads the Ntdelect.com program which detect the hardware profiles configured for the system. If there are many hardware profiles detected, it gives a time period to select a hardware profile for the system before proceeding with the 1^st profile. Then NTLDR is loading Ntoskrnl.exe.

Configuration selection – It loads drives which are selected as boot drivers to the system, while ntoskrnl.exe in first phase disable interrupts and call HAL (Hardware Abstraction Layer) to setup interrupt controller, then it enables the interrupts before the next phase. During the 2^nd phase below processes execute and re-initialization occurs in the given sequence.

a. Object manager

b. Executive

c. Microkernel

d. Security Reference Monitor

e. Memory manager

f. Cache manager

g. LPCS

h. I/O Manager

i. Process Manager

I/O manager first finishes loading boot drivers and system drivers and prioritized and load all other drivers. Session Manager Subsystem (SMSS) loads win23k.sys devices driver which change screen into graphical mode. After successful loading of all the device drivers and services it saves its configuration as “Last Know Good Configuration”. Hence logging process is started by Winlogon.exe, and lsass.exe (Local Security Authority) displays the logon screen.

Good Luck and Bad Luck

Prof Richard Wiseman is based at the University of Hertfordshire in the UK, and has gained an international reputation for research into quirky areas of psychology, including deception, humour, luck and the paranormal.

This is the one such experiment conducted by the Prof. wiseman about how some people get all the luck and others miss it.

By Professor Richard Wiseman, University of Hertfordshire :

Why do some people get all the luck while others never get the breaks they deserve? A psychologist says he has discovered the answer. His study in his own words:--

Ten years ago, I set out to examine luck.

I wanted to know why some people are always in the right place at the right time, while others consistently experience ill fortune. I placed advertisements in national newspapers asking for people who felt consistently lucky or unlucky to contact me.

Hundreds of extraordinary men and women volunteered for my research and over the years, I have interviewed them, monitored their lives and had them take part in experiments.

The results reveal that although these people have almost no insight into the causes of their luck, their thoughts and behaviour are responsible for much of their good and bad fortune. Take the case of seemingly chance opportunities. Lucky people consistently encounter such opportunities, whereas unlucky people do not.

I carried out a simple experiment to discover whether this was due to differences in their ability to spot such opportunities. I gave both lucky and unlucky people a newspaper, and asked them to look through it and tell me how many photographs were inside. I had secretly placed a large message halfway through the newspaper saying: "Tell the experimenter you have seen this and win $50."

This message took up half of the page and was written in type that was more than two inches high. It was staring everyone straight in the face, but the unlucky people tended to miss it and the lucky people tended to spot it.

Unlucky people are generally more tense than lucky people, and this anxiety disrupts their ability to notice the unexpected.

As a result, they miss opportunities because they are too focused on looking for something else.

They go to parties' intent on finding their perfect partner and so miss opportunities to make good friends.

They look through newspapers determined to find certain types of job advertisements and miss other types of jobs.

Lucky people are more relaxed and open, and therefore see what is there rather than just what they are looking for.

My research eventually revealed that lucky people generate good fortune via four principles.

They are skilled at creating and noticing chance opportunities, make lucky decisions by listening to their intuition, create self-fulfilling prophesies via positive expectations, and adopt a resilient attitude that transforms bad luck into good.

Towards the end of the work, I wondered whether these principles could be used to create good luck. I asked a group of volunteers to spend a month carrying out exercises designed to help them think and behave like a lucky person.

Dramatic results! These exercises helped them spot chance opportunities, listen to their intuition, expect to be lucky, and be more resilient to bad luck. One month later, the volunteers returned and described what had happened. The results were dramatic: 80% of people were now happier, more satisfied with their lives and, perhaps most important of all, luckier.

The lucky people had become even luckier and the unlucky had become lucky.

Finally, I had found the elusive "luck factor".

Here are Professor Wiseman's four top tips for becoming lucky:

1) Listen to your gut instincts - they are normally right

2) Be open to new experiences and breaking your normal routine

3) Spend a few moments each day remembering things that went well

4) Visualize yourself being lucky before an important meeting or telephone call.

Have a Lucky day and work for it..

The happiest people in the world are not those who have no problems, but those who learn to live with them.