Key steps in conducting forensic investigations.

Before proceeding with the investigation, forensic investigation team must be well prepared and equipped with necessary prerequisite facilities. Below indicated steps define the steps that the forensic team should adapt to, although the steps are not limited to this.

I. Policy and Procedure development.

Developing proper procedures and policies will give a clear guidance of functional and operational behavior of the forensic unit, and the mission statement that will keep the unit focus on their existence.

· Software licensing – Purchase required softwares and licenses for the forensics unit

· Training – Forensic team requires specialized training for the investigation.

· Resource allocation – Funds and resource allocation

II. Evidence assessment

Forensic investigator must determine the actions to be taken after considering the evidence assessment against the scope of the case.

· Case assessment – Determine whether you need to sought additional evidences such as finger print, DNA analysis, etc.

· Processing location assessment – Identifying the place of the investigation ( In lab environment or onsite)

· Legal considerations - What is the extend of authority to search.

III. Evidence acquisition

Digital evidence has the tendency of getting destroyed, damaged or altered due to its sensitivity, thus protecting and handling them during the entire process is very critical.

· Imaging – Extract the evidence data by fixing the storage device to a forensically cleaned system.

· Write protection – Perform MD5 (Message Digest 5) or CRC (Cyclic Redundancy Check) before and after examination of evidence to determine if the evidence is being tampered during the examination process.

IV. Evidence examination

This process will defer according to the case that the investigator is working on, method, tools to be used and methodology of the investigation. Examination should not perform on original evidence.

· Preparation – Create a unique folder on a separate system to extract evidence data

· Extraction

i. Physical – Extract /recover data of the full physical drive

ii. Logical – Extract and recover data based on operating system, file stucture.ect

iii. Analysis of data – This is the method of matching the relevance of the evidence data to the case that is being examined.

V. Documenting and reporting

All the incidences have to be documented with the timelines of the occurrence from the beginning to the closure of the case and each and every supporting document should be filed accordingly. Final report has to be produced to the case if needed or only to the relevant authority.

How to implement Wireless VoIP

Comparatively wireless VoIP is slower than VoIP in wired network. Thus deployment of wireless VoIP needs to consider the real need of wireless VoIP to the corporate network. It is not the point to implement the latest technology but to implement the best system which serves the purpose of the corporate network. Below mentions are basic guidelines for wireless VoIP deployment and this can greatly vary according to the organizational requirements.

1. Make sure the network can handle VoIP.

When moving from wired communication channels to wireless communication channels it is vital to check whether current organizational structure is capable of handling the wireless VoIP requirement adequately and provide the level of expected results. Since data and voice are going to be transmitted through shared medium if the corporate network is also a wireless LAN. Even with the wired data network voice transmission required to be prioritized due to its real time requirement.

Determining the network's readiness for VoIP is essential. A readiness assessment to establish the baseline capabilities of the network will help determine which areas of the overall system need to be fine-tuned or upgraded to support the streaming media requirements of VoIP.

2. Keep the deployment simple.

Deployment of wireless VoIP should take place in parallel or pilot deployment due to the fact that if anything got backfired in the corporate network, it is easy to rectify and resolve without having to shutdown the whole communication lines. This pilot deployment helps to measure the pros and cons of the wireless VoIP implementation and take necessary actions in due places.

3. Create network service maps and update service-level agreements.

During pre-deployment, network administrators should create maps of the network and define service-level agreements with internal departments and external clients. With a proper inventory of the network in the form of a service map, administrators will be able to pinpoint potential bottlenecks and areas of the network that need to be upgraded or extended to support the additional traffic.

Setting requirements in advance is essential, because appropriate expectations and regular feedback between business owners, technology departments and end-users will result in a more successful VoIP experience. Define the policies for ongoing monitoring, performance measurement and management of the network and the VoIP system. Typical SLA metrics include network uptime, application availability, and network and application response time. The data gathered is used to measure pertinent service delivery aspects, such as delay, jitter and uptime, and report confirmation that all requirements and expectations are being met.

4. Consider QoE.

Quality of experience (QoE) is a way to understand the user's perception of the quality of the VoIP telephone systems which can give a correct feedback of the systems that you have implemented. QoE will help measure the success of the wireless VoIP deployment from the end users level.

5. Review, reassess and repeat.

Networks are not static, so implementing an ongoing monitoring process is important. Any change to the infrastructure or usage patterns has an impact to everything on the network. Bringing servers on and offline, upgrading hardware or virtualizing portions of the environment can impact VoIP services.

Continuous monitoring and measurement of IT operations and service-level reporting will provide needed information to quickly resolve network outages and system issues. This technical and business intelligence analysis supports service improvement plans that will sustain the VoIP implementation and make sure end-users do not experience call degradation issues.

Much of the management of the VoIP system and applications can be automated to allow network assessment and monitoring to be repeated consistently to maintain appropriate baselines. Baselines enable administrators to monitor performance and availability, as well as prevent, diagnose and resolve problems.

Wireless Protocols

These are few wireless protocols in use.

Name of the Protocol	Description
WAP (Wireless Application Protocol)	This is an application communication protocol inherited from internet which is used by handheld devices, mobile phones, pagers and two way radios, smart phones, etc. WAP is supported by operating systems such as PalmOS, EPOC, Windows CE, FLEXOS, OS/9, and JavaOS. This protocol is capable of working with wireless networks such as CDPD, CDMA, GSM, PDC and TDM
TKIP (Temporal Key Integrity protocol)	This is a short term fix introduced to WAP which comes as a simple software/firmware upgrade. TKIP identifies all of the WAP weaknesses. This increase the IV (Initialization Vector) to 48 bits and first 4 bits indicate QoS traffic class while remaining 44 bits are used as a counter. TKIP generate new secret keys dynamically and use original secret key as a base.
SWAP (Shared Wireless Access Protocol)	This is developed by HomeRF Working Group for wireless voice and data networking for home environment. SWAP supports TDMA for interactive data transfer and CSMA / CA for high speed packet transfer.
EAP (Extensible Authentication Protocol)	EAP supports multiple authentication methods such as, token cards, smart cards, Kerberos, one time passwords, certificates and public key authentication. There are two EAP variations, · LEAP (Lightweight Extensible Authentication Protocol) – This is a proprietary protocol of Cisco which use dynamic Wired Equivalent Privacy (WEP) key that are changed with more frequent authentication between RADIUS server and clients. LEAP intends to provide secure authentication for 802.11 WLAN which supports 802.1x port access control. · PEAP (Protected EAP) – This is base on the Internet Draft (I-D) submitted by Cisco, Microsoft and RSA security to IETF. This relies on TLS to allow nonencrypted authentication types and encrypt all user sensitive authentication information.
LDAP (Lightweight Directory Access Protocols)	This is built on X.500 Directory services model and communication has two elements such as client-server and server-server. Few common LDAP server are, IBM DS Series LDAP Directory (AIX), Netscape Directory Server and OpenLDAP server (Linux), etc.
WRAP (Wireless Robust Authentication Protocol)	This is an encryption protocol standard for 802.11i and based on Offset Codebook (OCB) mode of AES. (EC Council)
HDTP (Handheld Device Transport Protocol)	This protocol is optimized for handheld devices and low performance networks and provide security features like, authentication, privacy and integration, counteracting playback attacks, etc. (EC Council)

Wireless Terminology

These are some of the wireless terminologies used in the industry.

Terminology	Description and common usage	Area of usage
802.11a	ü An IEEE standard for wireless area network which operate in the 5 GHz. Wireless product must support 6,12, and 24 Mpbs data rate as well as this can go up to 54 Mbps.	ü This is used in 802.11a wireless networking
802.11b	ü An IEEE standard support 11 Mbps of data rate and operating range between 2.4 GHz – 2.4835 GHz. This uses CSMA/CD for path sharing. These wireless devices suffer interference with other devices like, microwaves, codeless phones, etc which operate in same frequency.	ü This is used in 802.11b wireless networking
802.11g	ü These devices operate range between 2.4 GHz – 2.4835 GHz and support data rate of 54 Mbps in most of the devices. These devices are backward compatible with 802.11b devices. These standard support better security such as WPA (Wi-Fi Protected Access), WPA2 with pre shared key or RADIUS server.	ü This is used in 802.11g wireless networking, Routers, laptops,
802.11n	ü Latest IEEE standard which support bandwidth upto 600 Mbps. This standard support 2.4 GHz and 5 GHz band and backward compatible with 802.11a, 802.11b and 802.11g wireless standards.	ü This is used in 802.11n wireless networking, routers, laptops, PDAs and 802.11g and 802.11b devices which are compatible with 802.11n.
dBi	ü Decibel is the unit which measures the gain of wireless antenna.	ü Used in every standard due to its usage to measure the signal strength.
Antenna	ü Antennas are used to transmit and receive wireless signals from wireless bridge. Antennas are connected to bridge and bridge is connected to local area network.	ü Used in all standard.
Fresnel Zone	ü The area around the line of sight of WLANs which used to transmit signals between WLAN devices. This are should be free with disturbance for strong signals	ü Used in all the standards.
RADIUS	ü Remote Authentication Dial In User Service an authentication and accounting which used to authenticate dial in users usernames and passwords. This service is used by ISP (Internet Service Providers)	ü Used in all the standards when needed to authenticate.
WEP (Wired Equivalent Privacy)	ü This is a security layer which used by wireless network. WEP used shared key by source and destination devices to encrypt and decrypt communication.	ü PDAs, Wi-Fi areas, hotspots, WLAN, WPAN,
SSID (Service Ser IDentifier)	ü This is the public name which identifies the wireless network from other networks.	ü WLAN, WPAN, WMAN, etc.
PCMCIA (Personal Computer Memory Card International Association)	ü External peripheral device which is comes in size of a credit card. This can be fixed to laptops to get wireless connection.	ü Laptops, PCs
Access Point (A/P)	ü Help users to connect to WLAN or wired network. Mobile users are automatically shifted to next AP while they are on the move.	ü WLAN, WPAN, WMAN, etc.
WPA (Wi-Fi Protected Access)	ü Security mechanism better than WEP which provide better security.	ü WLAN, WLAN, WPAN, PDAs,
WLAN (Wireless Local Area Connection)	ü High frequency radio waves or infrared can be used for communication between nodes. In this Local Area Network used wireless transmission for communication.	ü
WWAN (Wireless Wide Area Network)	ü Similar to WAN except the implementation of wireless technology for communication. These enable users to interact with corporate email, applications and information as they do in the wired environment.	ü
WPAN (Wireless Personal Area Network)	ü With help of IrDA and Bluetooth we can communicate in a short distance such as 10m. This enabled personal area network which equipped with personal devices like, PDA, laptop and wireless printers, etc.	ü
WMAN (Wireless Metropolitan Area)	ü Wireless communication network which covers a metropolitan area which use multiple WLAN in the range of 50km.	ü
War Driving	ü This is a process of travelling around buildings to find out available wireless access points to gain access to networks and internet. Hackers use war driving to gain unauthorized access to corporate networks.	ü This can be used in any wireless network.

RFID Implementation.

RFID (Radio Frequency Identifier) is an interesting and booming technology in tracking, monitoring and administration in many industries. These RFID devices automatically transmit radio frequency which has a unique serial number for identification that particular devices uniquely. RFDI technology uses few main components in their architecture to provide complete and comprehensive system. Main components are RFID tag, Tag readers, RFID antennas, RFID controllers, RFID premises servers, and RFID integration servers.

RDIF architecture is shown in below diagram for better comprehension.

Implementation of RFID projects needs to be thoroughly planned and organized due to its nature of complexity, cost and needed expertise knowledge. First of all network administrator should have clearly identify the use case of RFID project. Planning, designing, and implementation of RFID project is based on the use case. Hence, meeting all the requirements of users is a great achievement but very difficult task for the implementer due to compatibility of hardware/software, environmental, budget, and organizational structural issues. When implementing RFID project minimum of below points needs to be adequately addressed.

Project objectives must be clearly defined and understood by the RFID team before hand doing anything. To understand clear objectives you need to identify why the organization is required to have RFID implementation, to serve what purpose. Whether it is trying to comply with some regulations or trying to improve productivity, efficiency or cost reduction in long run for their production environment or warehouse. This identification of reasons and setting objectives based on the facts you collected will help having smooth implementation process.

There should be a proper site survey to analyze the current infrastructure to identify places needs implementation of RFID. Selection of RFID product such as RFID tags, RFID readers, RFID antennas, etc need to be determined by the project team to suit the project budget. This is an area where there are lot of questions been rose. Your budget may not be enough to purchase required hardware devices such as RFID tags, RFID readers, etc with expected quality thus, this may leads to improper operation of devices when integrating, mismatch of your requirement or low quality of service. It is important to point out the disadvantages of having a fixed budget which cannot facilitate the organizational main purpose, thus get your budget approved for correct devices or else proceed with compromised budget, which is not recommended. On the other hand make sure your devices that are going to be purchased are well tested and have met quality and compliance standards in industry. There may be other RFID systems already in place in the organization or different system using radio frequency, in these conditions proper investigation should be carried out to identify the interferences that these existing systems may have on the RFID project you are going to implement.

Next step is to align your project to the organizational processes. Your organization’s business in the main concern, and this RFID implementation should benefit to the organization as a whole and improve the processes without adding burden. Due to new RFID implementation there may be a need to process/procedure realignments, adding new process/procedures, removing redundant processes/procedures, etc, which have to be well analyzed and adjusted to suit the business needs and implementation of RFID project.

Software configuration and integration of RFID devices play an important part in the RFID project. All the devices need to place in appropriate places as decided during the planning stage and configure software to connect all RFID devices and meet organization expectations. It is acceptable to start with the default configurations for general purposes applications. But fine tuning to get maximum accuracy and high performance needs well trained professional knowledge.

When all the things are in place monitor how interdependent components behave in the system. For instance all processes, equipments, software, and human aspect of the entire system needs to operate in collaboration to produce better result. Monitor all aspects to identify places where it needs adjustments to smooth the operation of RFID system to improve performance and efficiency.

One main aspect needs to address above all stages is education, awareness and training for users and manage the positive/negative resistance of users. People might have a misunderstanding of that implementation of RFID system will eliminate the human resources in the process which may results in loss of employment. If this situation cannot be managed diplomatically, this might result in a project failure with large amount of financial, and human resources wastage.

Applying RFID in real time or in line process just to serve the purpose of customer compliance is not going to give you a cost effective solution. But if the customer compliance is going to make huge difference in the market place than when it is not compliance, then the implementation is definitely going to give financial advantage. If the customer compliance is not going to add ad impact to your market place, then these are going to add some additional cost to the production due to its implementation of RFID tags. Thus, if the organization can find another a place where they can improve a production process, streamline warehouse operation, or improve logistic services, etc with the implementation of RFID system along with complying customer requirement, then the organization is reaping the true benefit of implementing RFID system.

Perimeter defense strategies employed on various segments for an internal network.

One of the main aspects of security is to avoid, minimized or defend malicious activities as soon as it detects or take action before hand as appropriate. If this tasks can be achieved from the boarders of your premises and reduce the impact of the risk to the organization, it is the best method. Even though many of us have not considered perimeter defense in-depth, it is becoming very valuable defending strategy for any organization during incident breaches.

Safe-guarding organizational perimeter is an art and a science, which needs to identify all possible perimeter breaches in all the possible angles and applying best solution which balance the financial commitment of the organization and the amount of the risk that the organization can tolerate.

As a beginning of the defense strategy we must analyze the organization’s assets and their importance to the organization’s operation. Thereafter we should analyze and identify the risk factors involved and their impact to the business. When we are preparing the defense strategy consider above analyzed factors and find a balance between them. Deferent departments have different requirements as the defense strategy differ.

Reception area is the mostly frequently exposed area to the general public and there are limited numbers of measures that we can take to restrict access to this area. But in this scenario will look at the internal access to the area rather than the outside access. All internal work forces have basically given privilege of accessing the area since they are trusted by the organization than general public. This privilege can be misused by the employees with malicious intention. Reception area is equipped with important customer contact details, head of departments personal contact details, and access to whole contact detail of all major contacts. If an unwanted individual access these information they can exploit those detail and gain very valuable information. Even misuse of equipments like business telephone lines, international call facilities, can be dangerous and could tarnish the reputation of the organization. To prevent such occurrences taking place this area should be protected even from the internal staff by restricting access to only necessary people, placing the equipments in a secure manner by partitioning the area or separating access from visitors and internal staff.

Finance department should have a more restricted movement of internal staff as well. All organization information is stored in the place and manipulation, copying, or deleting this information has very drastic impact to the business. This could even take down the whole operation of the business and keep the organization out of operation for few days or forever. Free movement to this area by general public is generally restricted by any organizations, thus very marginal consideration is given by access from internal staff. This area’s access privileges can be controlled by company security policies for internal and external people. On the other hand restricting access by means of access controls like finger printing, facial recognition, proximity cards, ID cards, door access systems and monitoring cameras could be useful.

One of the main departments in any organization is the information technology department. This needs to have very strong security defense in place to protect the information. This target can be fulfilled by the implementation of properly planned and tested defense system. Apart from the general security measures placed in other areas in the organization such as security cameras, finger printing and ID cards below measures can be placed. Special security policy for IT department, formal sanction process to penalized the breach of security policies, limit very restrictive permission for IT department, properly laid and practiced backup procedures, maintenance procedures, SLA (Service Level Agreements), training and education for internal staff to understand, practice and obey the IT rules and regulation, man-traps, etc.