What are the security problems faced by a network?

Making mistakes concerning the network security is very common. The same mistakes are repeated again and again. These problems cannot be solved without changing our working methods. In this article we discuss about some common security problems that are faced by a network.

ØUsing weak and non-complex passwords for accessing the network: 

- Brute forcing is an old school exploit to which many of the system network administrators are open to. 

- The very famous captcha technology has been implemented for correcting this vulnerability of the network security passwords. 

- In the common captcha, the user is required to type in the digits or the letters that are displayed on the screen in some sort of distorted image. 

- This technology has been designed to prevent the network to be accessed by unwanted internet bots.

- However, this is not as safe as it looks. 

- It just gives a false sense to the network admins for countering the brute forcing. 

- Complex password is the solution for this problem. 

- For creating a complex password, more than seven characters need to be combined with special characters and numbers. 

- Apart from the creation of the complex passwords, a password expiration system has to be implemented. 

- This system is for reminding the users for changing their passwords. 

- Also, care should be taken regarding the reuse of the passwords. 

- Cycling of the passwords should not be allowed.

Ø Using server application or software that is outdated: 

- The patches are released by the companies from time to time for ensuring that the system does not become vulnerable to the various threats. 

- Also, new exploits and threats are posed by the hackers that can harm the network if the patches are not properly used. 

- For ensuring the network administrator is kept informed of the new threats, the software or the applications have to be updated regularly.  

Ø Web cookies: 

- Even though the viruses and malware cannot be introduced in to the network through cookies, these cookies can be tracked by some third party cookies for compiling the records of the browsing histories of the individuals. 

- The cookies that are not encrypted pose a major threat because they make the system vulnerable to the cross site scripting (XSS) attacks, thus putting your privacy at risk. 

- The open cookies can provide access to the cookies with the log-in data which can be used by hackers for intruding in to your systems. 

- The solution to this problem is to use the encrypted cookies along with an encoded expiration time. 

- The admins might ask the users to re-log-in before accessing important network directories.

Ø Plain hashes: 

- Hashing is the technique used for indexing and retrieval purposes in the database. 

- In most of the encryption algorithms, the plain hashes are mostly used. 

- A type of encryption is the salt that might be added to the hashes for making the creation of a look-up table that might assist the brute force or directory attacks extremely difficult or let’s say almost impractical. 

- But this works only when large salt is used. 

- Usually a pre-computed look up table might not be used by the attacker in exploitation of the network. 

- This makes the network security system even more complex.

- So even if the attacker is able to break into your system, he won’t be able to access the information from the database. 

- The encryption key should be kept hidden.

Ø Shared web hosting: 

- This service is used by the websites that reside on one same server. 

- Each site is given its own partition. 

- This is economically feasible for most of the systems. 

- But here if the attacker breaches in to system of one website, he can get into other website’s security systems too. 

Explain the technique of admission control to control congestion in virtual circuit subnets?

- Virtual circuits can be thought of as a virtual channel in the telecommunication networks as well as computer networks. 

- Virtual circuit sub-nets represent a communication service that is connection oriented. 

- This service is used through the packet mode communication.

- A stream of data bytes can be exchanged between the two nodes only if a virtual circuit has been established between them. 

- Without the presence of the higher level protocols, data division has to be dealt with unnecessarily. 

- Therefore, the virtual circuits always allow the high level protocols. 

- There is a resemblance between the circuit switching mode and the virtual circuits because of the fact that both of them are based up on connection. 

- The packets that are transmitted through a virtual circuit sub-net consist of a circuit number and not the destination address. 

- This is why the memory requirement of the packets is less when using virtual circuits and more in the others. 

- This also makes the virtual circuit sub nets less expensive when compared to other sub nets. 

In this article we discuss about the technique for congestion control in virtual circuit sub nets. 

- One most popular technique is of the admission control. 

- Most of the congestion control methods are based up on an open loop i.e., the congestion is prevented rather than managing it after it has occurred. 

- Admission control is a dynamic method for controlling the congestion problems in the virtual circuit sub nets. 

- Admission control technique has been widely accepted for preventing the congestion problem from getting worse over the time. 

- The technique is based up on a very simple idea which is that no virtual circuit is set up until and unless the congestion problem that was detected has been resolved. 

- Therefore, any attempt that is made for establishing a new virtual connection with the transport layer is failed. 

- The things get even worse if the access is granted to more and more people. 

- Simplicity of the technique is one of its characteristic that makes it easy to be implemented. 

- The technique can be implemented in a straightforward manner. 

- The admission control technique is also used by the telephone systems for combating with the congestion problems. 

- The admission control technique is implemented whenever a switch in the network gets overloaded. 

- At this time no dial tone is heard. 

- Establishing new virtual connections represents another way of coping with this problem. 

- Here, the new connections have to be routed carefully such that there are no problems. 

Another method for eliminating the problem of congestion is to strike an agreement between the virtual circuit subnet and the host. 

- By this we mean establishing a new virtual circuit. 

- But this arrangement requires specifying how the traffic has to be shaped and what would be its volume, QoS (quality of service), other parameters and so on. 

- The virtual circuit sub net has to reserve the resources on its part of the agreement established. 

- These resources lie on the route where the virtual circuit has been established. 

- The resources might include the following:

Ø  Space in the router’s buffer.

Ø  Tables

Ø  Bandwidth of the lines and so on.

- The newly virtual circuits are less likely to experience the congestion problems. 
- This is because to them the availability of the resources has been guaranteed.
- Resources can be reserved in this way only if the existing sub nets are experiencing congestion problem or when the standard operating procedure is being followed. 
- One disadvantage of the admission control technique is that it leads to the wastage of the resources. 
- Also, sometime the bandwidth is left unused. 

What are different policies to prevent congestion at different layers?

- Many times it happens that the demand for the resource is more than what network can offer i.e., its capacity. 

- Too much queuing occurs in the networks leading to a great loss of packets. 

- When the network is in the state of congestive collapse, its throughput drops down to zero whereas the path delay increases by a great margin. 

- The network can recover from this state by following a congestion control scheme.

- A congestion avoidance scheme enables the network to operate in an environment where the throughput is high and the delay is low. 

- In other words, these schemes prevent a computer network from falling prey to the vicious clutches of the network congestion problem. 

- Recovery mechanism is implemented through congestion and the prevention mechanism is implemented through congestion avoidance. 

- The network and the user policies are modeled for the purpose of congestion avoidance. 

- These act like a feedback control system. 

The following are defined as the key components of a general congestion avoidance scheme:

Ø  Congestion detection

Ø  Congestion feedback

Ø  Feedback selector

Ø  Signal filter

Ø  Decision function

Ø  Increase and decrease algorithms

- The problem of congestion control gets more complex when the network is using a connection-less protocol. 

- Avoiding congestion rather than simply controlling it is the main focus. 

- A congestion avoidance scheme is designed after comparing it with a number of other alternative schemes. 

- During the comparison, the algorithm with the right parameter values is selected. 

For doing so few goals have been set with which there is an associated test for verifying whether it is being met by the scheme or not:

Ø  Efficient: If the network is operating at the “knee” point, then it is said to be working efficiently.

Ø  Responsiveness: There is a continuous variation in the configuration and the traffic of the network. Therefore the point for optimal operation also varies continuously.

Ø Minimum oscillation: Only those schemes are preferred that have smaller oscillation amplitude.

Ø Convergence: The scheme should be such that it should bring the network to a point of stable operation for keeping the workload as well as the network configuration stable. The schemes that are able to satisfy this goal are called convergent schemes and the divergent schemes are rejected.

Ø Fairness: This goal aims at providing a fair share of resources to each independent user.

Ø  Robustness: This goal defines the capability of the scheme to work in any random environment. Therefore the schemes that are capable of working only for the deterministic service times are rejected.

Ø  Simplicity: Schemes are accepted in their most simple version.

Ø Low parameter sensitivity: Sensitivity of a scheme is measured with respect to its various parameter values. The scheme which is found to be too much sensitive to a particular parameter, it is rejected.

Ø Information entropy: This goal is about how the feedback information is used. The goal is to get maximum info with the minimum possible feedback.

Ø Dimensionless parameters: A parameter having the dimensions such as the mass, time and the length is taken as a network configuration or speed function. A parameter that has no dimensions has got more applicability.

Ø Configuration independence: The scheme is accepted only if it has been tested for various different configurations.

Congestion avoidance scheme has two main components:

Ø  Network policies: It consists of the following algorithms: feedback filter, feedback selector and congestion detection.

Ø  User policies: It consists of the following algorithms: increase/ decrease algorithm, decision function and signal filter.

These algorithms decide whether the network feedback has to be implemented via packet header field or as source quench messages.

Explain the various techniques for Deadlock Prevention

Deadlocks are like a nightmare for the programmers who design and write the programs for the multitasking or multiprocessing systems. For them it is very important to know about how to design programs in such a way as to prevent the deadlocks. 

Deadlocks are a more common problem in the distributed systems which involve a use of the concurrency control and distributed transactions. The deadlocks that occur in these systems are termed as the distributed deadlocks. 

It is possible to detect them using either of the following means:

1. Building a global wait for graph from a local one through a deadlock detector.

2. Using distributed algorithms such as the edge chasing.

- An atomic commitment protocol similar to a two phase commit is used for automatically resolving the distributed deadlocks. 

- Therefore, there is no need for any other resolution mechanism or a global wait for graph. 

- But this is possible only in the commitment ordering based distributed environments. 

- For the environments that have 2 – phase locking, a similar automatic global deadlock resolution takes place.

- There is another class of deadlocks called the phantom deadlocks. 

- These are the ones detected in the system because of some internal delays but they actually do not exist during the detection time.

- Today, their exist a number of ways using which the parallelism can be increased where otherwise severe deadlocks might have been caused by the recursive locks. 

- But like for everything else, this also has a price.

- You either have to accept one of these or both i.e., the data corruption or the performance/ overhead. 

- Preemption and lock–reference counting, WFG or wait – for graph are some of the examples of this. 

- These can be followed either by allowing for the data corruption during the preemption or by using version.

- Apart from these heuristic algorithms and the algorithms that can track all the cycles causing the deadlocks can be used for preventing the deadlocks.

- These algorithms even though they don’t offer 100 percent parallelism, they prevent deadlocks by providing an acceptable degree of the performance overhead versus parallelism. 

This example will make it clearer: 

- Consider at a crossing junction there are 2 trains approaching each other. 

- Their collision can be prevented by some just-in-time prevention means. 

- This mean can be person at the crossing having a switch pressing which will allow only one of them to cross on to the succeeding track super passing the other trains that are also waiting. 

- There are following two types of deadlocks:

1. Recursive locks: In such locks, only one thread can pass through it. Any other threads or processes entering the lock need to wait for the initial one to pass through after its task is finished.
2. Non – recursive locks: Here only once a thread can enter the lock. If the same thread again tries to enter the lock without unlocking it, a deadlock can occur.

- There are issues with both of these. 

- The first one does not provides distributed deadlock prevention and the latter one has no concerns for the deadlock prevention. 

- In the first one, if the number of threads trying to enter the lock equals the number of locked threads, then one of the threads has to be assigned as the super one and then only one can execute it till completion. 

- After the execution of the super thread is complete, the condition reverts back from the recursive lock and the super thread removes its status of being super thread and sends a notification to the locker that the condition has to be re-checked. 

What is Cleanroom Software Engineering?

Cleanroom software engineering is one of the fastest emerging software development processes and has been designed for the production of the software systems and applications with a reliability of certificate level. The credit for the development of this process goes to Harlan Mills and a couple of his colleagues among which one was Alan Hevner at the IBM Corporation. 

What is Cleanroom Software Engineering?

- The cleanroom software engineering is focused on defect prevention rather than their effective removal. 

- The process was named so since the word cleanroom evoked the sense of cleanrooms that are used by the electronics industry for preventing the defects from entering the semiconductors during the fabrication process. 

- The first time when the cleanroom process was used was in the late 80s. 

- This process began to be used for military demonstration process in the early 1990s. 

Principles of Cleanroom Approach

Cleanroom process has its own principles which we have discussed below:

1. Development of software systems and applications based up on formal methods: Box structure method is what that is used by the cleanroom development for specifying and designing a software product. Later, team review is used for carrying out verification of the design i.e., whether it has been correctly implemented or not.
2. Statistical quality control through incremental implementation: An iterative approach is followed in the cleanroom software engineering process i.e., the software system is evolved through increments in which the implemented functionality gradually increases. Pre–established standards are used for measuring the quality of all the increments for making verification that the process is making acceptable process. In case the process fails to meet the quality standards, testing of the current increment is stopped and the process is returned to the designing phase.
3. Statistically sound testing: Software testing in cleanroom development process is carried as a disguise of a statistical experiment. A subset that represents software’s i/p and o/p trajectories is selected and then subjected to testing. The sample so obtained is  then considered for statistical analyzation so as to get an estimation  of the software’s reliability and level of confidence.

Features of Cleanroom Software Engineering

Software products developed using the cleanroom software engineering process have zero defects at the delivery time. Below mentioned are some of the characteristics features of the cleanroom software engineering:

1. Statistical modeling
2. Usage scenarios
3. Incremental development and release
4. Separate acceptance testing
5. No requirement of unit testing and debugging
6. Formal reviews with verification conditions

The defects rate was recorded as follows:

1. <3 .5=".5" and="and" delivered="delivered" kloc="kloc" o:p="o:p" per="per">

2.7 Per KLOC between first execution and first delivery.

Basic technologies thus used can be listed as:

1. Incremental development: Each increment is carried out from end – to – end and in some cases there is overlapping development of the increments. This whole process takes around 12 – 18 weeks and partitioning though being critical proves to be difficult.
2. Function – theoretical verification: A parser may check the constructed program for syntax errors but it cannot be executed by the program developer. Verification conditions drive the team review for verification. Verification is improved by 3- 5 times than debugging. Formal inspections also fall under this category.
3. Formal specifications: This further includes:

a)    Box structured specification: It includes 3 types of boxes namely:

Ø  Black box

Ø  State box

Ø  Clear box

b)    Verification properties

c)    Program functions

4. Statistical usage testing: It helps in implementing cost effective orientation and process control. It provides a stratification mechanism to deal with situations that are critical. 

Team Software Process (TSP) - TSP Quality Management

Team Software Process (TSP) shows teams how to manage quality, teams must establish quality measures, set quality goals, establish plans to meet these goals, measure progress against the plans, and take remedial action when the goals are not met.

ELEMENTS OF TSP QUALITY MANAGEMENT

- Preparing a quality plan.
- Identifying quality problems.
- Finding and preventing quality problems.

PREPARING A QUALITY PLAN
TSP make a quality plan based on the estimated size of the product and historical data on defect injection rates, they estimate how many defects they will inject in each phase. Once the engineers have estimated the defects to be injected, they estimate defect removal,again using historical data or the TSP quality guidelines which are based on the yield for each defect removal phase. Once the injection and
removal estimates have been made, the team can generate the quality plan.

IDENTIFYING QUALITY PROBLEMS
TSP provides many quality measures one of them being is by comparing the data for any module or component with the quality plan. TSP introduces a series of quality measures like: Process quality index—PQI.
- Percent defect free—PDF: Comparing the PDF curves for several similar projects. Where there are problems, the quality manager can look at data on lower level components to identify the source of the problem and recommend what the team should do about it. PDF plot can only be produced for an overall system or large component.
- Defect-removal profile: The defect-removal profile can be drawn for the system, each of its subsystems, any component, or even down to the module level.
- Quality Profile: The quality profile measures the process data for a module against the organization’s quality standards. The five quality profile dimensions indicate module quality based on data for design, design reviews, code reviews, compile defects, and unit test defects.
- Process quality index—PQI: is produced by taking the product of the five dimensional values of the quality profile to produce a single quality figure of merit. With PQI values above about 0.4, program modules are generally defect free.

FINDING AND PREVENTING QUALITY PROBLEMS
The TSP quality measures can indicate likely quality problems even before the first compile. Once the problems are identified, they can be prevented by:
- Monitor the module during test to see if problems are found and then determine the remedial action.
- Reinspect the module before integration or system test.
- Rework on the module to fix suspected problems.
- Redevelop the module.