Intruder Alert

By Raul Bernardino

Introduction:

The “Domain Names Systems (DNSs) are supporting the internet infrastructure to resolve the host names to the internet protocol (IP) or from IP to the host names,” (Davidowicz, D. (1999). The function of the DNS is similar to the telephone directory, in which is helping human being to easily memorize the host names rather than computer numeric addresses. The fundamental functions of the DNS are follows:

• Forward resolution: The forward resolution known as translating from host name in to the IP address
• Inverse resolution: The inverse resolution known as translating the IP address in to the host name

Initial the DNS is designed with a security embedded. It is public database and not restricted of the accesses. Therefore, it is vulnerable and the bad guy can be intercepted the message, as it shows in the below diagram:

How DNS Poisoning happen?

First of all DNS resolves the query internally then if it is not found, the DNS server will be passing the query to the other servers. The following server may contain wrong information and replying to the requested server.  Here is the caching of the poison happened as it shows in below diagram:

The host-1 is willing to browse 'ourdns.example.org'. The local server has not have the answer. The local server then passing the query to the other server and other server responding with the 'brokendns.exemple.org' information. It is now cached in the local server. From now on, anyone from the same network that request or browse the address of 'ourdns.exemple.org' the local server will be giving the wrong information. Here, we called DNS cache poisoning. The attacker can be used this opportunity to establish communication with the host-1 as the victim.

The attacker intentional formulate misleading information with the rogue server name as it shows in  the below diagram:

 The established communication called spoofing of the host name.

How to prevent?

To prevent and minimized the DNS cache poisoning, the network administrators are adding firewall, proxy, Gateways, and Intrusion detection system.

The firewall is isolating a private network to the internet connection in which to allow several packets to pass through and also block several packets, as it show in the below diagram:

The gateway or router firewall: The gateway application functions as follows:

• Filtering the packets on the application data as well as on the TCP/IP/UDP
•  Allowing several internal users to use telnet to communicate outsider as it shows in the below diagram:

The intrusion detection system (IDS) as follows:

•  Filtering Packets: The packet filters are operation on the TCP or IP headers and it is not related to the check among session
• IDS: The IDS has a deep inspection to the packets such as to identify the strings with the antivirus data-base and attack string. It is also examining the related packets over port scanning, network mapping, and Denial of the service attack

As it is shows in the below diagram:

In conclusion: DNS is designed to be a public data-base and have no security embedded. Therefore, we have to configure our network with firewall or router firewalls whereas to minimized the attacks and prevent the spam’s or viruses going to our network.

References list:

1.  Kurose, J.F. & Ross, K.W. (2010) Computer Networking: A Top-Down Approach. 5^th ed. Boston: Addison Wesley
2. University of Liverpool/Laureate Online Education (2011) Lecture notes from Computer Networking Module Seminar 7 [Online]. Available from: University of Liverpool/Laureate Online Education VLE (Accessed: 16  September 2011)
3.  Security in the Network, [Online]. Available from: http://www.informit.com/articles/article.aspx?p=31339&seqNum=2  (Accessed: 17 September 2011)
4.  Davidowicz, D. (1999), Domain Name System, [Online]. Available from: http://compsec101.antibozo.net/papers/dnssec/dnssec.html  (Accessed: 17 September 2011)

Data Structure

By

Raul Bernardino (Dino), B of Comp. Sc., MSc in ISM

Introduction:

Lists and Queues are enormously used in the operating systems whereas to control various tasks in different stages of the execution. These tasks are stored in the queues and it structured by first in first out (FIFO), (Brookshear, 2009:374). This operation is proper for certain application; however it is not use for controlling blocks in the operating system. The operating system much more efficient by using high priority task first or use simultaneously (lists).

[2] List in Data Structure:

A listing or computing is a data structure values that’s in sequence, where the same value can be occurred in more than one place. In computing or listing of data types can also view as model of mathematics, which has similar behavior for certain class of the data structures.  An instance of a value in the list is usually called an element.  In a listing, we can also make a link to the list of the data structure itself, where it consists of an order of data records.  The records are fields that contain an address to the next record in the sequence. This is allow us, to easily shorting a data, adding new data or insert new data and delete data, or easily moves data from list to other end.

A field of node contains information of next node calls a pointer. A first node is a HEAD of a list and the last node calls TAIL minus that node.

A circular link diagram

[5] A single link diagram

[4] A doubly link diagram

[3] Queue in Data Structure:

Queues in general as it pictured below is FIFO model. FIFO stands for First In First Out.

FIFO queue model

A queue is group whereas members are a collection of objects that keeps in the line. The elements can be only adding from the back and only deleting or removing from the front. Some examples are the queues in front of the cashier for the payment or deposits in the banks. The cashier will be only serving the first-in person in the queues. The queues also have a limited to the available of the rooms, places or buffers in the case of computing.

There are two term for queue which are overflow and underflow. The overflow is adding a new object to the full queue. The underflow is deleting object from an empty queues.

Some questions about memory mapping

#1.  Suppose a homogeneous array with 6 rows and 8 columns is stored in row major order starting at address 20 (base ten).  If each entry in the array requires only one memory cell, what is the address of the entry in the third row and fourth column? What if each entry requires two memory cells?

When data is stored in the rows, the major order of the rows are stored first horizontally in adjacent memory locations. When one row is stored, the next one is stored adjacent to the last entry in the previous row.

1 memory cell per item of the data

In the above scenarios, if the starting location was 20 the first row of data would be stored in locations of 20 to 27 and the second row would be stored in locations 28 to 35 and the third row would be stored between locations 36 to 43. The location of the 3^rd row and 4^th column would thus be 39

[6] 2 memory cells per item of data

In the above scenario the first row would occupy memory locations 20 to 35, the second row would be stored between locations 36 to 51 and the third row would be stored between locations 52 to 67. So the required entry would be stored in memory location 58 to 59.

#2. Describe a method for storing three-dimensional homogeneous arrays. What addressing formula would be used to locate the entry in the i^th plane, j^th row, and the k^th column?

Ordinarily, the values posed within the question would be stored within the computer memory in one of two ways (Row major order or Column major order). These are then grouped together within the computer’s memory. When this is done, we can refer to the location by specifying the row and column. For this exercise, we will also add the plane data for further location (a little like locating an object floating in a cube).

Therefore, if we suppose use the following formula:

X = Address of the cell containing the entry

For this exercise:

I = 4

J = 10

K = 11 (Represents the number of columns)

X + (K*(I – 1)) + (J – 1)

è X + (11*(4 - 1)) + (10 – 1) = 42

Answer = 42

The answer or information can then be translated through the use of software routines into locations within the computer’s memory. In this case 4,2.

Moreover, there are some related questions in the software engineering as follows:

#3.  Explain how the lack of metrics for measuring certain software properties affects the software engineering discipline.

Unlike the traditional engineering disciplines where concrete and quantitative, methods for verification of the product, software engineering isn’t blessed with such methods. These methods are called metrics and lack of them is a cause for various problems with software systems. The most immediate impact of the lack of quantitative metrics is the unreliable nature of the end product. Software that can’t be verified can never be sure to perform consistently under all possible operating conditions.

Unless suitable metrics are found for testing the validity of software to the same degree of effectiveness as other more traditional engineering disciplines it is going to be hard to argue the case for software engineering to be considered as part with traditional engineering disciplines. Brookshear [1] compares the current state of software engineering to the position mechanical engineering was in the early seventeenth century before Newton and others discovered the basic mathematical measurements for mass, acceleration and force and their interrelation.

Research in software engineering would have to focus on the discovery of similar fundamental principles which can be applied generically to all software development endeavors. At present most development projects are engineered from scratch.

Although the lack of quantitative metrics affects all aspects of software engineering but the following are perhaps affected more heavily.

Reliability

Software cannot be guaranteed to be reliable if all new projects are developed from scratch as all the mistakes are repeated again and again. The idea of building entire software systems from prefabricated modules using them as building blocks is the focus of much research and interest in the IT community.

Testing

Non existence of any quantitative measures for testing software results in systems rigged with errors which on occasions have caused catastrophic results and have come very close to total destruction. The big hurdle in the way is the intolerance of errors in software systems where software either functions properly without errors or produces the wrong results with the presence of the smallest of error (a missing expression or a wrong operator). It is the effort of eliminating the construction of primitives every time software is developed that is the goal of so many academic and commercial organizations.

Security

With the advent of distributed systems and the explosion in e-commerce and internet systems security has become a major issue is software systems. As software systems cannot yet be defined and tested for all their operating states it is impossible to plug every security hole in the system and discover every error that may exist.

Project Management

The unpredictable nature of software projects puts incredible strain on those tasked with managing the projects. They are often asked to make assumptions about the likely cost of developing a system before any design work has been done and as there exist no metrics for defining a project’s work breakdown structure and the effort associated with them.

Estimating

Software project estimation remains a work of art than a science due to the lack of metrics in the software engineering discipline.

#4. What is the difference between coupling and cohesion? Which should be minimized and which should be maximized?

Coupling refers to the connections between modules; cohesion refers to the connectivity within a module. On the surface, one would like to minimize coupling (because that leads to independent modules that can be maintained individually) and maximize cohesion (because that leads to modules whose activities can be more easily understood).

References:

[1] Brookshear, J. (2009) Computer Science: An Overview. 10th ed. Boston: Pearson Education, Inc.

[2] List or computing [Internet]. Available from: http://en.wikipedia.org/wiki/List_(computing)  (Accessed: 13 November  2010)

[3] Queue of data structure [Internet]. Available from: http://en.wikipedia.org/wiki/Queue_(data_structure) (Accessed: 13 November 2010)

[4] Double link list [Internet]. Available from: http://en.wikipedia.org/wiki/File:Doubly-linked-list.svg  (Accessed: 13 November 2010)

[5] Single link list [Internet]. Available from: http://en.wikipedia.org/wiki/File:Singly-linked-list.svg (Accessed: 13 November 2010)

[6] Multidimensional Array [Internet]. Available from: http://courses.cs.vt.edu/~csonline/DataStructures/Lessons/2DArrays/index.html (Accessed: 13 November 2010)

The use of Software Enterprise and Development in the Organization

By Raul Bernardino (Dino)

Abstract:

In average, many organizations are fallen into the trap of the software application features, its advertisement, based on incomplete information, and software provider persuasion (marketing staff’s skills). They (Institution, Organizations, Company, and Government entities) do not think twice to have and implement the applications immediately in their business environment. Moreover, Information Technology (IT) planners also contributed to the failure of IT implementation projects in organization. Most of IT planners without have enough soft skills such business analysis, leadership, risk management, change control, etc. that can helps to mitigate future system integration and its ward investment.

The larger or well-known organizations tend purchased and customized software enterprise for their business purposes from outsource. The small software enterprise company is most likely to purchase from big software industries. While others, may use several sources of the software enterprise to fulfill their needs.

It is important that the investment in the software enterprise application should be fitted into organization requirements and needs. The quality output of any software enterprise development is relatively varied. This is because, each of the individuals have a different interpretation on the result of software development. The involvement persons in developing or in buying will be giving a high mark on the software enterprise quality, while others who are not involved, will be marking with a low quality.

Since software enterprise and technology industries developed, many methodologies and approaches have been introduced. They are waterfall, spiral, prototypes methodologies, etc. Each methodology has its own advantages and disadvantages.

Introduction:

Software enterprise development is an increasingly persistent part of our daily lives. In the USA alone, the software products and services exceeded $140 billion in 1998 with more than 2 million software programmers employed. This includes not “only Microsoft or Oracle but within all IT departments in the USA” (MacCormack, 2001).

In the Timor-Leste alone has been introduced various software enterprise. Timor-Leste government has been invested in this sector with significant amount money. Let’s name several of them; Free Balance as finance core business application, Portals, e-procurement, etc. Many of them have different platforms whereas no scalability, no cross platform, no workflow, and open standard capabilities.   

In obtaining any software application for the organizations, the management or CEOs have to decide either to develop in house, to develop from outsources, or to purchase from the software industries.

The decision is based on the organizations’ needs and requirements which have been documented or gathered by business and system analyst.

Buy a Software Enterprise: 

In the largest organizations most likely software enterprise application tends to be both “custom developed and procured from outside sources. Small business software applications are most likely purchased. Others businesses may use various sources of the software applications to fulfill their own needs” (Hall and Fernandez-Ramil, 2007). According to Martin et al (2005) that the investment in the “enterprise system packages with integrated modules became a major trend by the late 1990s”.

There are several advantages of purchasing software enterprise application as follows:

1. Cost savings
2. Faster  implementation
3. A possibility of better support for generic business functions

The disadvantage of the purchasing software enterprise applications is the lack of an exact fit in with organizational needs as “building custom software can result in fewer trade-offs and a better fit to the company’s needs” (Martin et al, 2005). New purchasing software enterprise application may not have a scale-ability, cross platform and open standard capabilities; therefore, organizations will spend an additional cost for the training and users spend additional time to re-entry the same amount of data that have been in the system. 

Develop Software Enterprise:

The changing of the software application in organizations is based on the business operations’ needs - often to be a more competitive institution. For instance, repair the bugs and errors, adapt the application, and add new requirements.

The Software Changing Research Result Graph

Software Changing Research:

Sommerville (2004) described in his research on software changes, “error and repairs application is 17 percent, adapting software application 18 percent, and adding functionality or modifying the functionality of the software applications is 65 percent. The research found that the majority of software application changes are on system application modification and adjusting to the business requirement and needs.

“The size of the software and the complexity can grow very quickly, only limited by the productivity of the people developing the software and the capacity of the computer [on] which [it] will be executed” (Hall and Fernandez-Ramil, 2007:304).

 Software Development Quality:

 “The high quality means fitting to the project purposes and satisfying the expectation of the stakeholders and it is not cause damage to them. The external quality process is needed in order to improve the overall quality enhancement and it also creates secondary complimentary views on the system that embodied in the implementation” (Hall and Fernandez-Ramil, 2007:363).

 

The Software Quality Diagram

The internal factors of software quality are built in the modular, able to maintain, testable, re-useable, adjustable, interoperable, readable, and understandable. The process factors of software quality are able to improve, able to track, able to maintain, predictable, and repeatable.  The external factors are efficient compare to other system applications, the functionality of the system, and reliability of the system, adaptability, robustness, and accuracy.   

  

As organizations adopt new computer aided design technologies, “the development processes for many software products increasingly resemble those found in the software industry” (MacCormack, 2001). Therefore, IT managers and CEOs need to be aware of the methodologies for developing and deploying software products and services.

There are many methodologies and approaches below for the organizations to use. However, more important than any one methodology is how to use people and resources to create and maintain the software applications. The software development methodology details are explained below:

Traditional Models (Code and Fix Model):

Code and Fix diagram

This model is simple and has been commonly used. The advantages are you can start developing a software application with general or specific ideas. By using this method you do not need to hire an expert in planning, testing, or documentation. Anyone who has knowledge of coding can start writing codes. Unfortunately, since it has no documentation, we cannot assess the progress until it is completed. Additionally, this method does not fit a complex project.

 The waterfall Model:

Waterfall model

This model has highly structured features and sequential processes. We cannot develop tasks randomly; it has to follow the steps of the process. We have to complete all tasks in a stage (for example, stage 1) before moving on to the following stage (in this case stage 2). For instance, in this model, we have to complete all requirement specification and verification before moving on to the software design stage.

The Sashimi (Waterfall with Overlapping Phases) Model:

Sashimi Model

This model is adopted from Japan and is named for a Japanese style of presenting sliced, raw fish. This model has overcome some of the weaknesses of the waterfall model. For example, you may start software design before considering the requirements, which brings some flexibility to the development of the software application. However, this model may cause confusion in the other phases, is not particularly efficient, and can leave developers guessing at the overall progress, or even the progress of the individual stages.

The Waterfall with Sub-projects Model:

Sub-project Model

This waterfall with sub-project model is even better in architecting the logical dependence in the subsystem development. This model allows parallel planning in the waterfall model. However the weakness of this model is the possibility of unforeseen inter-dependency among sub-projects.  

 The Spiral Model:

Spiral Model

This is an incremental model of developing a software application. The first process starts from center position and moves clockwise across the area. The first circle, or transversal, is for requirement planning. Each circle has planning, evaluation, risk analysis, and engineering or prototypes. “The first round is the stage of feasibility study. The second round is [for the] concept of the operations. The third round is the top level requirements specification”, (Boehm, 1998:65-69).  Each loop represents a phase of the process. For instance, the inner loop may be feasibility, the next loop requirement, the following loop design, etc. Bear in mind that development in each cycle has to exercise the risk analysis. As soon as the design stage begins, we have to create the testing plan and user documentation. 

 The Staged Delivery Model:

Staged Delivery Model

The staged delivery model defines specification with delivery stage. The entire product design specifies that development should take place in the early stages. The advantage of this model is that the user or customer gets functionality earlier than in other models. You have to be careful, however, in the planning and design phases. For instance, component B is schedule for stage 3 but needs to be included in stage 2. 

The Prototyping Model:

Prototype Model

This model’s principle is to help customers and developers understand the system requirements. It includes back to back testing, detection and identification of missing or confusing services, and development of a prototype as a basis for delivering a system specification and working system early available in the process.

The Hybrid Model:

 In the development of the large or complex system we may use several models simultaneously. A prototype may be used for high risk assessment. The waterfall can be used for developing systems that are well understood, and life cycle can be used to determine the organization of the software.

The Agile Model:

The agile model provides several approaches such as an Adaptive Software

 Development (ASD), Crystal methods, Dynamic System Development Methods

 (DSDM), eXtreme Programming (XP), Feature Driven Development (FDD), Lean

 Development (LD), and Scrum models. Here, we will focus on ASD and DSDM.  The

 ASD life cycle focuses on developing working software one small piece at a time. The

 customer describes the functionality and features of the system and developers 

develop it at each stage. The diagram below shows the ASD life cycle.

The ASD Life Cycle Phases Model

The DSDM provides an overall framework of the software project developments. The principles of DSDM are users’ involvement and business rules, team decisions; focus on frequent product delivery, iterative and incremental development that fits the business purposes, reversible changes, and baseline requirements for software development, integrated testing throughout the system, and collaboration and cooperation between all stakeholders. The diagram below shows the DSDM method.

  

The DSDM method adopted from (Highsmith, 2002a) Model       

The Developer:

The developers during developing software are using several software processes model. The fundamental concept of the software engineering is the SDLC, which is stand for Software Development Life Cycle. The life cycle of software development is developing, using, and maintaining. The common pattern of the industries is products. The only differences are industries production for maintenance is repair process while in the software production, the maintenance is upgrading or updating or correcting.

There are lot of methodology and approach as mentioned above for developing enterprise software. However, there are two common software engineering methodologies that developer and software industries use to use. They are Waterfall and Spiral model.

The Waterfall methodology is providing a linier and sequential or step by step move forward development. As the matter of fact developer is developing software with phase by phase, likewise water is running from high level to low level and it will never go back.

For instance, developing software by using waterfall methodology as follows:

Requirement engineering: The system developer will elicit all requirements in the steps which are to be developed. As other model of processes, those requirements need to put into the functions and challenges that system need to fulfill. It includes analyzing the end user needs.

System design: System designer is involving in the architecture of design and the system has to be proper. In this section, it has to be a system definition, selection of hardware platform, operating system etc.

Software design: The software design is based on the system architecture in which can be defined software blocks and break it down into the code modules. The describe interface and interactive modules including functionality for instant system state, start up, shutdown, output, and error conditions.

Coding: The code is based on software design document. The developers are starting code the unit in small part of the system functions. They (units) are stand alone and later to integrate in software package form.

Software Integration and verification: In this section, each unit that has been developed, it needs a testing of the functionality. Verify each unit is meeting the requirements.

System Verification: In this section, verification for whole system is needed; it includes verifying the original hardware and environment.

Operation and Maintenance: In this part the developer handover to the user to test if all requirements are met the need or otherwise to need change to meet customer needs.  In this stage of waterfall methodology is never ending.

Weakness of waterfall method:

• It is very important to put to gather all possible requirements at the first stage.
•  Iteration only happen in the same stage
• There would be very big maintenance at last stage

While in the Spiral method the process is staring for the center position and move across area clockwise.  The first traversals maybe place for requirement and planning.

• Planning : to define recourse, milestone, and schedule
• Evaluation: in this section developer is evaluating and analyzing all requirements and determine goal and task. It includes defines all possible alternatives.
• Risk analysis: In this section, the developer is to asses both management and technical risk
• Engineering: In this section, developer design and implement one or more prototypes or sample of application.

The software purchase or development decisions are based on several criteria such as available information from elicitation, being able to predict future features, available technology, and the scientific development. Purchasing or developing software applications is also based on having sufficient knowledge in the field.

In the situation where the decision is made to buy a system application, the outcome may be that it will not fully fit with the business’ requirements and needs. While, on the other hand, a decision made for developing a software application may take more time to develop.

There are situations where a group decision is necessary. For instance, if the decision involves, the imposition of regulations, technology specification, or lack of available knowledge, the organization will need to come to an agreement. The diagram below shows the differences between software development and purchase.

Build or buy decision making Diagram