Design and implementation of network activity monitoring sysytem. (a case study of anambra state fedral inland revenue services, f.i.r.s)

Thesis Overview

<p> </p><p>INTRODUCTION<br>Attacks on computer by outside intruder are more publicized but the ones<br>perpetrated by insiders are very common and often more damaging. Insiders<br>represent the greatest threat to computer security because they understand their<br>organization’s business and how their computer systems work. They have both<br>the confidentiality and access to perform these attacks. An inside attack will<br>have a higher probability of successfully breaking into the system and<br>extracting critical information. The insiders also represent the greatest challenge<br>to securing the company network because they have authorized level of access<br>to the file system.<br>In a quest for maximum profitability in a network, there is need to monitor the<br>activities performed such that the network activity in a real time would be<br>tracked, confidential information safeguarded and control over the daily<br>activities of every staff established. The question is: which and how would one<br>develop the so much needed system that would exhibit all these potentialities?<br>Network activity monitoring system is used to detect inside threats by<br>monitoring file access and process activity (Behr et al, 2009). It is a powerful<br>tool that allows one to track any local area network, giving you the most<br>detailed information on when, how and what your network users do on daily<br>basis. If it is a library public network, university or commercial organization<br>network, Activity Monitor offers efficient control. This work targets the<br>monitoring of every activity of a user in a computer network and maximizes the<br>security for the organization or corporate body.<br>2<br>1.1 BACKGROUND OF STUDY<br>The Federal Inland Revenue service (FIRS) is one of the federal ministries<br>charged with the responsibility of accessing, collecting, and accounting for the<br>various taxes to the federal government since 1943.<br>Tax revenue has been reliable from time, from where government rely for<br>decision making, and aids for development and administrative planning, hence<br>the need for optimum human resource of the organisation or ministry; for it’s<br>considered to be their most valuable asset if properly harnessed and are well<br>motivated to perform their assigned tasks so as to enhance the organisations<br>goals and objectives.<br>Computer network activity monitoring system has become one of the vital tools<br>in providing evidence in cases such as computer misuse and fraud. Computers<br>and other devices are being used increasingly to commit, enable or support<br>unwanted activity perpetrated against individuals, organizations or assets.<br>Although it is most often associated with the investigation of a wide variety<br>of computer crime, network activity monitoring system may also be used in<br>civil proceedings. The discipline involves similar techniques and principles<br>to data recoveryand a lot of information is retained on the computer than most<br>people realize. It’s also more difficult to completely remove information than it<br>is generally thought. For these reasons (and many more), network activity<br>monitoring system can often find evidence or even completely recover lost or<br>deleted information, even if the information was intentionally deleted.<br>This system consist of two tier application – server and client whereby the<br>activity monitoring server can be installed in any computer in the entire local<br>area network and the client which is the remote spy software is installed on all<br>the computers on the network to be monitored.<br>3<br>1.2 STATEMENT OF PROBLEM<br>The existing system used by FIRS has been a challenge to them. Amongst the<br>problems affecting the FIRS from maintaining a steady reliable accounting<br>figures and estimates are:-<br>With the current system, staffs easily erase or add data in order to cover<br>up their fraud since there is no back up of the activity log. Frauds like<br>computer fraud: – loss or damage to money, securities resulting directly<br>from the use of any computer to fraudulently cause a transfer of money or<br>other property from inside the premises to a personat a place outside the<br>premise.<br>Their method of operation is not so efficient for both units in the<br>department (Operations and Reconciliation units).Both units cannot work<br>at the same time, and this is because the staffs in one of the unit<br>(reconciliation unit) has to wait for the staffs in the other unit (operation<br>unit) to get their work to some extent before they can process their own<br>work, and while they are processing their own work, the staffs in the<br>operation unit has to pause their work a little,and with this manual of<br>operation in the department, rooms for corporate fraud is being created.<br>These are the more reasons, why the researcher embarked on this research.<br>1.3 OBJECTIVES OF STUDY<br>This project targets towards discovering what should be done to improve the<br>existing system, monitoring the daily activities of every user in a network and<br>using it to provide evidence to frauds or crimes committed using computer<br>technology which some people referred to as digital crime; that is crime<br>committed using a computer system.<br>The objective of this work is to develop a system that should be able to;<br>4<br>1. Monitor the daily activities of every user in a network in real time.<br>2. Detect active users.<br>3. Provide accurate evidence on corporate fraud when investigation is being<br>carried out in an organization.<br>4. Has a good memory management for efficient carrying out of activities.<br>1.4 SIGNIFICANCE OF STUDY<br>This work was embarked upon for several reasons discussed below and again<br>provides answers to some questions like:<br>What is the value in adopting an investigation system?<br>Why should you invest time and money on this?<br>What are the benefits to organisations?<br>Therefore some of the significance and benefits of this work include:<br>Increased employers loyalty: -What ultimately creates the employers<br>loyalty is meeting and exceeding their expectation.<br>Maintaining system integrity.<br>Staying current on work status so as to know how well the organisation is<br>going.<br>Ensure proper handling of investigation in computing:This is the reason<br>why we need a careful, methodical process for gathering digital data in<br>the first place; and this is why we need network activity monitoring<br>system.<br>Increased employer’s retention:-The employees are an investment.<br>Generally, it takes nine to twelve months or longer before an employee is<br>a productive asset to a company. If an employee leaves after a year or<br>two, the company has lost most of its investment.<br>5<br>Information empowered decision making: -Most managers, executives<br>and employers make decisions based upon all relevant information. There<br>are some actions that can have a profound effect on corporate decision<br>making; those actions are more easily justifiable when you have easily<br>accessed the users system.<br>1.5 SCOPES OF THE STUDY<br>Although a network activity monitoring system involves many things and<br>activities that can be run within it, yet due to lack of time and space, we were<br>not able to use this software in other operating systems apart from windows<br>operating system (that is from windows XP to windows operating system of<br>higher versions). Furthermore this work did also not involve internet<br>connectivity as well as detection of virus in a network.<br>1.6 LIMITATIONS OF THE STUDY<br>During the course of this study, many things militated against its completion,<br>some of which are;<br>Lack of finance<br>Refusal of the Federal Inland Revenue Services Awka, to give detailed<br>answers and in some cases no answer at all to some questions.<br>This project is limited to all the data associated with the information<br>gotten from the Federal Inland Revenue Service commission, and due to<br>time factor, not all the commissions were reached for sources of data and<br>information.<br>6<br>1.7 DEFINITION OF TERMS<br>NAMS (Network activity monitoring system): This is the system that is<br>used monitor the daily activity of every user on a network<br>Corporate fraud: This is the fraud committed by insiders in a large,<br>publicly traded (or private) corporation, and/or by senior executives.<br>Real time: Occurring immediately, this is used for such task as<br>navigation, in which the computer must react to a steady flow of new<br>information without interruption.<br>LAN (local area network): This is computer network that spans a<br>relatively small area. Most LANs are confined to a single building or<br>group of buildings.<br>Suid: A file attributes which allows a program to run as a specific user no<br>matter who executes it.<br>Corporate decision making: This is connected with a corporation, this<br>involves the image of a company or organization where all its members<br>involve taking critical decision making (finance/planning/strategy)<br>Internal Auditor: An employee of a company charged with providing<br>independent and objective evaluations of the company’s financial and<br>operational business activities, including its corporate governance.<br>Internal auditors also provide evaluations of operational efficiencies and<br>will usually report to the highest level of management on how to improve<br>the overall structure and practices of the company<br>External Auditor: An external auditor is an audit professional who<br>performs an audit in accordance with specific laws or rules on financial<br>statements of a company, government entity, other legal entity or<br>organization, and who is independent of the entity being audited.</p><div><div></div></div><br> <br><p></p>