Theory Assessment
Computer networks (administration) 1


ICAITU127B Support system software
ICAITS032B Provide network system administration
ICAITS112B Optimize system performance
ICAITS115B Maintain equipment and software in working order



Question 1: What are the tasks that the network administrator is required to perform?

Generally, a network administrator needs to include the following areas of responsibilities in the job description:

a. In relation to the management of network software, the administrator is responsible for:
Maintaining the network system’s software
Creating and management of system files
Manage the system usage
Monitor system security
Carry out system back-up and restore functions

b. For the management of the network, the administrator is responsible for:
Management of staff access and security
Input into and dissemination of disaster recovery plan
c. For quality assurance, the system administrator is responsible for:
Monitoring of the network performance
To be proactive in the identification of areas of poor performance for corrective action
To proactive in the investigation of better methods to improve performance
Fine tune system for optimal performance

d. For systems maintenance, the administrator is responsible to provide the following service to the organization:
Equipment maintenance requirements
Diagnosis of system faults and manage the repair of the fault
Documentation of the maintenance of equipment and formation of proposals to management for the maintenance plan of the system.

e. Additionally (reference: http://en.wikipedia.org/wiki/System_administrator), the system administrator is responsible for:
Applying operating system updates, and configuration changes
Installing and configuring new hardware/software
Answering technical queries
Responsibility for documenting the configuration of the system
Troubleshooting any reported problems

In larger organizations, some of the tasks listed above may be divided between different system administrators. For example, there may be a dedicated individual or group responsible for testing and applying system upgrades.

In smaller organizations, the system administrator can also perform any number of duties elsewhere associated with other fields:
Technical support
Database administrator (DBA)
Network administrator/analyst/specialist
Application analyst
Programmer

System administrators also tend not to be system architects/system engineers/system designers, although these duties are sometimes given to them, too.

In smaller organizations, IT/computing specialties are less often set out in detail, and the term "system administrator" is used in a rather generic way — they are the people who know how the computer systems work and can respond when something fails.


Question 2: What are the maintenance options available to the system administrator?

On-site response
Remote diagnostics
Web based diagnostics
Return to depot
24x7 hours support
On-line real-time support
Business hours only support
Telephone support
Second level support



Question 3: Briefly discuss the general features you need to include in a Password Policy for your organisation.

1. Overview In this section, a briefing on the significance of the concept of a password policy in relation to computer security
2. Purpose defines the objectives of the policy. i.e., to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change
3. Scope describes the range of coverage of the document, i.e. all individuals who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides in the organization, has access to the organization’s network, or stores any non-public organization information.
4. Policy The following sub-sections are included:
4.1 Standard User Accounts
Once this policy becomes effective, all users will have a mandatory one time password change.
All user-level passwords (e.g., email, web, desktop computer, etc.) will be audited by ITS with password cracking software every six months. The accounts that fail the password audit will be required to change their password at that time. ITS recommends that passwords be changed every six months.
Passwords must not be inserted into email messages or other forms of electronic communication.
All user-level and system-level passwords must conform to the guidelines described below.
4.2 Admin Level Accounts
All Administrator-level passwords (e.g., Help Desk, root, enable, MS Windows admin, application administration accounts, etc.) must be changed on at least a quarterly basis.
All production system-level passwords must be part of the ITS administered Active Directory Database (with the exception of legacy systems).
User accounts that have system-level privileges granted through group memberships must have a unique password from all other accounts held by that user.
4.3 Guidelines
General Password Construction Guidelines
Passwords are used for various purposes: user level accounts, web accounts, email accounts and screen saver protection logins.
Since it is easy to guess or crack certain types of passwords, everyone should be aware of how to select strong passwords.
Poor, weak passwords have the following characteristics:
The password contains less than eight characters
The password is a word found in a dictionary (English or foreign)
The password is a common usage word such as:
Names of family, pets, friends, co-workers, fantasy characters, etc.
Computer terms and names, commands, sites, companies, hardware, software.
The words "….. [organization name or Alias]
Birthdays and other personal information such as addresses and phone numbers.
Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
Any of the above spelled backwards.
Any of the above preceded or followed by a digit (e.g., secret1, 1secret)
Strong passwords have the following characteristics:
Contain both upper and lower case characters (e.g., a-z, A-Z)
Have digits and punctuation characters as well as letters e.g., 0-9, !@#$%^&*()_+~-=\`{}[]:";'<>?,./)
Are at least eight alphanumeric characters long.
Are not a word in any language, slang, dialect, jargon, etc.
Are not based on personal information, names of family, etc.
Passwords should never be written down or stored on-line. Try to create passwords that can be easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation.
Password Protection Standards
Do not use the same password for the organization accounts as for other non-organization access (e.g., personal ISP account, option trading, benefits and e-banking). Where possible, don't use the same password for various organization access needs. For example, select one password for the network logon and a separate password for Internet access.
Do not share the organization passwords with anyone, including administrative assistants or secretaries. All passwords are to be treated as sensitive, confidential information.
Here is a list of "do nots":
Don't reveal a password over the phone to ANYONE
Don't reveal a password in an email message
Don't reveal a password to a friend
Don't talk about a password in front of others
Don't hint at the format of a password (e.g., "my family name")
Don't reveal a password on questionnaires or security forms
Don't share a password with family members
For employees, don't reveal a password to co-workers while on vacation
If someone demands a password, refer them to this document or have them call the Information Technology Systems Administrator.
Avoid using the "Remember Password" feature of applications (e.g., Eudora, OutLook, Netscape Messenger), where possible.
Again, do not write passwords down and store them anywhere in your office. Do not store passwords in a file on ANY computer system (including Palm Pilots or similar devices) without encryption.
Change passwords on a regular basis (except system-level passwords which must be changed quarterly). The recommended change interval is every six months.
If an account or password is suspected to have been compromised, report the incident to the Help Desk and change all passwords.

5. Enforcement Staff violations of this policy will be referred to supervisors or the General Manager of the organisation. 6. Definitions
Terms
Definitions
Active Directory
Central user account database
Account:
Any account that is for the administration of an application
Application Administration

(e.g., Oracle database administrator, Web administrator)

7. Revision Historye.g., Draft Version 0.6 March 29, 2004e.g. Version 1.0 April 7, 2004
7.1 Wet Signature of Custodian and Owner of the Policy Document and Date.

Question 4: Briefly describe the features an organisation needs to have in a Disaster Recovery Plan

1. Provide a brief overview of the organization in terms of employees, organizational structure, buildings occupied and core business
2. A description of what the plan is aiming to achieve, what it contains and scope
3. The major business processes and associated hardware, software and data, criticality rating for processes and data
4. A description of the relevant risks to hardware, software and data
5. An analysis of risks which includes a description of the probability of the risk and the impact on the business
6. A listing of which risks are acceptable and a listing of which risks should be mitigated. An explanation of why the risks which have a high impact but low likelihood of occurring have a low priority for mitigation
7. A description of the strategies and procedures for disaster prevention
8. A description of the strategies and procedures for disaster response
9. A description of the strategies and procedures for disaster recovery
10. A description of the criteria and procedures for declaring a disaster and the staff involved
11. A statement of how often the plan needs to be updated and by whom
12. A statement of how often the plan will be tested, how the plan will be tested and who will be responsible for testing.
Question 5: Discuss the following system administration terms
5.1 Logical page sizes
The logical page size is a server-wide setting. The databases needs to have standard sized logical pages within the same server.
The server can create master devices and databases with logical page sizes of 2K, 4K, 8K, or 16K. A given server installation can have only one of these four logical page sizes. All databases in a server and all objects in every database, use the same logical page size.
5.2 Using "test" servers
It is best to install and use a "test" and/or "development" Server, and then remove it before you create the "production" server. Using a test server makes it easier to plan and test different configurations and less stressful to recover from mistakes. It is much easier to learn how to install and administer new features when there is no risk of having to restart a production server or re-create a production database.

For test servers, it is recommended to approach it from the point of installing or upgrading the Server through the process of configuring the server. It is in these steps that you make some of the most important decisions about your final production system.
5.3 Benefit of test server
1. Understanding new procedures and features
Using a test server allows you to practice basic administration procedures before performing them in a production environment. Many procedures may take several attempts to complete a task successfully. So the benefit is from practising techniques that are introduced by new features in a server.
2. Planning resources
Working with a test server helps in planning the final resource requirements for the system and helps in the discovery of resource deficiencies that might not have been anticipated.

Disk resources can have a dramatic effect on the final design of the production system. For example, there may be a requirement that a particular database needs nonstop recovery in the event of a media failure. This would necessitate configuring one or more additional database devices to mirror the critical database. Discovering resource requirements by using a test server allows changes to the physical layout of databases and tables without affecting database users.
A test server can be use to benchmark both the production server and your applications using different hardware configurations. This enables the determination of the optimal setup for physical resources at both the production server level and the operating system level before bringing the entire system online for general use.
3. Achieving performance goals
Most performance objectives can be met by planning a database's design and configuration. For example, the insert and I/O performance of a particular table may turn out to be a bottleneck. In this case, the best course of action may be to re-create the table on a dedicated segment and partition the table. Changes of this nature are disruptive to a production system; even changing a configuration parameter may require the restart of the production server.
5.4 Steps in installing network software
1. Check product compatibility –
Always read the release bulletin included with the products to understand any compatibility issues that might affect your system. Compatibility problems can occur between hardware and software and between different release levels of the same software. Reading the release bulletin in advance can save the time and guesswork of troubleshooting known compatibility problems.
2. Install or upgrade Server -
Read through the installation documentation for the platform (network operating system) before beginning a new installation or upgrade. It is necessary to plan parts of the installation and configure the operating system before installing the server software.
Requirements include the configuration of memory, raw devices and asynchronous I/O. Many of these tasks must be completed before beginning the installation.
For upgrading, back up all data (including the master database, user databases, triggers, and system procedures) offline before beginning. After upgrading, immediately create a separate, full backup of the data, especially if there are incompatibilities between older dump files and the newer versions.
5.5 Install additional third-party software
1. Network protocols
Check if the network supports additional protocols, it maybe necessary to install the required protocol support.
2. Directory services
A directory service can be used to obtain a server's address and other network information. Directory services are provided by platform or third-party vendors and may be sourced independently and installed separately from the installation of server (network operating system).
5.6 Configure and test client connections
A successful client connection depends on the coordination of server, the client software, and network products. If using one of the network protocols installed with the server,
read the configuration documentation for the platform for information about testing network connections. If using a different network protocol, follow the instructions included with the network product. The "ping" utilities included with Network Operating Systems NOS can be used to test client connections with the server.
5.7 Allocating physical resources
This is the process of giving the server, the memory, disk space, worker processes, and CPU power required to achieve your performance and recovery goals.
When installing a new server, every System Administrator must make decisions about resource utilization.
Making these decisions is necessary when reallocating server’s resources if upgrading the platform by adding new memory, disk controllers, or CPUs, or if the design of the database system changes.

Additionally, conducting benchmarking tests on server plus the applications installed regularly can help spot deficiencies in hardware resources that create performance bottlenecks. Therefore, reallocation of resources may be necessary following these tests.

The first step in planning server resources is to understand the resources required by other applications running on the same machine.
On a shared system, other applications, such as client programs or print servers, run on the same machine as the server. It can be difficult to calculate the resources available to the server on a shared system, because the types of programs and their pattern of use may change over time.
In either case, the System Administrator is responsible to take into account the resources used by operating systems, client programs and windowing systems when configuring resources for the server.
Configure the server to use only the resources that are available to it. Otherwise, the server may perform poorly or fail to start.
5.8 Resource planning
It is necessary to understand and plan resource usage in advance.
In the case of disk resources, for example, after you initialize and allocate a device to the server, that device cannot be used for any other purpose (even if the server never fills the device with data). Likewise, the server automatically reserves the memory for which it is configured, and this memory cannot be used by any other application.
The following can help in planning resource usage:
· For recovery purposes, it is always best to place a database's transaction log on a separate physical device from its data.
· Consider mirroring devices that store mission-critical data. Using disk arrays and disk mirroring for server data if these features are available.
· If working with a test server, it is sometimes easier to initialize database devices as operating system files, rather than raw devices, for convenience. The server supports either raw partitions or certified file systems for its devices.
· Bear in mind that changing configuration options can affect the way the server consumes physical resources.
5.9 Operating system configuration
This task follows resource planning. This is the configuration of the physical resources at the operating system level:
· If using raw partitions, initialize the raw devices to the sizes required by the server. If the raw device is initialized for the server, that device cannot be used for any other purpose (for example, to store operating system files).
· Configure the number of network connections. Ensure that the machine on which the server runs can actually support the number of connections configured. This should be in the operating system documentation.
· Often, additional configuration requirements for the operating system and the applications used are needed. It is necessary to consult the technical installation documentation for the platform and applications
5.10 Monitor the log size
The reason why the log size should be monitored is that when the transaction log becomes nearly full, it may be impossible to use standard procedures to dump transactions and reclaim space. The System Administrator needs to monitor the log size and perform regular transaction log dumps in addition to regular database dumps to ensure this situation never occurs. The preferred method is to set up a threshold stored procedure that notifies you (or dumps the log) when the log reaches a certain capacity. It is also a good strategy to dump the transaction log just prior to doing a full database dump in order to shorten the time required to dump and load the database.


Question 6: Discuss the concept and significance of backup and recovery



Making regular backups of your databases is crucial to the integrity of your database system. Although the server automatically recovers from system crashes if configured initially (for example, power outages) or server crashes, only the administrator can recover from data loss caused by media failure.

Backing up the master database is the core activity of the backup and recovery plan. The master database contains details about the structure of your entire database system. It keeps track of the server databases, devices, and device fragments that make up those databases. Because the server needs this information during recovery, it is crucial to maintain an up-to-date backup copy of the master database at all times.

To ensure that the backup of master is always up to date, back up the database after each command that affects disks, storage, databases, or segments. This means back up the master after performing any of the following procedures:
1. Creating or deleting databases
2. Initializing new database devices
3. Adding new dump devices
4. Using any device mirroring command
5. Creating or dropping system stored procedures, if they are stored in the master
6. Creating, dropping, or modifying a segment
7. Adding new server logins.
In addition to backing up the master regularly, keep offline copies of the contents of the system tables.

With copies of these tables, if a hard disk crash or some other disaster makes your database unusable, this can be used for the recovery procedures.
Copies of all data definition language (DDL) scripts for user objects are also necessary for record keeping management.

Creating an automated backup procedure takes the guesswork out of performing backups and makes the procedure easier and quicker to perform.

Automating backups can be as simple as using an operating system script or a utility to perform the necessary backup commands. Or you can automate the procedure further using thresholds.

The creation of an automated backup procedure using scripts should accomplish the same basic steps:
1. Start process and dump the transaction log to a holding area (for example, a temporary file).
2. Rename the dump file to a name that contains the dump date, time, and database name.
3. Make a note about the new backup in a history file.
4. Record any errors that occurred during the dump in a separate error file.
5. Automatically send mail to the System Administrator for any error conditions.
Having backups of a database sometimes is not enough—there must be a check on consistent, accurate backups (especially for the master). If you back up a database that contains internal errors, the database will have the same errors when restoring it.

You need to use the system’s utilities to check a database for errors before backing it up. If the integrity of a database shows errors, correct them before dumping the database.
Over a period of time, if there are few or no errors while running checks, it may be justifiable that the risk of database corruption is small and that checks can be run only occasionally.
Or, if the consequences of losing data are too high, continue to run checks each time you back up a database.

For performance considerations, consider running checks outside of peak hours or on separate servers.

Question 7: As a system administrator, you need to undertake the function of ongoing maintenance and troubleshooting. Discuss some of the features of this function.


For maintenance, the System Administrator performs the following activities throughout the life of a server.
7.1 Starting and stopping Server
Most System Administrators automate the procedure for the start-up of the server machine. This can be accomplished by editing operating system start-up scripts or through other operating system procedures.
7.2 Viewing and pruning the error log
Examine the contents of the error log on a regular basis to determine if any serious errors have occurred. Use operating system scripts to scan the error log for particular messages and to notify the System Administrator when specific errors occur. Checking the error log regularly helps you determine whether there are continuing problems of the same nature or whether a particular database device is going bad. The error log file can grow large over time, as the server appends informational and status messages to it each time it starts up. It is necessary to periodically "prune" the log file by opening the file and deleting old records. Keeping the log file to a manageable size saves disk space and makes it easier to locate current errors.
7.3 Keeping records
Accurate records of changes and problems encountered can be a valuable reference when it is necessary to recover databases and obtain vendor support. More importantly, they can provide vital information for administrators who manage the server system in the absence of the system administrator.

The types of records kept are:
1. A list of primary and secondary contacts: the System Administrator; the System Security Officer; operator, and database owners of the system. This information is available to all server users so that the appropriate contacts receive enhancement requests and problem reports.
2. Script files: part of the job includes creating databases, creating database objects, and configuring the server using script files that you later store in a safe place. Storing the script files makes it possible to re-create your entire system in the event of a disaster. It also enables re-creation of database systems quickly on new hardware platforms for evaluation purposes. If a third-party tool is used to perform system administration, it is necessary to generate equivalent scripts after performing administration tasks.
3. Commands used to create databases and database objects (DDL scripts)
4. Commands that add new server logins and database users
5. The current server configuration file
6. The names, locations, and sizes of all files and raw devices initialized as database devices
7. Dated log: a dated log of all changes to the server configuration; mark each change with a brief description of when and why the change was made, as well a summary of the end result.
8. System information: Record information about the hardware and operating system on which you run the server. This includes:
· Copies of operating system configuration files or start-up files
· Copies of network configuration files (the hosts and services files)
· Names and permissions for the server executable files and database devices
· Names and locations of the tape devices used for backups
· Copies of operating system scripts or programs for automated backups, starting Server, or performing other administration activities.
7.4 Maintenance schedules
Keep a calendar of regularly scheduled maintenance activities. This calendar lists the procedures performed on site and includes:
1. checking database for consistency
2. backing up user and system databases
3. monitoring the space left in transaction logs (if this is not done automatically)
4. dumping the transaction log
5. examining the error log contents for the server and backup server
6. Running the update statistics command for Performance and Tuning
7. Examining auditing information, if the auditing option is installed
8. Recompiling stored procedures
9. Monitoring the resource utilization of the server machine

Question 8a: In some organisations, the system administrator takes on the responsibility of technical support, discuss this association.



Reference http://en.wikipedia.org/wiki/Technical_support

Technical support is a service used by information communication technology (ICT) companies used to help solve problems with technical equipment, usually computer hardware and software.

Types of support

Technical support can be delivered through various media, including e-mail, live chat, telephones, applications, faxes and technicians. The most common vector is the telephone. Often technical support takes the forms of support for a particular range of products or services, the support remit.

It is necessary to note that technical support can be delivered by staff or contractors through a service level agreement (a maintenance contract). The technical support role can be providing system support for the organisation, in which case, it is linked to systems administration. Technical support can also be set up as part of a helpdesk function to service external customers for the organisation’s products and services. In this case, its function is not direcly linked to systems administration.

Support remits have several purposes, including legal liability, training, and availability. An Internet technical support contractor has a limited number of Customer Support Advisors available at any one time, and so needs to satisfy a certain rate of customers. If it supports and assists on products not relating to the support remit then the customer throughput will be lower than if it only supports certain issues. Training is also a factor, built around the proverb that a “jack of all trades is a master of none” - a limited support remit limits the amount of training required for the support officer and allows for greater customer confidence - the definition of a support remit prevents the support officer from being humiliated by being asked about matters about which he or she knows little or nothing. A support remit also protects from liability lawsuits - incorrect advice on, say, Internet Explorer configuration may cause only limited damage, but incorrect advice on a Power Supply Unit may lead to serious injury or fire.

With the introduction of the Internet into the mass market, technical support as a segment of the service industry has exploded in recent years, augmented by the formation of dedicated companies and outsourcing. In recent years, large numbers of call centres have been established to provide telephone technical support.

There are also a growing number of online technical-support bulletin boards

Technical support varies depending on the range of responsibilities. Some things that are not supported in lower levels of support can be supported with higher service levels: for instance, only direct questions can feasibly be addressed through SMS or fax; basic software problems can be addressed over the telephone; while hardware problems often need to be dealt with in person.

The cost of support can vary. Some companies offer limited free support when their hardware or software is purchased; others charge by premium-rate telephone calls.

Question 8b: the organisation’s Help Desk is sometimes managed by the System Administrator. Discuss the features of the Help Desk.



Reference :http://en.wikipedia.org/wiki/Help_desk

A help desk is an information and assistance resource that troubleshoots problems with computers and similar products. Organisations often provide help desk support to their customers via a toll-free number and/or website. There are also in-house help desks geared toward providing the same kind of help for employees only.


A typical help desk has several functions. It provides the users with a central point to receive help on various computer issues. The help desk typically manages its requests via help desk software such as HEAT or TrackIT that allows them to track user requests with a unique ticket number.

The user notifies the help desk of his or her issue, and the help desk issues a ticket that has details of the problem. If the first level is able to solve the issue, the ticket is closed and updated with documentation of the solution to allow other help desk technicians to refer to it. If the issue needs to be escalated, it will be dispatched to a second level.


Large help desks have different levels to handle different type of questions. The first-level help desk personnel are prepared to answer the most commonly asked questions, such as those that perhaps belong in an FAQ. The second or higher levels handle more difficult calls.
Larger help desks have a person or team responsible for managing the tickets and are commonly called queue managers. The queue manager is responsible for the ticket queues, which can be setup in various ways depending on the help desk size or structure.

Typically, larger help desks have several teams that are experienced in working on different issues. The queue manager will assign a ticket to one of the specialized teams based on the type of issue.

The deskside team is responsible for the desktops, laptops and peripherals such as PDAs. The help desk will assign the deskside team the second level deskside issues that the first level was not able to solve. They set up and configure computers for new users and are typically responsible for any physical work relating to the computers such as repairing software or hardware and moving workstations to another location.


The network team is responsible for the network software, hardware and infrastructure such as servers, switches, backup systems and firewalls. They are responsible for the network services such as email, file, and security. The help desk will assign the network team issues that are in their field of responsibility.


Some companies have a telecom team that is responsible for the phone infrastructure such as PBX, voicemail, VOIP, telephone sets, modems and fax machines. They are responsible for configuring and moving telephone numbers, voicemail setup and configuration and are assigned these types of issues from the help desk.

Not all of the help desk staff and supporting IT staff are in the same location. With remote takeover applications such as “PcAnywhere” and “Dameware”, technicians are able to solve many help desk issues from another location or their home office. There is a need for on-site support to physically work on some help desk issues; however, help desks are able to be more flexible with their remote support.

Help desk is a broadly applied term referring to a staffed resource—often, an actual desk, or a telephone service—that can help persons answer questions or to use resources such as audio-visual or computer resources.

Assignment Topic 1: Perhaps the most difficult task as a system administrator is that you need to conduct troubleshooting and problem solving (1) discuss these two terms. (2) In your problem solving training, you would have noticed that problems can present themselves from just about anywhere. Give some examples from your training in problem solving, as you need to understand techniques, the problems need not come from just the system you are operating. Sometimes in the future, one of these situations could appear in another business domain or environment.




Reference: http://en.wikipedia.org/wiki/Troubleshoot

a. Troubleshooting is a form of problem solving. It is the systematic search for the source of a problem so that it can be solved. Troubleshooting is used in many fields such as system administration and electronics. Normally a process of elimination is used to isolate possible causes of problems.

Usually troubleshooting is applied to something that has suddenly stopped working, so the first focus, or concentration of attention, should be on what has changed. However, care must be used to not jump to false conclusions of causality - correlation does not always mean cause.

A basic principle in troubleshooting is to start from the simplest and most probable possible problems first. This principle results in the common complaint about help desks or manuals, that they sometimes first ask: "Is it plugged in?", but this should not be taken as an affront, rather it should serve as a reminder or conditioning to always check the simple things first before calling for help.

Further steps in troubleshooting are to check each component in a system one by one, and to substitute known good components for any suspect ones. A cognitive walkthrough is also a good thing to try. Comprehensive documentation produced by proficient technical writers is very helpful, especially if it provides a theory of operation for the subject device or system.

b. Problem solving

Reference: John Malouff (2001), Fifty Problem Solving Strategies Explained, University of New England @ http://www.une.edu.au/psychology/staff/malouff/problem.htm

According to Malouff, problem solving can be improved by being organised and structured in approach. The techniques checklisted below help in finding solutions more effectively.

b.1 Understand the problem

Clarify the problemIdentify key elements of the problemVisualize the problem or a relevant process or situationDraw a picture or diagram of the problem or a relevant process or situationCreate a model of the problem or a relevant processImagine being the problem, a key process, or the solution Simulate or act out a key element of the problem Consider a specific exampleConsider extreme casesChange perspectiveConsider levels and systems
b.2 Simplify the task
Simplify the problemSolve one part at a timeRedefine the problem
b.3 Determine the cause of the problem
Collect information about what happens before, during, and after the problemOrganize information into a table, chart, or list and look for a patternTry to make the problem worseCompare situations with and without the problemConsider multiple causes and interactionsConsider non-linear effects
b.4 Use of external aids to help you identify possible solutions
Ask someone, especially an expertSeek the answer in written materialUse a tool or technologyApply a theoryApply the scientific methodUse mathematicsUse a formula
b.5 Use of logic to help you identify possible solutions
Reason by analogy in using what you have learned about similar problemsUse deductive reasoningUse inductive reasoningQuestion assumptions
b.6 Using a possible solution as a starting point to help you solve a problem
Guess, check, and adjustWork backward
b.7 Determine which possible solution is best
Estimate the likely costs and benefits of possible solutionsChoose one or more options to implementImplement the best solutions and collect information about the effects of it
b.8 Function optimally while problem solving
Think of options without immediately evaluating themSet a goal with a purpose you valueAvoid distractionWork in a new settingAdjust time limit to optimumWork with someoneCreate a positive mood with an optimum arousal levelThink of the problem as a challenge or opportunity Think confidentlyTake a breakPersist
b.9 Solve multiple problems
Adopt a problem solving orientationApply triageSolve one problem at a time

Below are examples the application of problem solving techniques: (Students can give four or five examples from the list below)


1. Clarify the problem.
It is easier to solve a specific problem than a vague one. So clarify the problem before you start looking for a solution. If your problem is that your spouse tells you that you are not supportive enough, find out what he or she means by supportive. If your problem is that your mother can’t get the new VCR to work, determine what doesn’t happen that she wants to happen. If your problem is a math homework question, read carefully the question (usually at the end): Is the answer supposed to be in metres or centimetres, rounded or not, square or not and so on.
2. Identify key elements of the problem.
Problems come to us with varying amounts of important and useless information. Focusing on useless information distracts us and wastes time. So identify the key elements of the problem before you start looking for a solution. If the problem is that of a couple who come to you for counselling because they argue continually, ask them what they argue about, when, and where. If the problem is that your bike squeaks when you ride it, determine what part squeaks.
3. Visualize the problem or relevant process or situation.
Sometimes we can see the problem and all its important details right in front of us. This helps us understand the problem. Other times we can’t see important elements because they have already occurred or are not visible. In these cases, it is valuable to visualize important elements of the problem. So, if you want to predict the future of the universe, visualize the big bang and the ensuing events. If you want to open a lock without a key, visualize the lock mechanism. If you want to determine how a murder was committed, visualize events that would explain the physical evidence.
3. Draw a picture or diagram of the problem or a relevant process or situation.
Visualizing a problem can aid understanding. However, we can keep only some much visual information in our minds at once. Hence, it is often useful to draw a picture or diagram. So, if you want to calculate when two airplanes will collide, draw their paths and speeds. If you plan to assault a house where a terrorist holds hostages, draw a picture of the room, doors, windows, or hostages, If you want to speed up delivery of goods to retailers, draw a diagram showing the steps in the process.
4. Create a model of the problem or a relevant process
Creating a model of a problem or relevant process helps us focus on essential elements and gives us the potential to alter the model and see what happens. For instance, if you want to minimize harm to individuals in auto accidents, create a computer model of the structures and forces involved. If you want to build a Mars rover, build a model. If you want to reduce international strife, create a model of causes.
5. Imagine being the problem, a key process, or the solution
Imagination can help us understand a problem by visualizing it. More understanding can occur in some cases if we go farther and imagine being the problem, a key process, or the solution. So, if you want to understand space and time, you can imagine, as Einstein did, riding a light beam. If you want to help a person who is very paranoid, you can imagine being that person and seeing the world as he does. If you want to get a hit in a big cricket game, you can imagine going up to bat, seeing the ball clearly, and swinging crisply while you step into the pitch, etc.
6. Simulate or act out a key element of the problem
Understanding complex or vague problems can be difficult. Simulating or acting out some key element of the problem can be productive. For instance, if you are calculating probabilities of some event happening, you can simulate the situation and observe outcomes yourself. If you want to help someone become more socially successful, you can act as that person does and observe the consequences. If you want to determine why a spacecraft exploded, simulate its flight, and try ways of recreating the explosion.
7. Consider a specific example.
Problems often come to us in the abstract. Creating a concrete example helps us explore the problem just as we might explore a specific example of dinosaur bones to understand dinosaurs. So, if you want to determine what makes a person psychotic, consider real people who have become psychotic. If you want to learn how to calculate the volume of a sphere, use a specific radius, such as one metre, and apply the formula. If you want to determine why frogs are dying right and left in your community, examine dead frogs.
8. Consider extreme cases.
Considering extreme cases is a type of considering a specific example. Here the example is chosen to test the limits of a relevant parameter. Sometimes this gives insight into important processes. So, if you want to determine whether level of intelligence affects retention on a police force, consider officers with the highest and lowest intelligence on the force. If you want to determine what happens to black holes in the long run, consider black holes that continue for infinitely long or black holes that suck up everything in the universe .If you want to determine how temperature affects the flow of electricity, consider a temperature of absolute 0.
9. Change perspective.
If you want to reduce crime in a community, look at crime from the perspective of criminals and victims. If you want to convince a hostage taker to surrender, take that person’s perspective. If you want to avoid being bitten by a vicious dog, take the dog’s perspective.
10. Consider levels and systems
If you want to prevent skin cancer, consider events that trigger the cancer at the level of the external environment, the intercellular level, and the intracellular level. If you want to reduce school violence, consider systems such as communities, families, and individuals. If you want to predict the weather, consider local conditions and approaching fronts.
11. Simplify the problem
Some problems overwhelm us with their complexity. In such cases, it may pay off to simplify the problem. So, if you want to solve an equation (a squared – 2a + 1) = 0, simplify it to (a – 1) squared = 0.If you want to determine how far you can drive on the fuel remaining in your tank, you can estimate the amount of fuel and divide by the estimated kilometres per litre. To simplify the task, round the amounts. If you want to protect your country from terrorist attack, identify the countries most likely to aid the terrorists and defend against the potential methods of those countries.

12. Solve one part at a time.
It is sometimes possible to make a problem easier to solve by attacking one part at a time. For instance, if you want to reduce international conflict in the Middle East, choose two countries with continuing conflict and focus on those. If you want to send a human to Mars, send and retrieve information-gathering robots first. If you want to improve your personality, choose one characteristic to improve at a time, starting, for instance, with your outgoingness.
13. Redefine the problem.
If a problem seems presently unsolvable, consider what value underlies the desire to solve that problem, and redefine the problem into something solvable. For example, if a farmer cannot solve the problem of how to grow a specific crop on his land, he might analyse why he finds growing this crop is desirable. If he decides that the reason is that the crop generally has a high profit margin, he might review what other crops have a high profit margin or even consider profitable uses of his land that do not involve farming. He thereby has redefined the problem from raising a certain crop on his land to making a high profit with his land.
14. Collect information about what happens before, during, and after the problem.
Problems are often triggered by something observable and reinforced by something that happens afterward. So if Carrie often has temper tantrums, observe her and the situation carefully to collect information about what happens before, during, and after the tantrum. You may find that pressing her to do difficult schoolwork usually happens before and allowing her to avoid the schoolwork happens after. If Jake often has digestive problems, you might find that nothing special happens before, during, or after. No specific foods seem to trigger the problem, so diet restriction is unlikely to help. If you want to help heart surgery patients avoid depression after their surgery, observe them before, during, and after surgery.
15. Organize information into a table, chart, or list and look for patterns
Information collected about a problem often becomes easier to search for patterns when put into a table, chart, or list. The patterns may reveal causes of the problem. So, if you want to predict the next time a man will beat his wife, organize information about his prior instances of wife beating and look for a pattern, such as beating being delivered after he suffered an affront and drank heavily. If you want to determine how to prevent auto accidents, put information about causes of past accidents into a table and look for patterns in the aggregated data, such as a high proportion of the accidents being caused by young males who have been drinking and were driving faster than the speed limit. If you want to predict when a stock will rise, chart its price fluctuations over time and events in the past.
16. Try to make the problem worse
One way to determine whether you know what causes a problem is to try to make the problem worse. This may be worth doing when the supposed solution is so difficult, inconvenient, expensive, or dangerous as to justify caution in trying it. So, if you suspect that eating strawberries is causing your nose to turn red, wait until your nose is its usual colour and eat a few strawberries. If you think that mentally retarded children has tantrums because of changes in his routine, change the routine substantially on a few occasions and observe his behaviour.
17. Compare situations with and without the problem
Comparing situations with and without the problem can sometimes shine light on a difference that causes the problem. So, if you want to eliminate bacterial infections that kill women giving birth, compare the care given women who become infected with those don’t. You might see, as a 19th Century researcher did, that the women who are “helped” by physicians who don’t wash their hands between patients. Women become ill and the women who are helped by midwives who do wash their hands do not become ill. If you want to know what causes AIDS, compare people who do and don’t have HIV and observe the people for several years. If you want to know what causes violent crime, compare the intelligence of individuals who have and have not been convicted of violent crimes.
18. Consider multiple causes and interactions
Sometimes two or more variables or influences cause a problem to occur. For instance, level of drunkenness depends on many factors, including the amount of alcohol consumed and the body weight of the person. A harmful level of carbon monoxide gas may flow into a house only if the wind is blowing hard in a certain direction, the heat exhaust pipe is less than a metre above the roof, and the heat is on high. If we do not look for all the causes of a problem, we may never find them. So if you want to determine what causes autism, wood rot in a house, or the cause of someone’s death, consider multiple causes and interactions.
19. Consider non-linear effects
Variables sometimes cause problems in a linear way, e.g., the more lead a child eats, the greater the harm. However, some variables have curvilinear effects. For instance, some arousal aids human performance, while a great deal of arousal impairs performance. So, if you want to determine what causes a problem, consider non-linear effects.
19. Ask someone, especially an expert
If we look hard enough we can usually find someone who knows more about how to solve a particular problem than we do. The fastest way to solve the problem may be to ask that person. So if you don’t know how to fix a leaking faucet, or help your child act more outgoing, or improve your job interviewing success, ask an expert.
20. Seek the answer in written material
Written materials exist that show how to solve many problems. New devices often come with instruction manuals. Libraries and bookstores are loaded with “How To” books. The Internet offers answers to many problems – if we ask the right question and use judgment about which web sites are credible. So if you want to learn how to improve the appearance of your nose, you could look up “cosmetic” or “nose” surgery in an Internet search engine and in a medical encyclopaedia in the library.
21. Use a tool or technology
Some problems require the right tool, which could be a hammer, a computer, or a metal detector. So whenever you have a problem to solve, consider whether some type of technology might help you.
22. Apply a theory
Good theories can point us in the right direction to find a solution to a problem. For instance, Albert Bandura’s social learning theory suggests that if we want to teach a child to act altruistically, we would set an altruistic model in our behaviour, talk about our altruistic goals, and reward the child (perhaps with praise) when she acts altruistically. Other theories in fields as different as economics and physics provide possible solutions to various types of problems.
23. Apply the scientific method
The scientific method has helped to produce many of the great accomplishments of recent human history, such as doubling the average human lifespan, putting a human on the moon, and discovering planets orbiting other stars. The method involves systematically collecting data to test a hypothesis, applying certain types of research design and analysis methods to the data, and being sceptical about the results.
24. Use mathematics
Mathematics is essential to solving some problems, such as how to put an exploring robot on Mars, how to determine whether one treatment is generally more effective than another for pancreatic cancer, and how to defend an area from enemy missiles. There are many types of mathematics, but even the simplest can be helpful in problem solving. For example, if you want to make yourself happier, you might start by counting the number of days in the next 14 that you feel happy. Then you have a baseline to use as a comparison after you make some behavioural or situational changes in pursuit of more happiness. If you wanted to determine whether a new treatment for diabetes is better than the usual treatment, you might use a t test to compare the blood sugar levels are of the group of people using the new treatment with a group of people using the usual treatment.
25. Use a formula
Sometimes, a formula can help solve a problem. The formula could be a recipe, a set of chemicals, pressures, and heat levels, or an established method of doing something else. So, if you want to develop a permanent way of marking the right lens for contact lens wearers, start with the formulas for permanent pens and markers. If you want to create better toothpaste, start with a typical formula and try altering its components.
26. Reason by analogy, using what you have learned about similar problems
Going through life we solve many problems. Often the problem solving methods we used and the actual solutions we found effective in the past can work to solve a current problem. So, if you have solved before a problem with a neighbour’s dog barking all night, the same solution may work with another neighbour who plays loud music all night. In fact, the same solution might be something to try with anyone who is chronically annoying.
27. Use deductive reasoning
Deductive reasoning involves going from a general rule to an application in a specific instance. So, if we assume that people commit murder only if they have a motive, then we look for murder suspects among people who had a motive. If we start with a premise that people do what they think is in their best interest, we try to provide employees incentives to work productively. If we believe causes must occur prior to effects, we can conclude that a huge grass fire did not cause the high level of asthma attacks that started two days before the fire.
28. Use inductive reasoning
Inductive reasoning involves drawing on specific instances to form a general rule. So, if you want to know whether your child will leave your yard if left outside alone, one thing you could do would be to set up that situation and covertly observe the child on several occasions. If you want to find out whether eating chocolate causes you acne, eat chocolate every day for two weeks, then not at all for two weeks, then every day again for two weeks, then not at all for two week, and record the state of your skin every day. If you want to know whether a genetically altered microbe will reproduce in field settings, put a specific number of the microbes in field settings and later count the number.
29. Question assumptions
Our thinking contains many assumptions or beliefs that have never been well tested, such as that our religion or ethnic group is the best one. If you want to reduce inter-group conflict, questioning these assumptions might help. If you want to stop children from starting to use illegal drugs, question the assumption that educating them about the effects of the drugs will discourage use. If you want to develop close relations with your supervisor, you may benefit from questioning your assumption that all supervisors are power hungry and self-centred.

30. Guess, check, and adjust
It may work to guess at a solution, especially if the range of possible solutions is limited as in a multiple-choice test. You can check to see whether your guess is right, and then eliminate the option if it is not. As Sherlock Holmes said, once you have eliminated all the possibilities except one, that one must be the solution. Sometimes guessing can help us even when the range of possible answers is unlimited. For instance, in solving for x in x + y = 12 and 2x – y = 3, if there are no answers from which to choose, and you don’t know how to solve simultaneous equations, you can guess at what x is, and if you miss, you can use how much you miss by to make a better second guess, and so on, adjusting your guessing as you go. That, in essence, is how software for structural equation modelling proceeds to a solution.

31. Work backwards
In solving a printed maze, looking at the goal area and working backward sometimes offers the fastest solution. That may occur because the maze maker did not expect you to use this strategy. Also, if you want to recreate the events involved in a crime, you could start with a possible perpetrator and the available evidence, work backward in time, and see what makes sense.

32. Estimate the likely costs and benefits of possible solutions.
Use deductive and inductive reasoning and the scientific method to estimate the costs and benefits of each possible solution. For instance, if you have a wart on your hand, one option is to buy a commercial product that slowly disintegrates the wart. The costs include the financial cost of buying the product, the time spent in applying it daily, the cost of bandages to cover the area, the inconvenience of wearing bandages, the possible embarrassment of being asked why your are wearing a bandage, and the possibility of a life-long scar. On the benefit side the wart is very likely to be eliminated.

33. Choose one or more options to implement.
Solving a problem usually involves doing something. So, use deductive and inductive reasoning and the scientific method to choose one or more options to implement. This usually involves weighing the costs and benefits of each option according to your values. For instance, if you want to eliminate a wart, you might choose to do nothing and bet on the significant chance the wart will go away on its own and leave no scar. You might choose this approach because you have strong feelings against creating a life-long scar, such as those caused by more active approaches.

34. Implement the best solution and collect information about the effects
Use deductive and inductive reasoning and the scientific method to determine the effects of the chosen option. So, if you want to eliminate a wart, you might wait a year and see whether it goes away on its own. If it doesn’t, you could choose a more active option.

35. Think of options without immediately evaluating them
It is often wise to consider a range of solution options when engaged in problem solving. Several options may solve a problem, but one may solve the problem more completely or cheaply. Individuals may squelch their own good ideas or the good ideas of others by immediately evaluating the ideas. Hence, it may help to brainstorm possible solutions, i.e., record them without first evaluating them. Even a very bad idea might point in a useful direction if it is not pushed aside too quickly.

36. Set a goal with a purpose you value
Setting a goal with an outcome we value tends to help us achieve more. So, if you have an assignment of math problems to complete, you might set a personal goal of completing all of them correctly for the purpose of earning an “A” on the assignment and in the course so that you can improve your chances of gaining admission to medical school, so you can spend your life helping ill children. If you have a problem of getting your research approved by an ethics board, set a goal of gaining approval so that you can do the research and help others with your findings.

37. Avoid distraction
Distractions slow the problem solving process. Distractions can include environmental events such as phone calls and machinery noise. Distractions can also include repeated intrusive thoughts (“This is a terrible situation!”) and. One way to avoid external distractions is to go somewhere peaceful where no one can find you. Another way is to disconnect the phone and put up a “Do not disturb, please” sign. One way to reduce intrusive thoughts is to tell yourself that you will think about these emotion-laden matters at a specific later time, but for now you are going to yell “STOP!” every time the thought intrudes. Another way to reducing intrusive thoughts is to write them down or to tell someone close to you about them.

38. Work in a new setting
New settings sometimes prompt new types of thinking that can be useful in solving hard problems. For instance, go sit and think in the quiet park across from your headquarters, in a forest cabin, or in a different library.

39. Adjust time limit to optimum.
Some problems are easy to solve but tedious. It may facilitate efficiency to set an artificially brief time frame for completion, e.g., “I’m going to finish these math problems in 30 minutes”. For difficult problems, increasing the time frame for solution may help by reducing distraction-provoking anxiety. So if you are asked to solve a difficult problem, ask for an amount of time that will be sufficient to eliminate time pressure but still not so long as to induce inefficiency.

40. Work with someone.
All else being equal, several people working on a difficult problem tend to produce a better solution than one person. Some efficiency may be lost, so working with someone may best be reserved for very difficult problems. So, if you want to clone a bonobo, work with someone. If you want to end your dependency on tobacco, work with someone.

41. Create a positive mood with an optimum arousal level
People work better when they have a positive mood and a moderate arousal level. To create a positive mood, you could engage in some activity you greatly enjoy, such as listening to music or reading a book, or you could think back about huge triumphs and outstanding moments in your life. To avoid excessive arousal, you could use a relaxation method such as deep breathing, tensing and relaxing muscle groups, and telling yourself to stay calm.

42. Think of the problem as a challenge or opportunity.
No one wants to have “problems”. So we often think of problem solving as an unfortunate, unpleasant task. Such a negative view of the problem solving may impair our performance at the task. In order to keep a positive mood and keep working on a problem, it is helpful to think of the problem as a challenge or opportunity. So, if the barking of your neighbour’s dog is driving you batty, look at the situation as an opportunity to practice your assertion skills. If your PC won’t come on, look at the situation as an opportunity to challenge yourself, as you might with an anagram. If your investments go sour, think of the situation as a challenge: Do you still have what it takes to make yourself rich through earnings or investment?

43. Think confidently
Confidence helps us persist in problem solving, and confidence comes most powerfully from problem solving success. So, think about past problem solving successes or solve another problem to boost your confidence about solving a specific problem. Useful thoughts include “I have solved more difficult (or similar) problems,” “I know how to approach this problem,” and “I can solve this problem if I try hard enough.”

44. Take a break
People can get fixed on a certain way of thinking about a problem or a specific class of possible solutions. It sometimes helps to take a break and think about matters unrelated to the problem in order to open the mind to new ideas. Some people benefit from sleeping on a problem.

45. Persist
Persistence in problem solving often pays off. It took many years to build the Great Wall of China. It may take you some time to solve a problem. Your odds of success often go to 0 when you give up. With continued effort, you have a chance. So, whether you want to want to become a millionaire or you want to eliminate the use of land mines, persist. If one possible solution fails, try another one or try another problem solving strategy. Note though that persistence can become maladaptive if the goal is unrealistic. In some cases, the best course is to accept a problem as presently unsolvable and focus (with persistence) on other, solvable problems.

46. Adopt a problem solving orientation
People who look for problems to solve have a decided advantage over others. These individuals can often identify problems when the problems are small enough to be easily solved and when enough time is available to allow the use of good problem solving strategies. For instance, it is far easier to lose a few kilograms of weight than to lose 50 kilos. Individuals who wait for problems to become unbearable or unavoidable before dealing with them may experience unnecessary stress when circumstances force them to tackle a problem. Naturally, looking for problems to solve will tend to lead to more problems solved. A math student who does all the problems in a textbook rather than just the half assigned is an example of that principle. So is an executive who looks for problems that keep her workers from being productive.

47. Apply triage
Often there are multiple problems a person could try to solve at any one time. Emergency room physicians have developed the custom of triage, which is assessing the urgency of the health problem of each of the current patients. In problem solving, it is wise to consider during triage which problem has (1) the most important outcome, (2) the greatest chance for solution, and (3) the nearest deadline. So, if you lose your 3-year-old child in an outdoor crowd and your 8-year-old child has a headache, you focus on the lost child because the risk of harm is greater with that child. If you have two problems to solve, and one, such as developing a method of time travel, seems currently unsolvable, work on the other problem first. If you have two important problem-solving assignments, with one due tomorrow and one due in a week, focus first on completing the one due tomorrow. Sometimes the problem with the most important outcome is different from the problem with the best chance of solution or the nearest deadline. Then you have to apply your own judgment in weighing the triage considerations.

48. Solve one problem at a time
When faced with multiple problems, individuals may panic or lose hope and then quit trying. When facing more than one problem, to the extent possible, focus on solving one at a time. So if you are overweight and smoke, choose one of these problems to work on at a time. If you dislike your job and your roommate, choose one to work on. If you want to improve your writing and speaking skills, choose one with which to start.

Assignment Topic 2: As a system administrator you need to be familiar with the types of threats. Discuss some of the common threats that the IT industry have come across



http://csrc.nist.gov/publications/nistpubs/800-12/800-12-html/chapter4.html
Errors and Omissions
These errors are caused not only by data entry clerks processing hundreds of transactions per day, but also by all types of users who create and edit data.
A sound awareness and training program can help an organization reduce the number and severity of errors and omissions.

Users, data entry clerks, system operators, and programmers frequently make errors that contribute directly or indirectly to security problems. In some cases, the error is the threat, such as a data entry error or a programming error that crashes a system. In other cases, the errors create vulnerabilities. Errors can occur during all phases of the systems life cycle.
A long-term survey of computer-related economic losses conducted by Robert Courtney, a computer security consultant and former member of the Computer System Security and Privacy Advisory Board, found that 65 percent of losses to organizations were the result of errors and omissions.

Programming and development errors, often called "bugs," can range in severity from benign to catastrophic. In a 1989 study for the House Committee on Science, Space and Technology, entitled Bugs in the Program, the staff of the Subcommittee on Investigations and Oversight summarized the scope and severity of this problem in terms of government systems as follows:
These concerns are heightened as computers perform more critical tasks, where mistakes can cause financial turmoil, accidents, or in extreme cases, death.

Since the study's publication, the software industry has changed considerably, with measurable improvements in software quality. Yet software "horror stories" still abound, and the basic principles and problems analyzed in the report remain the same. While there have been great improvements in program quality, as reflected in decreasing errors per 1,000 lines of code, the concurrent growth in program size often seriously diminishes the beneficial effects of these program quality enhancements.
Installation and maintenance errors are another source of security problems.
Fraud and Theft
Computer systems can be exploited for both fraud and theft both by "automating" traditional methods of fraud and by using new methods. For example, individuals may use a computer to skim small amounts of money from a large number of financial accounts, assuming that small discrepancies may not be investigated. Financial systems are not the only ones at risk. Systems that control access to any resource are targets (e.g., time and attendance systems, inventory systems, school grading systems, and long-distance telephone systems).
In addition to the use of technology to commit fraud and theft, computer hardware and software may be vulnerable to theft.
Employee Sabotage
Employees are most familiar with their employer's computers and applications, including knowing what actions might cause the most damage, mischief, or sabotage. The downsizing of organizations in both the public and private sectors has created a group of individuals with organizational knowledge, who may retain potential system access (e.g., if system accounts are not deleted in a timely manner). The number of incidents of employee sabotage is believed to be much smaller than the instances of theft, but the cost of such incidents can be quite high.
The motivation for sabotage can range from altruism to revenge:

Common examples of computer-related employee sabotage include:
destroying hardware or facilities,
planting logic bombs that destroy programs or data,
entering data incorrectly,
"crashing" systems,
deleting data,
holding data hostage,
changing data
As long as people feel cheated, bored, harassed, endangered, or betrayed at work, sabotage will be used as a direct method of achieving job satisfaction -- the kind that never has to get the bosses' approval.
Loss of Physical and Infrastructure Support
The loss of supporting infrastructure includes power failures (outages, spikes, and brownouts), loss of communications, water outages and leaks, sewer problems, lack of transportation services, fire, flood, civil unrest, and strikes. These losses include such dramatic events as the explosion at the New York World Trade Centre as well as more common events, such as broken water pipes. A loss of infrastructure often results in system downtime, sometimes in unexpected ways. For example, employees may not be able to get to work during a winter storm, although the computer system may be functional.
Malicious Hackers
The term “malicious hackers”, sometimes called “crackers”, refers to those who break into computers without authorization. They can include both outsiders and insiders. Much of the rise of hacker activity is often attributed to increases in connectivity in both government and industry.
The hacker threat should be considered in terms of past and potential future damage. Although current losses due to hacker attacks are significantly smaller than losses due to insider theft and sabotage, the hacker problem is widespread and serious. One example of malicious hacker activity is that directed against the public telephone system.

Studies by the National Research Council and the National Security Telecommunications Advisory Committee show that hacker activity is not limited to toll fraud. It also includes the ability to break into telecommunications systems (such as switches), resulting in the degradation or disruption of system availability. While unable to reach a conclusion about the degree of threat or risk, these studies underscore the ability of hackers to cause serious damage.
The hacker threat often receives more attention than more common and dangerous threats. The U.S. Department of Justice's Computer Crime Unit suggests three reasons for this.
First, the hacker threat is a more recently encountered threat. Organizations have always had to worry about the actions of their own employees and could use disciplinary measures to reduce that threat. However, these measures are ineffective against outsiders who are not subject to the rules and regulations of the employer.
Second, organizations do not know the purposes of a hacker -- some hackers browse, some steal, some damage. This inability to identify purposes can suggest that hacker attacks have no limitations.
Third, hacker attacks make people feel vulnerable, particularly because their identity is unknown. For example, suppose a painter is hired to paint a house and, once inside, steals a piece of jewelry. Other homeowners in the neighborhood may not feel threatened by this crime and will protect themselves by not doing business with that painter. But if a burglar breaks into the same house and steals the same piece of jewelry, the entire neighborhood may feel victimized and vulnerable.
Industrial Espionage
Industrial espionage is the act of gathering proprietary data from private companies or the government for the purpose of aiding another company. Industrial espionage can be perpetrated either by companies seeking to improve their competitive advantage or by governments seeking to aid their domestic industries. Since information is processed and stored on computer systems, computer security can help protect against such threats; it can do little, however, to reduce the threat of authorized employees selling that information.

The three most damaging types of stolen information were pricing information, manufacturing process information, and product development and specification information. Other types of information stolen included customer lists, basic research, sales data, personnel data, compensation data, cost data, proposals, and strategic plans. Technology-related information is the main target, but also lists corporate proprietary information, such as negotiating positions and other contracting data, as a target
Malicious Code
Malicious code refers to viruses, worms, Trojan horses, logic bombs, and other "uninvited" software. Sometimes mistakenly associated only with personal computers, malicious code can attack other platforms.

Key Terms reference (NIST Special Publication 800-5)

Virus: A code segment that replicates by attaching copies of itself to existing executables. The new copy of the virus is executed when a user executes the new host program. The virus may include an additional "payload" that triggers when specific conditions are met. For example, some viruses display a text string on a particular date. There are many types of viruses, including variants, overwriting, resident, stealth, and polymorphic.
Trojan Horse: A program that performs a desired task, but that also includes unexpected (and undesirable) functions. Consider as an example an editing program for a multi-user system. This program could be modified to randomly delete one of the users' files each time they perform a useful function (editing), but the deletions are unexpected and definitely undesired!
Worm: A self-replicating program that is self-contained and does not require a host program. The program creates a copy of itself and causes it to execute; no user intervention is required. Worms commonly use network services to propagate to other host systems.
Foreign Government Espionage
Some unclassified information that may be of interest includes travel plans of senior officials, civil defense and emergency preparedness, manufacturing technologies, satellite data, personnel and payroll data, and law enforcement, investigative, and security files.
Threats to Personal Privacy
The threat to personal privacy arises from many sources. In several cases federal and state employees have sold personal information to private investigators or other "information brokers."
It is apparent that information technology is becoming powerful enough to warrant fears of both government and corporate "Big Brothers." Increased awareness of the problem is needed.

Assignment Topic 3: A server generates error messages when certain events develop. Give some examples of error messages from an operating system that you have investigated. How can they be used in response to rectify system problems?

(Examples of operating systems that you could come across are: Win NT/2000/XP/2003, Sun Solaris/SunOS, HP-UX, AIX, Digital Unix, VMS, Linux, and Novell NetWorking

When the server encounters a problem, it displays information--in an error message that describes whether the problem is caused by the user or the system--about the problem, how serious it is, and what you can do to fix it. The error message consists of:
· A message number, which uniquely identifies the error message
· A severity level number which indicates the type and severity of the problem
· An error state number, which allows unique identification of the line of server code at which the error was raised
· An error message, which tells you what the problem is, and may suggest how to fix it
To illustrate the types of messages from computer system errors, Table 3 below is a segment of the error messages generated by Microsoft Windows XP once the system encounters a network problem: (Reference http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/errors_overview.mspx )
These are viewed in “Help” and “Support Center” on the Windows XP Professional platform. To view them on the Windows XP Professional computer, click Start, click Help and Support, type network error messages into the Search box, and then select the topic wanted.
Table 3 shows that the error message database is very comprehensive for troubleshooting.
Table 3
600 An operation is pending
601 An invalid port handle was detected
602 The specified port is already open
603 The caller's buffer is too small
604 Incorrect information was specified
605 The port information cannot be set
606 The specified port is not connected
607 An invalid event is detected
608 A device was specified that does not exist
609 The device type was specified that does not exist
610 An invalid buffer was specified
611 A route was specified that is not available
612 A route was specified that is not allocated
613 An invalid compression was specified
614 There were insufficient buffers available
615 The specified port was not found
616 An asynchronous request is pending
617 The modem is already disconnecting
618 The specified port is not open
619 The specified port is not connected
620 No endpoints could be determined
621 The system could not open the phonebook
622 The system could not load the phonebook
623 The system could not find the phonebook entry for this connection
624 The system could not update the phonebook file
625 The system found invalid information in the phonebook
626 A string could not be loaded
627 A key could not be found
628 The connection was closed
629 The connection was closed by the remote computer
630 The modem was disconnected due to hardware failure
631 The user disconnected the modem
632 An incorrect structure size was detected
633 The modem is already in use or is not configured for dialing out
634 Your computer could not be registered on the remote network
635 There was an unknown error
636 The device attached to the port is not the one expected
637 A string was detected that could not be converted
638 The request has timed out
639 No asynchronous net is available
640 A error has occurred involving NetBIOS
641 The server cannot allocate NetBIOS resources needed to support the client
642 One of your computer's NetBIOS names is already registered on the remote network
643 A network adapter at the server failed
644 You will not receive network message popups
645 There was an internal authentication error
646 The account is not permitted to log on at this time of day
647 The account is disabled
648 The password for this account has expired
649 The account does not have permission to dial in
650 The remote access server is not responding
651 The modem has reported an error
652 There was an unrecognized response from the modem
653 A macro required by the modem was not found in the device .INF file section
654 A command or response in the device .INF file section refers to an undefined macro
655 The macro was not found in the device .INF file section
656 The macro in the device .INF file section contains an undefined macro
657 The device .INF file could not be opened
658 The device name in the device .INF or media .INI file is too long
659 The media .INI file refers to an unknown device name
660 The device .INF file contains no responses for the command
661 The device .INF file is missing a command
662 There was an attempt to set a macro not listed in the device .INF file section
663 The media .INI file refers to an unknown device type
664 The system has run out of memory
665 The modem is not properly configured
666 The modem is not functioning
667 The system was unable to read the media .INI file
668 The connection was terminated
669 The usage parameter in the media .INI file is invalid
670 The system was unable to read the section name from the media .INI file
671 The system was unable to read the device type from the media .INI file
672 The system was unable to read the device name from the media .INI file
673 The system was unable to read the usage from the media .INI file
674 The system was unable to read the maximum connection BPS rate from the media .INI file
675 The system was unable to read the maximum carrier connection speed from the media .INI file
676 The phone line is busy
677 A person answered instead of a modem
678 There was no answer
679 The system could not detect the carrier
680 There was no dial tone
681 The modem reported a general error
691 Access was denied because the user name and/or password was invalid on the domain
692 There was a hardware failure in the modem
695 The state machines are not started
696 The state machines are already started
697 The response looping did not complete
699 The modem response caused a buffer overflow
700 The expanded command in the device .INF file is too long
701 The modem moved to a connection speed not supported by the COM driver
703 The connection needs information from you, but the application does not allow user interaction
704 The callback number is invalid
705 The authorization state is invalid
707 There was an error related to the X.25 protocol
708 The account has expired
709 There was an error changing the password on the domain. The password might have been too short or might have matched a previously used password
710 Serial overrun errors were detected while communicating with the modem
711 The Remote Access Service Manager could not start. Additional information is provided in the event log
712 The two-way port is initializing. Wait a few seconds and redial
713 No active ISDN lines are available
714 No ISDN channels are available to make the call
715 Too many errors occurred because of poor phone line quality
716 The remote access service IP configuration is unusable
717 No IP addresses are available in the static pool of remote access service IP addresses
718 The connection timed out waiting for a valid response from the remote computer
719 The connection was terminated by the remote computer
720 The connection attempt failed because your computer and the remote computer could not agree on PPP control protocols
721 The remote computer is not responding
722 Invalid data was received from the remote computer. This data was ignored
723 The phone number, including prefix and suffix, is too long
726 The IPX protocol cannot be used for dial-out on more than one modem at a time
728 The system cannot find an IP adapter
729 SLIP cannot be used unless the IP protocol is installed
731 The protocol is not configured
732 Your computer and the remote computer could not agree on PPP control protocols
733 Your computer and the remote computer could not agree on PPP control protocols
734 The PPP link control protocol was terminated
735 The requested address was rejected by the server
736 The remote computer terminated the control protocol
737 Loopback detected
738 The server did not assign an address
739 The authentication protocol required by the remote server cannot use the stored password. Redial, entering the password explicitly
740 An invalid dialing rule was detected
741 The local computer does not support the required data encryption type
742 The remote computer does not support the required data encryption type
743 The remote server requires data encryption
751 The callback number contains an invalid character. Only the following characters are allowed: 0 to 9, T, P, W, (,), -, @, and space
752 A syntax error was encountered while processing a script
753 The connection could not be disconnected because it was created by the multi-protocol router
754 The system could not find the multi-link bundle
755 The system cannot perform automated dial because this entry has a custom dialer specified
756 This connection is already being dialed
757 Remote access services could not be started automatically. Additional information is provided in the event log
758 Internet Connection Sharing is already enabled on the connection
760 An error occurred while routing capabilities were being enabled
761 An error occurred while Internet Connection Sharing was being enabled for the connection
763 Internet Connection Sharing cannot be enabled. There are two or more LAN connections in addition to the connection to be shared
764 No smart card reader is installed
765 Internet Connection Sharing cannot be enabled. A LAN connection is already configured with the IP address required for automatic IP addressing
766 The system could not find any certificate
767 Internet Connection Sharing cannot be enabled. The LAN connection selected on the private network has more than one IP address configured. Reconfigure the LAN connection with a single IP address before enabling Internet Connection Sharing
768 The connection attempt failed because of failure to encrypt data
769 The specified destination is not reachable
770 The remote machine rejected the connection attempt
771 The connection attempt failed because the network is busy
772 The remote computer's network hardware is incompatible with the type of call requested
773 The connection attempt failed because the destination number has changed
774 The connection attempt failed because of a temporary failure. Try connecting again
775 The call was blocked by the remote computer
776 The call could not be connected because the destination has invoked the Do Not Disturb feature
777 The connection attempt failed because the modem on the remote computer is out of order
778 It was not possible to verify the identity of the server
779 To dial out using this connection, you must use a smart card
780 An attempted function is not valid for this connection
781 The encryption attempt failed because no valid certificate was found
782 Network Address Translation (NAT) is currently installed as a routing protocol, and must be removed before enabling Internet Connection Sharing
783 Internet Connection Sharing cannot be enabled. The LAN connection selected as the private network is either not present, or is disconnected from the network. Please ensure that the LAN adapter is connected before enabling Internet Connection Sharing
784 You cannot dial using this connection at logon time, because it is configured to use a user name different than the one on the smart card. If you want to use it at logon time, you must configure it to use the user name on the smart card
785 You cannot dial using this connection at logon time, because it is not configured to use a smart card. If you want to use it at logon time, you must edit the properties of this connection so that it uses a smart card
786 The L2TP connection attempt failed because there is no valid machine certificate on your computer for security authentication
787 The L2TP connection attempt failed because the security layer could not authenticate the remote computer
788 The L2TP connection attempt failed because the security layer could not negotiate compatible parameters with the remote computer
789 The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer
790 The L2TP connection attempt failed because certificate validation on the remote computer failed
791 The L2TP connection attempt failed because security policy for the connection was not found
792 The L2TP connection attempt failed because security negotiation timed out
793 The L2TP connection attempt failed because an error occurred while negotiating security
794 The Framed Protocol RADIUS attribute for this user is not PPP
795 The Tunnel Type RADIUS attribute for this user is not correct
796 The Service Type RADIUS attribute for this user is neither Framed nor Callback Framed
797 A connection to the remote computer could not be established because the modem was not found or was busy
798 A certificate could not be found that can be used with this Extensible Authentication Protocol
799 Internet Connection Sharing (ICS) cannot be enabled due to an IP address conflict on the network. ICS requires the host be configured to use 192.168.0.1. Please ensure that no other client on the network is configured to use 192.168.0.1
800 Unable to establish the VPN connection. The VPN server may be un-reachable, or security parameters may not be configured properly for this connection
The error message is registered in an error log. An example of error log format from Sybase is given below:
The entries in the error log include the following information:
1. The engine involved for each log entry. The engine number is indicated by a 2-digit number. If only one engine is online, the display is "00."
2. The family ID of the originating thread:
o In serial processing, the display is "00000."
o In parallel processing, the display is the server process ID number of the parent of the originating thread.
3. The server process ID of the originating thread:
o In serial processing, this is the server process ID number of the thread that generated the message. If the thread is a system task, then the display is "00000."
o In parallel processing, this is the server process ID number of the originating thread.
4. The date, displayed in the format yyyy/mm/dd
, which allows you to sort error messages by date.
5. The time, displayed in 24-hour format, includes seconds and hundredths of a second.
6. The word "server" or "kernel." This entry is for Sybase Technical Support use only.
7. The error message itself.
The following diagram illustrates two examples of a line from an error log, one for a single-engine server, the other is for a multi-engine server.

When using error messages for diagnostics, the severity level of a message enables the administrator to understand the fault.
For the Sun Solaris system, the following are the severity levels.
Levels 10-18
Error messages with severity levels 10-16 are generated by problems that are caused by user errors. These problems can always be corrected by the user. Severity levels 17 and 18 do not terminate the user's session.
Error messages with severity levels 17 and higher need to be reported to the System Administrator or Database Owner.
Levels 17 and 18 are usually not reported in the error log. Users are instructed to notify the System Administrator when level 17 and 18 errors occur.
Level 17: Insufficient resources
Error messages with severity level 17 mean that the command has caused the Sun Adaptive Server1 to run out of resources or to exceed some limit set by the System Administrator. The user can continue with the work, although the user may not be able to execute a particular command.
The Database Owner can correct the level 17 error messages indicating that you have run out of space. Other level 17 error messages should be corrected by the System Administrator.
Level 18: Non-fatal internal error detected
Error messages with severity level 18 indicate internal software bugs. However, the command runs to completion, and the connection to Adaptive Server1 is maintained. The user can continue with the work, although the user may not be able to execute a particular command.
An example of a situation that generates severity level 18 is when the Server detects that a decision about the access path for a particular query has been made without a valid reason.
Since problems that generate such messages do not keep users from their work, users tend not to report them.
Users need to be instructed to inform the System Administrator every time an error message with this severity level (or higher) occurs so that the System Administrator can report them for investigation.
Severity levels 19-26
Fatal problems generate error messages with severity levels 19 and higher, and they break the user's connection to the Server (some of the higher severity levels shut down the Server).
To continue working, the user must restart the client program.
When a fatal error occurs, the process freezes its state before it stops, recording information about what was happening. It is then killed and disappears.
When the user's connection is broken, he or she may or may not be able to reconnect and resume working.
Some problems with severity levels in this range affect only one user and one process. Others affect all the processes in the database. In some cases, it will be necessary to restart Adaptive Server1. These problems do not necessarily damage a database or its objects, but they can. They may also result from earlier damage to a database or its objects. Other problems are caused by hardware malfunctions.
A “back trace” of fatal error messages from the kernel is directed to the error log file, where the System Administrator can review it.
Here are examples (level 19 and 20)
Level 19: Adaptive Server1 fatal error in resource
Error messages with severity level 19 indicate that some non-configurable internal limit has been exceeded and that the server cannot recover gracefully. It is necessary to re-connect to the server.
Level 20: Server fatal error in current process
Error messages with severity level 20 indicate that server has encountered a bug in a command. The problem has affected only the current process, and it is unlikely that the database itself has been damaged. The administrator needs to run dbcc diagnostics (an Adaptive Server1 utility). The administrator needs to reconnect to Adaptive Server1.
For reporting errors, include the following::
· The message number, level number, and state number.
· Any numbers, database object types, or database object names that are included in the error message.
· The context in which the message was generated, that is, which command was running at the time. You can help by providing a hard copy of the backtrace from the error log.
Using the Sybase Utility Guide as an example, the backup server also has error logging, and it creates an error log if one does not already exist.
Backup Server error messages are in the form:MMM DD YYY: Backup Server:N.N.N.N: Message Text
Backup Server message numbers consist of 4 integers separated by periods, in the form N.N.N.N. Messages in the form N.N.N are sent by Open Server(TM).
The four components of a Backup Server error message are major.minor.severity.state:
1. The major component generally indicates the functional area of the Backup Server code where the error occurred:
o 1 - System errors
o 2 - Open Server event errors
o 3 - Backup Server remote procedure call errors
o 4 - I/O service layer errors
o 5 - Network data transfer errors
o 6 - Volume handling errors
o 7 - Option parsing errors
Major error categories 1- 6 may result from Backup Server internal errors or a variety of system problems. Major errors in category 7 are almost always due to problems in the options you specified in your dump or load command.
2. Minor numbers are assigned in order within a major category.
3. The severity is:
o 1 - Informational, no user action necessary.
o 2, 3 - An unexpected condition, possibly fatal to the session, has occurred. The error may have occurred with usage, environment, or internal logic, or any combination of these factors.
o 4 - An unexpected condition, fatal to the execution of the Backup Server, has occurred. The Backup Server must exit immediately.
4. State codes have a one-to-one mapping to instances of the error report within the code. If you need to contact Technical Support about Backup Server errors, the state code helps determine the exact cause of the error.
When errors are detected, the System Administrator sometimes need to consider stopping the process, also refer to as killing the process. The kill command gets rid of an ongoing process. The most frequent reason for killing a process is that it interferes with other users and the person responsible for running it is not available. The process may hold locks that block access to database objects, or there may be many sleeping processes occupying the available user connections. A System Administrator can kill processes that are:
· Waiting for an alarm, such as a waitfor command
· Waiting for network sends or receives
· Waiting for a lock
· Waiting for synchronization messages from another process in a family
· Most running or "runnable" processes
Adaptive Server1 allows you to kill processes only if it can cleanly roll back any uncompleted transactions and release all system resources that are used by the process.
For processes that are part of a family (inheritance feature in object oriented programming), killing any of the child processes will also kill all other processes in the family. However, it is easiest to kill the parent process. For a family of processes, the kill command is detected more quickly if the status of the child processes is (1) sync or (2) sleep.
Only the System Administrator can issue the kill command; permission to use it cannot be transferred. Deactivation is only one process at a time, but you can perform a series of kill commands in a batch.
A kill command is not reversible and cannot be included in a user-defined transaction. Spid must be a numeric constant; you cannot use a variable.
In the Sun Solaris Performance and Tuning Guide, there is a function called “sp_lock” and it is used to examine blocking processes.
Occasionally a query or procedure causes Server Monitor to hang.
Users with the System Administrator role can configure Adaptive Server1 to give Adaptive Server1 Monitor access to the text of the currently executing SQL batch.
Viewing the SQL text of long-running batches helps debug hung processes or fine-tune long statements that are heavy resource consumers.
The Server needs to be configured to collect the SQL batch text and write it to shared memory, where the text can be read by Adaptive Server1 Monitor Server (the server component of Adaptive Server1 Monitor).
Configuring the server to save SQL batch text also allows the viewing of the current query plan in what is called a “showplan” format. This can be viewed from within the Sun Solaris Adaptive Server1 SQL batches are viewable only through Adaptive Server1 Monitor Server.
Finally, part of the troubleshooting strategy is to learn about known problems. The release bulletin from the platform of choice is a valuable resource for learning about known problems or incompatibilities with the server and backup server. Reading the release bulletin in advance can save the time and guesswork of troubleshooting known problems

Note 1: Background on the term, Adaptive Server
It is the server computer for the Adaptive Server Enterprise Database Management System (DBMS). Adaptive Server Enterprise (ASE) is Sybase Corporation's flagship relational database management system product.
ASE is a direct descendant of Sybase SQL Server as it was a change in name only starting from version 11.5 in 1996. In 1998, ASE 11.9.2 was rolled out with support for row-level locking and distributed joins and improved SMP performance. ASE 12.0 was released in 1999 providing support for Java, high availability and distributed transaction management. In 2001, ASE 12.5 was released providing features such as dynamic memory allocation and support for XML and SSL among others. Support of an EJB container within the database server along with efficient in-memory connections to the database engine, suggests an object oriented access to the relational data.




ASSESSOR NOTES: ADDITIONAL FEATURES AROUND WHICH QUESTIONS CAN BE STRUCTURED
Using system software and system tools
Security and network guidelines/procedures
Approaches to back up and restoring computer data
Help desk and maintenance practices
System performance
Practical and concepts of diagnostic tools
Operating systems
Win 95/98/NT/2000
Sun Solaris/SunOS
HP-UX
AIX
Digital Unix
Silicon Graphics IRIX
DOS
DEC
VMS
Mac OSX
Linux
NetWare
Hardware
Workstations, PCs, IBM, Compaq, Hewlett Packard, Sun, Dell, Gateway 2000, SGI, Sun Microsystems
Bridges, 3Com, Compaq, CISCO, IBM
Modems, analog, cable, ISDN, DSL
servers, Acer, Apple, Compaq, Dell, Gateway 2000, Hewlett-Packard, IBM, Macintosh, NEC, SGI, Sun Microsystems, Unisys
Network cards, Adaptec, ARTIC, Compex, SMC
Switches, 3Com, Accton, Cabletron, CISCO, D-Link, Farallon, Hewlett-Packard, Intel, Network Technologies
hubs & repeaters, 3Com, Compaq, CISCO, Accton, Asante, D-Link, Farallon, Hewlett-Packard, Intel, Omnitron
Routers & gateways, 3Com, CISCO, D-Link, Intel
File & print servers, AcerAltos, Aerocomm, AlphaServer, Dell, D-Link, Hewlett-Packard, IBM, NEC, Sun Microsystems
Software
Most likely to be packaged software but can be supplied from many varying vendors and can include full suites or individual components:
Intranet Connections
ColdFusion
Xpedio
Samba
ERoom
Collabra Share.
Groupware/email/office
Possible groupware applications and servers include:
Novell Groupwise
Lotus Notes, Domino
MS Exchange
Netscape SuiteSpot
Teamware Office
Email applications
Group calendars
Collaborative writing systems
Shared whiteboards
Decision support systems
Application/web servers; BEA Weblogic Servers, IBM VisualAge and WebSphere, Microsoft Host Integration Server, NetDynamics, Netscape Application Server
Email Servers
File & Print Servers
FTP Servers
Proxy Servers