• Connectionless
  • Each packet is transported independently from other packets
• Unreliable
  • Delivery on a best effort basis
  • acknowledgments
  • Packets may be lost, reordered, corrupted, or duplicated
• packets
  • Encapsulate TCP and UDP packets
  • Encapsulated into link-layer frames

• addresses
  • IPv4: 32-bit addresses
  • IPv6: 128-bit addresses
• Address subdivided into network, subnet, and host
  • , 128.148.32.110
• Broadcast addresses
  • , 128.148.32.255
• Private networks
  • not routed outside of a LAN
  • 0.0/8
  • 0.0/12
  • 0.0/16

header includes

• Source address
• Destination address
• Packet length (up to 64KB)
• Time to live (up to 255)
• protocol version
• Fragmentation information
• Transport layer protocol information (e.g., TCP)

• Hosts on the internet must have unique IP addresses
• Internet Corporation for Assigned Names and Numbers
  • International nonprofit organization
  • Incorporated in the US
  • Allocates IP address space
  • Manages top-level domains
• Historical bias in favor of US corporations and nonprofit organizations

Examples

3. 8 May 94 General Electric
4. 8 Aug 92 IBM
5. 8 Jun 95 AT&T Bell Labs
6. 8 Sep 91 Xerox Corporation
7. 8 Jul 94 Hewlett-Packard
8. 8 Jul 92 Apple Computer
9. 8 Jan 94 MIT
10. 8 May 95 Ford Motor
11. 8 Jun 94 Eli Lily
12. 8 Jan 91 Japan Inet
13. 8 Jul 92 Amateur Radio Digital
14. 8 Jan 91 Bell-Northern Res.
15. 8 May 95 Prudential Securities
16. 8 Mar 92 Merck
17. 8 Apr 95 Boeing
18. 8 Jun 94 U.S. Postal Service

• Most universities separate their network connecting dorms and the network connecting offices and academic buildings
• Dorms
  • Class B network 138.16.0.0/16 (64K addresses)
• Academic buildings and offices
  • Class B network 128.148.0.0/16 (64K addresses)
• department
  • Several class C (/24) networks, each with 254 addresses

• router bridges two or more networks
  • Operates at the network layer
  • Maintains tables to forward packets to the appropriate network
  • Forwarding decisions based solely on the destination address
• Routing table
  • Maps ranges of addresses to LANs or other gateway routers

• Internet Control Message Protocol (ICMP)
  • Used for network testing and debugging
  • Simple messages encapsulated in single IP packets
  • Considered a network layer protocol
• Tools based on ICMP
  • Ping: sends series of echo request messages and provides statistics on roundtrip times and packet loss
  • Traceroute: sends series ICMP packets with increasing TTL value to discover routes

• Ping of death
  • ICMP specifies messages must fit a single IP packet (64KB)
  • Send a ping packet that exceeds maximum size using IP fragmentation
  • Reassembled packet caused several operating systems to crash due to a buffer overflow
• Smurf
  • Ping a broadcast address using a spoofed source address

• Unencrypted transmission
  • Eavesdropping possible at any intermediate host during routing
• source authentication
  • Sender can spoof source address, making it difficult to trace packet back to attacker
• integrity checking
  • Entire packet, header and payload, can be modified while en route to destination, enabling content forgeries, redirections, and man-in-the-middle attacks
• bandwidth constraints
  • Large number of packets can be injected into network to launch a denial-of-service attack
  • Broadcast addresses provide additional leverage

• Send large number of packets to host providing service
  • Slows down or crashes host
  • Often executed by botnet
• Attack propagation
  • Starts at zombies
  • Travels through tree of internet routers rooted
  • Ends at victim
• source spoofing
  • Hides attacker
  • Scatters return traffic from victim

• Problem
  • How to identify leaves of DoS propagation tree
  • Routers next to attacker
• Issues
  • There are more than 2M internet routers
  • Attacker can spoof source address
  • Attacker knows that traceback is being performed
• Approaches
  • Filtering and tracing (immediate reaction)
  • Messaging (additional traffic)
  • Logging (additional storage)
  • Probabilistic marking

• Method
  • Random injection of information into packet header
  • Changes seldom used bits
  • Forward routing information to victim
  • Redundancy to survive packet losses
• Benefits
  • additional traffic
  • router storage
  • packet size increase
  • Can be performed online or offline

• TCP is a transport layer protocol guaranteeing reliable data transfer, in-order delivery of messages and the ability to distinguish data for multiple concurrent applications on the same host
• Most popular application protocols, including WWW, FTP and SSH are built on top of TCP
• TCP takes a stream of 8-bit byte data, packages it into appropriately sized segment and calls on IP to transmit these packets
• Delivery order is maintained by marking each packet with a sequence number
• Every time TCP receives a packet, it sends out an ACK to indicate successful receipt of the packet.
• TCP generally checks data transmitted by comparing a checksum of the data with a checksum encoded in the packet

• TCP supports multiple concurrent applications on the same server
• Accomplishes this by having ports, 16 bit numbers identifying where data is directed
• The TCP header includes space for both a source and a destination port, thus allowing TCP to route all data
• most cases, both TCP and UDP use the same port numbers for the same applications
• Ports 0 through 1023 are reserved for use by known protocols.
• Ports 1024 through 49151 are known as user ports, and should be used by most user programs for listening to connections and the like
• Ports 49152 through 65535 are private ports used for dynamic allocation by socket libraries

• TCP connections are established through a three way handshake.
• The server generally has a passive listener, waiting for a connection request
• The client requests a connection by sending out a SYN packet
• The server responds by sending a SYN/ACK packet, indicating an acknowledgment for the connection
• The client responds by sending an ACK to the server thus establishing connection

• Typically DOS attack, though can be combined with other attack such as TCP hijacking
• Rely on sending TCP connection requests faster than the server can process them
• Attacker creates a large number of packets with spoofed source addresses and setting the SYN flag on these
• The server responds with a SYN/ACK for which it never gets a response (waits for about 3 minutes each)
• Eventually the server stops accepting connection requests, thus triggering a denial of service.
• Can be solved in multiple ways
• One of the common way to do this is to use SYN cookies

• During connection initialization using the three way handshake, initial sequence numbers are exchanged
• The TCP header includes a 16 bit checksum of the data and parts of the header, including the source and destination
• Acknowledgment or lack thereof is used by TCP to keep track of network congestion and control flow and such
• TCP connections are cleanly terminated with a 4-way handshake
  • The client which wishes to terminate the connection sends a FIN message to the other client
  • The other client responds by sending an ACK
  • The other client sends a FIN
  • The original client now sends an ACK, and the connection is terminated

• During the mid-80s it was discovered that uncontrolled TCP messages were causing large scale network congestion
• TCP responded to congestion by retransmitting lost packets, thus making the problem was worse
• What is predominantly used today is a system where ACKs are used to determine the maximum number of packets which should be sent out
• Most TCP congestion avoidance algorithms, avoid congestion by modifying a congestion window (cwnd) as more cumulative ACKs are received
• Lost packets are taken to be a sign of network congestion
• TCP begins with an extremely low cwnd and rapidly increases the value of this variable to reach bottleneck capacity
• this point it shifts to a collision detection algorithm which slowly probes the network for additional bandwidth
• TCP congestion control is a good idea in general but allows for certain attacks.

• optimistic ACK attack takes advantage of the TCP congestion control
• begins with a client sending out ACKs for data segments it hasn’t yet received
• This flood of optimistic ACKs makes the servers TCP stack believe that there is a large amount of bandwidth available and thus increase cwnd
• This leads to the attacker providing more optimistic ACKs, and eventually bandwidth use beyond what the server has available
• This can also be played out across multiple servers, with enough congestion that a certain section of the network is no longer reachable
• There are no practical solutions to this problem

• Also commonly known as TCP Session Hijacking
• security attack over a protected network
• Attempt to take control of a network session
• Sessions are server keeping state of a client’s connection
• Servers need to keep track of messages sent between client and the server and their respective actions
• Most networks follow the TCP/IP protocol
• Spoofing is one type of hijacking on large network

• Spoofing is an attempt by an intruder to send packets from one IP address that appear to originate at another
• the server thinks it is receiving messages from the real source after authenticating a session, it could inadvertently behave maliciously
• There are two basic forms of IP Spoofing
  • Blind Spoofing
    • Attack from any source
  • Non-Blind Spoofing
    • Attack from the same subnet

• The TCP/IP protocol requires that “acknowledgement” numbers be sent across sessions
• Makes sure that the client is getting the server’s packets and vice versa
• Need to have the right sequence of acknowledgment numbers to spoof an IP identity

• Spoofing without inherently knowing the acknowledgment sequence pattern
  • Done on the same subnet
  • Use a packet sniffer to analyze the sequence pattern
    • Packet sniffers intercept network packets
    • Eventually decodes and analyzes the packets sent across the network
    • Determine the acknowledgment sequence pattern from the packets
    • Send messages to server with actual client's IP address and with validly sequenced acknowledgment number

• Packet sniffers “read” information traversing a network
  • Packet sniffers intercept network packets, possibly using ARP cache poisoning
  • Can be used as legitimate tools to analyze a network
    • Monitor network usage
    • Filter network traffic
    • Analyze network problems
  • Can also be used maliciously
    • Steal information (i.e. passwords, conversations, etc.)
    • Analyze network information to prepare an attack
• Packet sniffers can be either software or hardware based
  • Sniffers are dependent on network setup

• Sniffers are almost always passive
  • They simply collect data
  • They do not attempt “entry” to “steal” data
• This can make them extremely hard to detect
• Most detection methods require suspicion that sniffing is occurring
  • Then some sort of “ping” of the sniffer is necessary
  • should be a broadcast that will cause a response only from a sniffer
• Another solution on switched hubs is ARP watch
  • ARP watch monitors the ARP cache for duplicate entries of a machine
  • such duplicates appear, raise an alarm
  • Problem: false alarms
    • Specifically, DHCP networks can have multiple entires for a single machine

• The best way is to encrypt packets securely
  • Sniffers can capture the packets, but they are meaningless
    • Capturing a packet is useless if it just reads as garbage
  • SSH is also a much more secure method of connection
    • Private/Public key pairs makes sniffing virtually useless
  • switched networks, almost all attacks will be via ARP spoofing
    • Add machines to a permanent store in the cache
    • This store cannot be modified via a broadcast reply
    • Thus, a sniffer cannot redirect an address to itself
• The best security is to not let them in in the first place
  • Sniffers need to be on your subnet in a switched hub in the first place
  • All sniffers need to somehow access root at some point to start themselves up

• Broadly port knocking is the act of attempting to make connections to blocked ports in a certain order in an attempt to open a port
• Port knocking is fairly secure against brute force attacks since there are 65536k combinations, where k is the number of ports knocked
• Port knocking however if very susceptible to replay attacks. Someone can theoretically record port knocking attempts and repeat those to get the same open port again
• One good way of protecting against replay attacks would be a time dependent knock sequence.

• UDP is a stateless, unreliable datagram protocol built on top of IP, that is it lies on level 4
• does not provide delivery guarantees, or acknowledgments, but is significantly faster
• Can however distinguish data for multiple concurrent applications on a single host.
• lack of reliability implies applications using UDP must be ready to accept a fair amount of error packages and data loss. Some application level protocols such as TFTP build reliability on top of UDP.
  • Most applications used on UDP will suffer if they have reliability. VoIP, Streaming Video and Streaming Audio all use UDP.
• UDP does not come with built in congestion protection, so while UDP does not suffer from the problems associated with optimistic ACK, there are cases where high rate UDP network access will cause congestion.

• Introduced in the early 90s to alleviate IPv4 address space congestion
• Relies on translating addresses in an internal network, to an external address that is used for communication to and from the outside world
• NAT is usually implemented by placing a router in between the internal private network and the public network.
• Saves IP address space since not every terminal needs a globally unique IP address, only an organizationally unique one
• While NAT should really be transparent to all high level services, this is sadly not true because a lot of high level communication uses things on IP

• Router has a pool of private addresses 192.168.10.0/24

• Circuit switching
  • Legacy phone network
  • Single route through sequence of hardware devices established when two nodes start communication
  • Data sent along route
  • Route maintained until communication ends
• Packet switching
  • Internet
  • Data split into packets
  • Packets transported independently through network
  • Each packet handled on a best efforts basis
  • Packets may follow different routes

• protocol defines the rules for communication between computers
• Protocols are broadly classified as connectionless and connection oriented
• Connectionless protocol
  • Sends data out as soon as there is enough data to be transmitted
  • , user datagram protocol (UDP)
• Connection-oriented protocol
  • Provides a reliable connection stream between two nodes
  • Consists of set up, transmission, and tear down phases
  • Creates virtual circuit-switched network
  • , transmission control protocol (TCP)

• packet typically consists of
  • Control information for addressing the packet: header and footer
  • Data: payload
• network protocol N1 can use the services of another network protocol N2
  • packet p1 of N1 is encapsulated into a packet p2 of N2
  • The payload of p2 is p1
  • The control information of p2 is derived from that of p1

• Network models typically use a stack of layers
  • Higher layers use the services of lower layers via encapsulation
  • layer can be implemented in hardware or software
  • The bottommost layer must be in hardware
• network device may implement several layers
• communication channel between two nodes is established for each layer
  • Actual channel at the bottom layer
  • Virtual channel at higher layers

• Link layer
  • Local area network: Ethernet, WiFi, optical fiber
  • bit media access control (MAC) addresses
  • Packets called frames
• Network layer
  • Internet-wide communication
  • Best efforts
  • bit internet protocol (IP) addresses in IPv4
  • bit IP addresses in IPv6
• Transport layer
  • bit addresses (ports) for classes of applications
  • Connection-oriented transmission layer protocol (TCP)
  • Connectionless user datagram protocol (UDP)

• The OSI (Open System Interconnect) Reference Model is a network model consisting of seven layers
• Created in 1983, OSI is promoted by the International Standard Organization (ISO)

• Network interface: device connecting a computer to a network
  • Ethernet card
  • WiFi adapter
• computer may have multiple network interfaces
• Packets transmitted between network interfaces
• Most local area networks, (including Ethernet and WiFi) broadcast frames
• regular mode, each network interface gets the frames intended for it
• Traffic sniffing can be accomplished by configuring the network interface to read all frames (promiscuous mode)

• Most network interfaces come with a predefined MAC address
• MAC address is a 48-bit number usually represented in hex
  • , 00-1A-92-D4-BF-86
• The first three octets of any MAC address are IEEE-assigned Organizationally Unique Identifiers
  • , Cisco 00-1A-A1, D-Link 00-1B-11, ASUSTek 00-1A-92
• The next three can be assigned by organizations as they please, with uniqueness being the only constraint
• Organizations can utilize MAC addresses to identify computers on their network
• MAC address can be reconfigured by network interface driver software

• switch is a common network device
  • Operates at the link layer
  • Has multiple ports, each connected to a computer
• Operation of a switch
  • Learn the MAC address of each computer connected to it
  • Forward frames only to the destination computer

• Switches can be arranged into a tree
• Each port learns the MAC addresses of the machines in the segment (subtree) connected to it
• Fragments to unknown MAC addresses are broadcast
• Frames to MAC addresses in the same segment as the sender are ignored

• switch can be configured to provide service only to machines with specific MAC addresses
• Allowed MAC addresses need to be registered with a network administrator
• MAC spoofing attack impersonates another machine
  • Find out MAC address of target machine
  • Reconfigure MAC address of rogue machine
  • Turn off or unplug target machine
• Countermeasures
  • Block port of switch when machine is turned off or unplugged
  • Disable duplicate MAC addresses

• Viewing the MAC addresses of the interfaces of a machine
  • Linux: ifconfig
  • Windows: ipconfig /all
• Changing a MAC address in Linux
  • Stop the networking service: /etc/init.d/network stop
  • Change the MAC address: ifconfig eth0 hw ether <MAC-address>
  • Start the networking service: /etc/init.d/network start
• Changing a MAC address in Windows
  • Open the Network Connections applet
  • Access the properties for the network interface
  • Click “Configure …”
  • the advanced tab, change the network address to the desired value
• Changing a MAC address requires administrator privileges

• The address resolution protocol (ARP) connects the network layer to the data layer by converting IP addresses to MAC addresses
• ARP works by broadcasting requests and caching responses for future use
• The protocol begins with a computer broadcasting a message of the form

who has <IP address1> tell <IP address2>

• When the machine with <IP address1> or an ARP server receives this message, its broadcasts the response

<IP address1> is <MAC address>

• The requestor’s IP address <IP address2> is contained in the link header
• The Linux and Windows command arp - a displays the ARP table

Internet Address Physical Address Type

128.148.31.1 00-00-0c-07-ac-00 dynamic

128.148.31.15 00-0c-76-b2-d7-1d dynamic

128.148.31.71 00-0c-76-b2-d0-d2 dynamic

128.148.31.75 00-0c-76-b2-d7-1d dynamic

128.148.31.102 00-22-0c-a3-e4-00 dynamic

128.148.31.137 00-1d-92-b6-f1-a9 dynamic

• The ARP table is updated whenever an ARP response is received
• Requests are not tracked
• ARP announcements are not authenticated
• Machines trust each other
• rogue machine can spoof other machines

• According to the standard, almost all ARP implementations are stateless
• arp cache updates every time that it receives an arp reply… even if it did not send any arp request!
• is possible to “poison” an arp cache by sending gratuitous arp replies
• Using static entries solves the problem but it is almost impossible to manage!

• Started in 1984
• Originally supposed to be named by function
  • .com for commercial websites, .mil for military
• Eventually agreed upon unrestricted TLDs for .com, .net, .org, .info
• 1994 started allowing country TLDs such as .it, .us
• Tried to move back to hierarchy of purpose in 2000 with creation of .aero, .museum, etc.

• Control distributed among authoritative name servers (ANSs)
  • Responsible for specific domains
  • Can designate other ANS for subdomains
• ANS can be master or slave
  • Master contains original zone table
  • Slaves are replicas, automatically updating
• Makes DNS fault tolerant, automatically distributes load
• ANS must be installed as a NS in parents' zone

• Many large providers have more than one authoritative name server for a domain
• Problem: need to locate the instance of domain geographically closest to user
• Proposed solution: include first 3 octets of requester's IP in recursive requests to allow better service
• Content distribution networks already do adaptive DNS routing

• Changing IP associated with a server maliciously:

• Basic idea: give DNS servers false records and get it cached
• DNS uses a 16-bit request identifier to pair queries with answers
• Cache may be poisoned when a name server:
  • Disregards identifiers
  • Has predictable ids
  • Accepts unsolicited DNS records

• Use random identifiers for queries
• Always check identifiers
• Port randomization for DNS requests
• Deploy DNSSEC
  • Challenging because it is still being deployed and requires reciprocity

• internal network connected to Internet via router firewall
• router filters packet-by-packet, decision to forward/drop packet based on:
  • source IP address, destination IP address
  • TCP/UDP source and destination port numbers
  • ICMP message type
  • TCP SYN and ACK bits

• example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23.
  • all incoming, outgoing UDP flows and telnet connections are blocked.
• example 2: Block inbound TCP segments with ACK=0.
  • prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside.

• stateless packet filter: heavy handed tool
  • admits packets that “make no sense,” e.g., dest port = 80, ACK bit set, even though no TCP connection established:

• Allow only requested TCP connections:

• filters packets on application data as well as on IP/TCP/UDP fields.
• example: allow select internal users to telnet outside.

• spoofing: router can’t know if data “really” comes from claimed source
• multiple app’s. need special treatment, each has own app. gateway.
• client software must know how to contact gateway.
  • , must set IP address of proxy in Web browser

filters often use all or nothing policy for UDP.

tradeoff: degree of communication with outside world, level of security

many highly protected sites still suffer from attacks.

• packet filtering:
  • perates on TCP/IP headers only
  • correlation check among sessions
• IDS: intrusion detection system
  • deep packet inspection: look at packet contents (e.g., check character strings in packet against database of known virus, attack strings)
  • examine correlation among multiple packets
    • port scanning
    • network mapping
    • DoS attack

• multiple IDSs: different types of checking at different locations

• Suite of protocols from Internet Engineering Task Force (IETF) providing encryption and authentication at the IP layer
  • Arose from needs identified in RFC 1636
  • Specifications in:
    • RFC 2401: Security architecture
    • RFC 2402: Authentication
    • RFC 2406: Encryption
    • RFC 2408: Key management

• Objective is to encrypt and/or authenticate all traffic at the IP level.

• Eavesdropping
• Modification of packets in transit
• Identity spoofing (forged source IP addresses)
• Denial of service

• Many solutions are application-specific
  • TLS for Web, S/MIME for email, SSH for remote login
• IPSec aims to provide a framework of open standards for secure communications over IP
  • Protect every protocol running on top of IPv4 and IPv6

• Data origin authentication
• Confidentiality
• Connectionless and partial sequence integrity
  • Connectionless = integrity for a single IP packet
  • Partial sequence integrity = prevent packet replay
• Limited traffic flow confidentiality
  • Eavesdropper cannot determine who is talking
• These services are transparent to applications above transport (TCP/UDP) layer

• Virtual Private Network (VPN) establishment
  • For connecting remote offices and users using public Internet
• Low-cost remote access
  • teleworker gains secure access to company network via local call to ISP
• Extranet connectivity
  • Secure communication with partners, suppliers, etc.

• Web now widely used by business, government, individuals
• but Internet & Web are vulnerable
• have a variety of threats
  • integrity
  • confidentiality
  • denial of service
  • authentication
• need added security mechanisms

• transport layer security service
• riginally developed by Netscape
• version 3 designed with public input
• subsequently became Internet standard known as TLS (Transport Layer Security)
• uses TCP to provide a reliable end-to-end service
• SSL has two layers of protocols

• SSL session
  • association between client & server
  • created by the Handshake Protocol
  • define a set of cryptographic parameters
  • may be shared by multiple SSL connections
• SSL connection
  • transient, peer-to-peer, communications link
  • associated with 1 SSL session

• confidentiality
  • using symmetric encryption with a shared secret key defined by Handshake Protocol
  • IDEA, RC2-40, DES-40, DES, 3DES, RC4-40, RC4-128
  • message is compressed before encryption
• message integrity
  • using a MAC with shared secret key
  • similar to HMAC but with different padding

• ne of 3 SSL specific protocols which use the SSL Record protocol
• single message
• causes pending state to become current
• hence updating the cipher suite in use

• IETF standard RFC 2246 similar to SSLv3
• with minor differences
  • record format version number
  • uses HMAC for MAC
  • pseudo-random function expands secrets
  • has additional alert codes
  • some changes in supported ciphers
  • changes in certificate negotiations
  • changes in use of padding

• war-driving: drive around Bay area, see what 802.11 networks available?
  • More than 9000 accessible from public roadways
  • use no encryption/authentication
  • packet-sniffing and various attacks easy!
• securing 802.11
  • encryption, authentication
  • first attempt at 802.11 security: Wired Equivalent Privacy (WEP): a failure
  • current attempt: 802.11i

• authentication
  • host requests authentication from access point
  • access point sends 128 bit nonce
  • host encrypts nonce using shared symmetric key
  • access point decrypts nonce, authenticates host
• key distribution mechanism
• authentication: knowing the shared key is enough

• host/AP share 40 bit symmetric key (semi-permanent)
• host appends 24-bit initialization vector (IV) to create 64-bit key
• bit key used to generate stream of keys, kiIV
• kiIV used to encrypt ith byte, di, in frame:

ci = di XOR kiIV

• and encrypted bytes, ci sent in frame

security hole:

• bit IV, one IV per frame, -> IV’s eventually reused
• transmitted in plaintext -> IV reuse detected
• attack:
  • Trudy causes Alice to encrypt known plaintext d1 d2 d3 d4 …
  • Trudy sees: ci = di XOR kiIV
  • Trudy knows ci di, so can compute kiIV
  • Trudy knows encrypting key sequence k1IV k2IV k3IV …
  • Next time IV is used, Trudy can decrypt!

• numerous (stronger) forms of encryption possible
• provides key distribution
• uses authentication server separate from access point

• Malware can be classified into several categories, depending on propagation and concealment
• Propagation
  • Virus: human-assisted propagation (e.g., open email attachment)
  • Worm: automatic propagation without human assistance
• Concealment
  • Rootkit: modifies operating system to hide its existence
  • Trojan: provides desirable functionality but hides malicious operation
• Various types of payloads, ranging from annoyance to crime

• insider attack is a security breach that is caused or facilitated by someone who is a part of the very organization that controls or builds the asset that should be protected.
• the case of malware, an insider attack refers to a security hole that is created in a software system by one of its programmers.

• Avoid single points of failure.
• Use code walk-throughs.
• Use archiving and reporting tools.
• Limit authority and permissions.
• Physically secure critical systems.
• Monitor employee behavior.
• Control software installations.