NETWORK BASE SECURITY SURVEILLANCE SYSTEM (A CASE STUDY OF KOGI STATE POLYTECHNIC LOKOJA)
Abstract
This project titled “NETWORK BASE SECURITY SURVEILLANCE SYSTEM” is so design to help security information system especially for the management of the present porous security system in the campuses. Presently the polytechnic is not armed with modern data processing and security information system. To help wake it up from its stagnation, my solution is to transform the existing age-long manual information system and embrace latest technology that will avert loss of information, insecurity and delay in data processing. Consequently, I have decided to use an automated data base system for storing and keeping track of security information. As a result, CCTV (Close-Circuit Television) security cameras will be mounted around the polytechnic premises during the course of project implementation to enhance high security for the compound and its communities. This will ensure that there is an efficient and effective computerized information system within the institution and likely to be first of its kind in any higher institution of learning in West Africa sub-region thank you.
TABLE OF CONTENT
CHAPTER ONE: INTRODUCTION
1.1 Background Of The Study    ----------------------------------------------    1   
1.2 Statement Of The Problem     ----------------------------------------------    2
1.3 Significance Of The Study    -----------------------------------------------    3
1.4 Aims and Objectives Of The Study     --------------------------------------    3
1.5 Scope And Limitation Of The Study--------------------------------------    4
1.6 Definition Of Terms     -----------------------------------------------------    6

CHAPTER TWO: LITERATURE REVIEW

CHAPTER THREE: SYSTEM ANALYSIS AND DESIGN
3.1     Introduction        -----------------------------------------------------    42
3.2     Analysis Of The Existing System ------------------------------------    42
3.3     Weakness Of The Existing System ----------------------------------    42
3.4     Data Collection Techniques      ------------------------------------    44
3.5     Analysis Of The Proposed System ----------------------------------    45
3.5.1    Algorithm    -------------------------------------------------------------    45
3.5.2    System Flowchart    -----------------------------------------------------    49
3.6    Database Design     -----------------------------------------------------    50
CHAPTER FOUR: SYSTEM IMPLEMENTATION AND EVALUATION
4.1      Program Development    ------------------------------------------------    51
4.2      System Requirement      ------------------------------------------------    51
4.2.1    Software Requirement     ------------------------------------------------    51
4.2.2     Hardware Requirement    ------------------------------------------------    52
4.3     System Interface    ---------------------------------------------------------    52
4.3.1     Input Interface    ---------------------------------------------------------    52
4.3.2     Output Interface    ---------------------------------------------------------    54
4.4      System Performance    ------------------------------------------------    56
4.5     System Training    ---------------------------------------------------------    57
4.6     Conversion To The Proposed System    --------------------------------    57
4.7    System Documentation     -------------------------------------------------    59
4.7.1    Operational Manual    -------------------------------------------------    59
4.7.2    User’s Manual    ---------------------------------------------------------    59
4.8  System Maintenance    ---------------------------------------------------------    61
CHAPTER FIVE:    Summary, Recommendation and Conclusion
5.1 Summary    -----------------------------------------------------------------    62
5.2 Recommendation     ---------------------------------------------------------    63
5.3 Conclusion      ------------------------------------------------------------------    64
Reference     ---------------------------------------------------------------------------    65
Appendix I  
CHAPTER ONE
INTRODUCTION
1.1    BACKGROUND OF STUDY
Information system occupies a vital and unique position in any organization by virtue of the data and information, which it contains. Security of information is of great importance to any given organization this makes the information reliable since information stored can be referenced whenever necessary access by unauthorized persons.
This project “NETWORK BASE SECURITY SURVEILLANCE SYSTEM” is so design to help security information system especially for the management of the present porous security system in the campuses. Presently the polytechnic is not armed with modern data processing and security information system. To help wake it up from its stagnation, my solution is to transform the existing age-long manual information system and embrace latest technology that will avert loss of information, insecurity and delay in data processing.
The management and security unite is responsible for security of live and property and as a result keeps record of vital information given to them by any informant so as to enable them arrest activities or scenes unpleasant to people residing in a particular district.
Therefore, for effective administration and management, the provision of computer based information security for every source station is certainly inevitable, since it will take care of all the problems and inadequacies of the manual system.
As a result, CCTV (Close-Circuit Television) security cameras will be mounted around the polytechnic premises during the course of project implementation to enhance high security for the compound and its communities
1.2    STATEMENT OF THE PROBLEM
In spite of the level of computation of various institution, this particular institution on discussion is still at the grass root level. It requires a certain degree of protection especially of vital equipment’s, properties and information and this cannot be realized through the current system of operation, which is the manual system.
1.3    SIGNIFICANCE OF THE STUDY
The purpose of this study is to provide a computer based, on line and interactive package that will accurately and efficiently record all data and information about staff, informers, witnesses and accused persons.
It will also eradicate the numerous problems associated with the manual technique of securing information in order to facilitate the transfer and retrieval of information between the various departments of the institution.
The research is intended not only to support the premise that an information security program is a Necessity in any computing environment, but also to offer practical advice on the design and implementation of such a program.
It is not the intent of this paper to endorse any particular product or technology, only to offer suggestions and guidance to computer users who are concerned about their security and privacy as related to computer use.

1.4    AIMS AND OBJECTIVES
Having studied the activities of the institution some benefits could be derived from the computerization of information system and this includes:
1.    Higher security efficiency of information
2.    Quicker access to individual data
3.    Faster treatment of information security oriented cases.
4.    Provision of output information in a readily comprehensible form to those persons involved in the activities of the organization. Provision of communication channels. To compass formal and informal component.
5.    Detecting security violations.
6.    Re-creating security incidents.
7.    To disallow unauthorized users.
8.    To safeguard the organizational data/information.
9.    To computerized the organizational security.
10.    To enhance the organizational security.
11.    To eliminate all forms of mistakes associated with security control.
To provide storage facilities for data not immediately required or that may be required to be used more than once.


1.5    SCOPE OF STUDY AND LIMITATION OF THE STUDY
The scope of this study is to eradicate the numerous problems associated with the manual technique of securing information in order to facilitate the retrieval of information. This research work will access the design and implementation of “NETWORK BASE SECURITY SURVEILLANCE SYSTEM” in kogi state polytechnic lokoja. It will look into the operations of this institution in the aspect of computerizing their security control system.
This study will cover three main areas:
1. Identification of security weaknesses
2. Assessment of risk associated with those weaknesses
3. Development of a plan to reduce or eliminate that risk
These three points will be dealt with in a general manner, as opposed to an in-depth treatment of every exploit, or of every possible solution.
First, in order to delineate between the varied needs of individuals and businesses, it is important to keep the discussion on a level where both environments can be examined equally.
Second, detailed research and studies have been done on most, if not all, of these weaknesses and exploits – it would be redundant to delve too deeply into those details in this study. Where applicable, these other more detailed studies are included by reference. For those readers who wish to do additional research, or require more detailed information, a list of security resources is included in Appendix A.
Actual implementation of an information security plan is likewise treated in a general manner. The disparities between environments, and even between individual computers, put detailed technical discussions outside the scope of this study.
This study focuses on the Microsoft Windows® computing environment. While the processes and procedures identified herein are, in many cases, also valid for other operating systems and environments, the Microsoft family of operating systems and applications is the system most widely used in business, and is all but exclusive in the home environment, making it a common factor upon which to draw comparisons and develop processes. Therefore, discussions of Unix, Linux, Macintosh, and other operating systems and environments will not be included unless the technology used to propagate or prevent an attack is based on one of these systems, in which case the system will be included by reference only. Again, for those wishing to do further research into these, and other operating systems and environments, a list of security vendors is included in Appendix A.
This paper will not discuss the relative strengths and weaknesses of individual pieces of technology or of multiple methodologies. Where a formula, process, or method is recognized as the preferred or most common, sufficient documentation to support that claim will be presented; alternatives, if they exist, will be included.
This study will result in a treatment of the subject sufficient for an individual or
Business person to make an informed decision on whether to pursue an information security program, and how to proceed with the planning and design of that program.
Guidance will be given to direct the reader to the appropriate resources to complete and implement their plan.
LIMITATION OF THE STUDY
Delimitations are the factors which affect the result of the study. There is hardly any research project without some limitation affecting it in one-way or the other. The limitations encountered during the course of this research are as follow:
I.    Collection of Information: There were limitations in getting all the required information needed for the research as some of the information’s where not forth coming due to lack of co-operation and secrecy the part of the respondents.
II.    Financial Limitation: There was also financial limitation, because to carry out a research of any kind you need money and being a student my finances are limited.
III.    Time Constraints: The time required to get the research done is limited being an academic requirement to finish your studies and research takes a considerable amount of time e.g two years.
IV.    Secrecy: The respondents being questioned were reluctant in giving relevant information needed for the research work. They see the questions being asked as trying to probe them.
V.    Illiteracy: There was limitation of illiteracy on the part of some of the respondent. It is difficult for people who cannot read and write to appreciate the need to supply relevant research information.      
1.6    DEFINITION OF TERMS
In order to provide a common understanding of the terms and phrases used in information security, and in an effort to adhere to industry standard terminology, many of the following terms and definitions were taken from the SANS Institute website (SANS Institute, 2013)
Q – Basic    - The programming language used in designing the project program
Modules    -    This is the act of partitioning software’s logically into elements that performs specific functions and sub functions.
On-line processing    - This is a method of processing that provides direct access to information files used by user’s and so enables updating.
Operations – The action carried out on an activity or process.
Crime record sheet – This contains pertinent information on staff and services as input to the computer system via the standard input device keyboard
Data entry – This is the standard input device through which the system gets most of the instructions and commands.
Old file – This contains previous information on the staff and crime record and is updated each time on operation is carried out.
Display unit – An output device where systems display mosts outputs on request.
New file – This is an update of the old file and is stored on line in the system hard disk or a floppy diskette.
Storage unit – This is where files are stored and retrieved when needed, it could be the hard – disk, floppy disk, drums e..t.c.
Processing unit – This is where all data are processed and commands from the user carried out.
Password – This is being employed to restrict unauthorized access to information contained in the system; in others it is a security check technique
Witness – This is a person who has actually present at an event and should for these reason be able to describe it.
Accused – This is a person who has done wrong by breaking the law.
Information or informers – This is a person who detects offenders and informs the authorities of their offences
Suspect – This is when one have a feeling that someone is guilty.
Search warrant – This is an official authority given to policemen when it is necessary to enter and search a building for any stolen property.
Exhibit – This is a document produced in a law court and referred to in evidence.
Conviction – This is the act of convicting a person for crime.
Availability: The need to ensure that the business purpose of the system can be met and that it is accessible to those who need to use it.
Authentication: The process of confirming the correctness of the claimed identity.
Authenticity: The validity and conformance of the original information.
Computer Network: A collection of host computers together with the sub-network or inter-network through which they can exchange data.
Confidentiality: The need to ensure that information is disclosed only to those who are authorized to view it.
Cost Benefit Analysis: A comparison of the cost of implementing countermeasures with the value of the reduced risk.
Cryptography: The process of garbling a message in such a way that anyone who intercepts the message cannot understand it.
Data Custodian: The entity currently using or manipulating the data, and therefore, temporarily taking responsibility for the data.
Data Owner: The entity having responsibility and authority for the data.
Defense In-Depth: The approach of using multiple layers of security to guard against failure of a single security component.
Denial of Service: The prevention of authorized access to a system resource or the delaying of system operations and functions.
Dictionary Attack: An attack that tries all of the phrases or words in a dictionary, trying to crack a password or key. A dictionary attack uses a predefined list of words compared to a brute force attack that tries all possible combinations.
Digital Signature: A hash of a message that uniquely identifies the sender of the message and proves the message has not changed since transmission.
Disaster Recovery Plan (DRP): The process of recovery of IT systems in the event of a disruption or disaster.
Domain: 1) A sphere of knowledge, or a collection of facts about some program entities or 2) a number of network points or addresses, identified by a name. On the Internet, a domain consists of a set of network addresses. In the Internet’s domain name system, a domain is a name with which name server records are associated that describe subdomains or hosts. In Windows NT and Windows 2000, a domain is collection of computers on a network that share a common user database and security policy. A domain is administered as a unit with common rules and procedures by the domain administrator. The user need only log in to the domain to gain access to the resources, which may be located on a number of different servers in the network.
Domain Name: A domain name locates an organization or other entity on the Internet. For example, the domain name “www.sans.org” locates an Internet address for “sans.org” at Internet point 199.0.0.2 and a particular host server named “www”. The “org” part of the domain name reflects the purpose of the organization or entity (in this example, “organization”) and is called the top-level domain name. The “sans” part of the domain name defines the organization or entity and together with the top-level is called the second-level domain name.
Domain Name System (DNS): The way that Internet domain names are located and translated into Internet Protocol addresses. A domain name is a meaningful and easy to- remember “handle” for an Internet address.
Due Diligence: The requirement that organizations must develop and deploy a protection plan to prevent fraud, abuse, and additional deploy a means to detect them if they occur.
Encryption: Cryptographic transformation of data (called “plaintext”) into a form (called “cipher text”) that conceals the data’s original meaning to prevent it from being known or used.
Firewall: A network security device that ensures that all communications attempting to cross it meet an organization’s security policy. Firewalls track and control communications, deciding whether to allow, reject or encrypt communications.
Hardening: The process of identifying and fixing vulnerabilities on a computer system.
Hijack Attack: A form of active wiretapping in which the attacker seizes control of a previously established communication association.
Honey pot: Programs that simulate one or more network services that you designate on your computer’s ports. A honey pot can be used to log access attempts to those ports including the attacker’s keystrokes. This could give you advanced warning of a more concerted attack.
Incident: An adverse network event in an information system or network, or the threat of the occurrence of such an event.
Incident Handling: An action plan for dealing with intrusions, cyber-theft, denial of service, fire, floods, and other security-related events. It is comprised of a six-step process: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
Integrity: The need to ensure that information has not been changed accidentally or deliberately, and that it is accurate and complete.
Internet: Multiple separate networks connected together.
Intranet: A computer network, usually based on Internet technology, that an organization uses for its own internal purposes, and that is closed to outsiders.
Intrusion Detection System (IDS): A security management system for computers and networks. An IDS gathers and analyzes information from various areas within a computer or a network to identify possible security breaches, which include both intrusions (attacks from outside the organization) and misuse (attacks from within the organization).
Least Privilege: The principle of allowing users or applications the least amount of permissions necessary to perform their intended function.