Table of Contents
Executive summary    3
Introduction    3
Communication strategy purpose    4
    4
Value Creation and Delivery    4
Functional Value    5
Emotional Value    5
Social Value    5
Unique Selling Proposition    5
Product differentiation    6
Communications strategy    6
4Ps- Positioning, pricing, promotion and distribution    6
Product    6
Pricing    7
Place    7
Promotion    7
Social Media Marketing    7
Search Engine Optimisation    8
Offline campaigns    8
Online Webinars    8
5 Cs    9
STP    10
Communications examples    10
@ CA Fresher vertical    10
@ CA Lateral segment    11
@ CA CFO    11
@ CA Retired    11
@ CA Freelance    11
@Graduates and other finance professionals    11
High level of customer satisfaction    11
Communications control and Management    12
References    14


Executive summary

We want to be a leading recruitment business servicing specialist markets in this space, from entry positions in organizations to the lateral positions leading to the CFO rung. We also seek to cater to Company Secretary, Cost Management Accountant, CFA, MBA (Finance) and Commerce graduate positions. We would also have a vertical for internship positions such as CA articleship and Industrial Training   

Our BHAG (Big Heavy Audacious Goal) is to become the one stop provider for CA jobs across the country. In 10 years from now, when companies and candidates think of recruitment for CAs, they should think of only cajobportal.com.  The moment a student enrolls for the CA course, he should register on our website. We support him across all phases of career leading up to his post retirement life. . We also plan to foray into other related segments such as Company Secretaries, Cost Accountants, CFAs, Commerce Graduates and well as Internships/Final Placements MBA colleges, especially the Tier 2 and Tier 3 ones.
Introduction

Chartered Accountants form the backbone of the Accounting & Finance function of any company. With increasing globalization, a host of avenues have opened for them in the consulting, transfer pricing, M&A and KPO space. Thus we want to straddle the pyramid for the entire CA space
Leveraging our success in CA space, we would invariably morph into job portal for finance professionals like CS, CFA, FRM, MBA (Finance) from Tie 2 and Tier 3 college { Tier 1 colleges generally have 100% placement) and Commerce graduate.
We also have envisaged a training vertical to cater to the finishing school needs for young professionals before they enter the job market.



 Communication strategy purpose
 
So  we achieve to fulfill this through the following        

Value Creation and Delivery
Functional Value

cajobportal.com acts a one stop provider of solutions in the recruitment space. Clients are assured of customized solutions and only premium postings in the website. Recruiters are assured of getting candidates screened by domain experts and having undergone psychometric tests organized by us. This eliminates the need for the initial screening, leading to substantial savings in time and cost.
Emotional Value

It acts as the go-to place for a CA student from the time he enters the course curriculum at the age of 20 to the end of his career. There is a substantial degree of attachment with the institution that facilitated your first job and we seek to leverage that emotional connect and create brand loyalty.
Social Value

The company also would gain considerable respect in society for helping people from humble economic backgrounds and not having informal referral networks to help get jobs.
Unique Selling Proposition

The USP would be the connect that the company establishes with the candidate and employers through a bouquet of service offerings that are designed to serve multiple and diverse needs.
Product differentiation


Our company would be offering standard solutions at lower costs and also charge premium for customized offerings such as ‘Freemium’ services from companies. There is also a potential to charge from the job seeker as well but we haven’t factored that into our revenue models so far.
Communications strategy

The strategy is to engage with candidates and the HR of companies
4Ps- Positioning, pricing, promotion and distribution

Product
We would have a job portal for Chartered Accountants, currently just a job board. Going forward, enhance the utility of the website through resume database and dynamic search capabilities as well as foray into revenue generating verticals related to CA education and soft skills
Pricing
The current revenue model is through Google Adsense which pays on a cost per click (CPC) basis. Recently the company has tied up with the Bangalore based media agency, Dataworkz promoted by IIMA alumni – Mr Senthil Govindan for paid advertising. It is also tied up as an Affiliate Partner of flipkart.com and would get commission on sales on flipkart.com routed through cajobportal.com
Listing Fee from employers at penetration pricing
Advertisement Revenue better than at Google specified rates
Place
cajobportal.com already has a good traction in the online space. We would control the Kolkata territory through our as well as branch offices under franchisee mode. We
Promotion
Value Communication through the following:
Social Media Marketing
The company has been actively using Facebook, Twitter and Linked to drive traffic. We have a Facebook page with 1000+ followers, Facebook Group with 7000+ followers etc

Search Engine Optimisation
It is currently not using SEO which is an imperative in the current competitive environment. We propose to start that in Q1 FY 16.
Offline campaigns
At coaching centres and colleges to create Awareness
Association with CII and FICCI events would help us gain visibility across industry circle
Complimentary career counseling workshops
Online Webinars
Webinars on career counseling as well as technical topics would help us gain

(KSRE, 2013)
5 Cs

 STP







Communications examples

The communication will seek to address the Customer Need across the verticals
@ CA Fresher vertical
The customer is a CA student at various stages of his academic course where he needs external aid w.r.t. searching the right form for articleship and Industrial Training as per ICAI norms. Post qualification, he needs guidance on what would be the appropriate industry to start with. Since this is an off-campus course, there is a lot of ambiguity surrounding placements. Similarly startups and SMEs who are scaling up cannot afford to pay high CTCs to candidates as well one month salary to consultants. But they surely need a finance professional (either full time or project basis). We seek to address this gap in the market through our Tier 2 and Tier 3 buckets.
@ CA Lateral segment
There is a segment one which gets stuck in the wrong first job and thus makes a move within the first year. This could be like someone who gets a job in Internal Audit in Wipro and soon realizes that this is not his cup of tea. Wants to make a move to Corporate Finance but cannot rely on traditional websites like naukri.com which do not offer customized solutions and where job leads come into your inbox based on keywords in your uploaded resume.  This is a huge gap that we seek to address.
@ CA CFO
A person seeking a change at CFO level cannot post his resume on naukri.com. Consultants in many cases are restricted to specific cities or zones.
He has to move through trusted advisers. We seek tremendous opportunity in this space through our mix of online as well as physical presence.
@ CA Retired
There are senior finance professionals who retire from PSUs or large private companies at Senior Manager or GM levels. They have 5-10 years of fire in their belly and could be invaluable for SMEs as consultants on retainer basis. We seek to connect the two ends of the market. Further there is a satisfaction element in helping our senior citizen being engaged productively. This is also an identified gap in the market
@ CA Freelance
A number of CA students as well as professionals would seek to supplement their earnings through freelance work. Similarly there are companies which do not want a fixed cost of payroll. This is also an identified gap in the market
@Graduates and other finance professionals
There is a huge gap in the market for graduate jobs. Even today, there are thousands of Commerce graduates who do not pursue professional courses because of aptitude or family problems such as finances.  There is a lot of information asymmetry in this market and desperation levels are really high.
Candidates desperately search for one job; job consultants are not interested due to lower CTC and companies need such talent that can be made operationally efficient through training but are unable to find.
We seek to actively operate in this space through the proposed launch of graduatejobportal.com
High level of customer satisfaction


Based on our limited experience in the last year, we have got a feedback that the quality of our customized offering is far superior to that of competition; be it for the USD 40 bn Aditya Birla Group or an Udaipur based SME.
The fresher community, especially in Tier 2 and Tier 3 buckets has a high loyalty base as we have offered them customized solutions in a job recessionary environment. A number of them owe their employment to us


Communications control and Management

The website will be as follows


There are 8 sources of revenue through the 8 verticals and 3 sources through Advertisement and Corporate Training
    •    CA Articleship
    •    CA Industrial Training
    •    CA Fresher Jobs
    •    CA Lateral Recruitment
    •    CA CFO Jobs
    •    CA Retired
    •    CS/CWA/CFA/FRM/MBA (Finance)/B.Com
    •    CA Freelancer
    •    Advertisement  from Google Adsense
    •    Advertisement  from banners
    •    Training
Core Business:
B2B revenues (from Recruiters)
 Resume Database Access, Job listing/ response management, Employer branding/ Visibility, Other - Resume short-listing and screening, career site manager, campus recruitment and non-recruitment advertising other than for jobs
B2C revenues (from Client)
 Services-Resume, Freemium Services
Diversification-Related:, CS & CWA Segments and also Education, Selling books online, marketing e-learning material, Paying Guest, Training for soft skills (not factored in current projections)


References
KSRE. (2013). Communciations Strategy. Retrieved December 14, 2014, from KSRE: https://blogs.ksre.ksu.edu/cs/files/2013/04/CommunicationStrategy.jpg?file=2013/04/CommunicationStrategy.jpg

Executive summary

www.cajobportal.com wants to be a leading recruitment business servicing specialist markets in this space, from entry positions in organizations to the lateral positions leading to the CFO rung. We also seek to cater to Company Secretary, Cost Management Accountant, CFA, MBA (Finance) and Commerce graduate positions. We would also have a vertical for internship positions such as CA articleship and Industrial Training   
 Our BHAG (Big Heavy Audacious Goal) is to become the one stop provider for CA jobs across the country. In 10 years from now, when companies and candidates think of recruitment for CAs, they should think of only cajobportal.com. 
Now we are going to approach Venture Capitalist to get funds worth Rs 20 lacs for a 10% stake in cajobportal.com.
The purpose of this paper is to plan the appropriate strategy to showcase to them that well t have a robust business plan with all the financials
Internally we have the CEO who manages the flow of information.
Since the information is the lifeline of the business, we regulate the flow of information so that an employee has only that my data as is required for effective discharge of his/her functions.
The external communication will be managed by CFO who will address all concerns of stakeholders about whether or not the business will be profitable, whether they will get returns on their money invested etc.
Introduction

The purpose of this paper is to plan the appropriate strategy to showcase to them that we have a robust business plan with all the financials and that they will earn good profits on their investments.
 Communication strategy purpose
 
For the investment, we will choose only the reputed VCs in India
    •    Accel Partners India
    •    August Capital Partners
    •    Helion Venture Partners
    •    IFCI Venture Capital Funds
    •    Incube Connect Fund
    •    India Innovation Investors
    •    InfraCo Asia Development Pte Ltd.
    •    Inventus (India) Advisory Company
    •    Nexus India Capital
    •    Reliance Venture
    •    Sequoia Capital
    •    Srijan Capital
    •    Trident Capital
We have to create an impression in the minds of investors that we have an effective strategy of communication with our business partners
So we achieve to fulfill this through the following        

It must be noted that we will control the flow of information in the following manner
Investors


(Source: Business Case Studies)
We will supply this data to the investors
Communications strategy
Internal Communication

Newsletters
Inter personal communication and Board Meetings
Emails and memos
Weekly Meetings

External Communication

PPTs and Corporate Brochures
Press Conferences

Investors


The strategy for business would be  to engage with candidates and the HR of companies
Value Communication through the following:
    •    Social Media Marketing
    •    Search Engine Optimization
    •    Offline campaigns
    •    Online Webinars
Communications examples

High level of customer satisfaction

We will show investors that we already have high levels of satisfaction. Based on our limited experience in the last year, we have got a feedback that the quality of our customized offering is far superior to that of competition; be it for the USD 40 bn Aditya Birla Group or an Udaipur based SME.
The fresher community, especially in Tier 2 and Tier 3 buckets has a high loyalty base as we have offered them customized solutions in a job recessionary environment. A number of them owe their employment to us


Communications control and Management

Website


There are 8 sources of revenue through the 8 verticals and 3 sources through Advertisement and Corporate Training
    •    CA Articleship
    •    CA Industrial Training
    •    CA Fresher Jobs
    •    CA Lateral Recruitment
    •    CA CFO Jobs
    •    CA Retired
    •    CS/CWA/CFA/FRM/MBA (Finance)/B.Com
    •    CA Freelancer
    •    Advertisement  from Google Adsense
    •    Advertisement  from banners
    •    Training
Core Business:
B2B revenues (from Recruiters)
 Resume Database Access, Job listing/ response management, Employer branding/ Visibility, Other - Resume short-listing and screening, career site manager, campus recruitment and non-recruitment advertising other than for jobs
B2C revenues (from Client)
 Services-Resume, Freemium Services
Diversification-Related:, CS & CWA Segments and also Education, Selling books online, marketing e-learning material, Paying Guest, Training for soft skills (not factored in current projections)
Projected Financials
Initial Investment: Rs 20 lacs in form of working capital infusion, to be repaid by end of year 1.

(Model prepared on ‘real’ basis and thus no price increase/inflation assumptions)


References
KSRE. (2013). Communciations Strategy. Retrieved December 14, 2014, from KSRE: https://blogs.ksre.ksu.edu/cs/files/2013/04/CommunicationStrategy.jpg?file=2013/04/CommunicationStrategy.jpg

Executive Summary

In today’s competitive business environment organizations have to provide customers with

products and services of greater quality and at a faster pace to sustain in the market. The

information systems have eased the business processes by automating certain processes but

integration of the systems has led to increased efficiency and more efficient management of

the business processes. Enterprise Resource Planning (ERP) system is one such tool, which


allows the companies to integrate its business operations by providing company-wide computing

environment that includes sharing a single database. This database provides the company with


consistent data across all business processes in real time enabling the organization to deliver

quality and effective services to its customers. Central Queensland University was one of


the first universities, which introduced distance learning few decades ago and to enhance its

operations implemented an enterprise system developed by PeopleSoft. The system was a

failure since there were many shortfalls in the implementation process, which include lack of

communication leadership employee involvement, vendor selection and project management.

CQU’s decision of replacing it with new ERP system to be implemented by a new local vendor

TechnologyOne would enable it to overcome the issues faced in the previous system but there

are possible risks developed due to the previous implementations such as inconsistency in the

system and software, integration of the various data, which has increased due to the merger and

low morale of the employees due to the failure of the previous implementation of the enterprise

system. To avoid these risks it is recommended that the university has clear understanding of the

requirements, increased involvement of senior management and employees, effective training

and testing of the new system before it goes live and effective communication with all the

stakeholders.


Table of Contents

Introduction 3

Critical Review of Enterprise Resource Planning (ERP) Systems 3

Enterprise Systems at Central Queensland University 9

About TechnologyOne 11

Possible Risks to CQU during Implementation of new ERP System by TechnologyOne 13

Recommendations 15

Conclusion 17

References 18

Introduction

Today, the complexity in the business environment is increasing due to changing market

trends, increased competition and increasing customer demands. The integration of the business

processes enables organization to work more effectively and efficiently since the entire

organization works in towards common goals. Enterprise Resource Planning (ERP) system is

one such system, which enables organizations to integrate all the primary business processes to

enhance efficiency and have a competitive advantage. The ERP systems have become important

strategic tools in today’s complex business environment. If the ERP system is not implemented

successfully it can lead to several issues in the business processes. The report talks about the

existing enterprise systems of Central Queensland University (CQU), which was ineffective due

to poor implementation process hence it has decided on replacing it with new ERP system from

a different vendor. The report discusses the possible risks Central Queensland University might

face while changing its old enterprise system to new ERP system to be implemented by a new

vendor. The report also provides recommendations to overcome the identified risks.

Critical Review of Enterprise Resource Planning (ERP) Systems

With growing complexity, demand of increasing efficiency and technological advancement

has forced organizations to implement latest technologies and solutions to enhance their

overall performance and effectiveness. Gable, Rosemann and Klaus define ERP systems as

“comprehensive packaged software solutions seek to integrate the complete range of business


processes and functions in order to present a holistic view of the business from a single

information and IT architecture” (Harley et al., 2006). ERP systems enable the organizations

to link their various departments and processes, which include manufacturing, sales order

processing, human resource functions, financial systems, processes involving suppliers and

customers (Rabaa’I et al., 2009). The system integrates these various functions, which allows

sharing of data and increases the visibility (Rabaa’I et al., 2009). ERP systems enable companies

to organize and improve the effectiveness of the various business processes and decrease the cost

of carrying out the processes. Beheshti (2006), states that enterprise systems enable organizations

to have effective communication and coordination by centralizing the administrative activities

and improve ability of the system to store, retrieve and use the information from the ERP

system efficiently and easily and also reduce the maintenance cost of the ERP system (Addo-
Tenkorang & Helo, 2011). A successfully implemented ERP system enables the organization

to maintain strong business intelligence for the company by giving the respective managers and

staff integrated view of the various business processes and also provide the required information

in a better manner, which enables the managers in making quick decisions (Simon & Webster,

2010). Every organization and institution has the scope of implementing an ERP system since

it integrates the main processes of the business in an effective manner. Education sector is one

such industry, which has increased need of ERP systems due to the continuously growing student

numbers, increasing competition, changes in nature of academic work, need for improvement of

operational efficiency and changing expectations of the stakeholders. Due to the substantial and

continuing changes in the sector there is a demand for more efficient management process and

improved operations of administrative processes. According to Zornada and Velkavrh (2005)

the education sector in inclined towards adopting ERP system with an intention to integrate

administrative functions, which include student administration, facilities management, financial

management and human resource management which traditionally have separate legacy system

(Harley et al., 2006). Deloitte & ToucheConsulting carried out a study to analyze the benefits of

implementing ERP system and classified them as tangible and intangible (Magal & Word, 2011).

The tangible benefits include increased productivity, inventory reduction, reduction of personnel,

reduction of IT and procurement costs, improved cash flow management, increase in revenues

and improvement in on-time delivery (Behrens & Sedera, 2004). The intangible benefits include

improved business processes, increased transparency of corporate data, improved responsiveness

to customers, increased integration between systems and standardization (Behrens & Sedera,

2004).

The effectiveness and success of ERP systems depends on various factors, which need to be

identified and considered during the implementation otherwise the system can lead to significant

losses and disruption in the overall business processes. The more complex the processes

get, there is increased complexity in the software development (Simon & Webster, 2010). It

is estimated that for every 25% increase in the complexity of a given task in the system, the

complexity of the software solution increases by 100% (Addo-Tenkorang & Helo, 2011).

According to Martin Campbell-Kelly, a computer historian, the management of any business

inevitably wants changes in the automated processes due to the changing and evolving needs of

the market (Phillips, 2012). Thus, it is very essential to identify the success and failure factors to

ensure the successful implementation of the ERP system.

Business Process Reengineering and Customization

To successfully implement an ERP system it is very essential for the organization to make

structural changes and have a clear understanding of how the business processes will be carried

out after implementation of the ERP system (Harley et al., 2006). Customization is an important

part of ERP implementation and has the goal of ensuring that company’s requirements match

ERP solution (Magal & Word, 2011). The degree of customization is very important decision

since it influences the complexity of the system. It relates the success of ERP and achieving user

satisfaction. Kumar suggests that the customization should be less than 30% since increased

customization can further complicate the system (Magal & Word, 2011).

Project Management

The project management should be effective for successfully implementing the ERP system. The

scope of the project, deadlines, milestones, resources required should all be clearly defined and

documented before the start of the project (Harley et al., 2006). The developers should also have

a risk management plan and continuously monitor the progress of the project.

End-user Involvement

The involvement of the end-user is very important for the success of the system. The end-users

have better knowledge about the requirement from the system and since they would be using the

system they can highlight the various risks or issues, which can arise during the implementation

process (Monk & Wagner, 2012).

Knowledge Management

This refers to exchange of information between all stakeholders within the organization. It is

essential that the company build effective channels and environment to exchange information

within the company and with the developers to have up to date information about the

development and working of the system. By exchanging information the employees would be

able to understand the ERP system better. It is very essential for the users to understand the

system to use it effectively (Magal & Word, 2011).

Software Selection

There is a direct and string relationship between the success of ERP system and software

selection. By selecting the software, which allows them to automate the crucial processes, the

system will help the organization in increasing the effectiveness of the organization (Malhotra

& Temponi, 2010). The company should identify the core business processes and choose

the software, which can integrate them and allow the organization to automate the main


functionalities and support the rest of the processes by integrating them effectively (Malhotra &

Temponi, 2010).

Effective communication

The success of ERP system implementation highly depends on effective communication between

all the stakeholders. The goals and expectations of implementing the ERP system should

be clearly communicated throughout the organization and to the vendor (Monk & Wagner,


2012). The capabilities and limitation of the ERP system should be well understood by all the

stakeholders (Malhotra & Temponi, 2010). The centralization and sharing of information among

all stakeholders enables organization to make quicker and effective decisions (Malhotra &

Temponi, 2010)..

Top Management Commitment and Support

This factor refers to the effective leadership at the top level and need for the involvement of

the senior management in strategy planning and has involvement in technical orientation. The

support from the top management regarding allocation of required resources and involvement in

the decisions related to the system is very essential. The leaders should involve and encourage

the involvement of the other stakeholders and establish effective communication between all and

lead the entire project with the support of the developers and implement the system as per the

requirements of the company (Monk & Wagner, 2012).

The factors, which can lead to the failure of ERP system implementation, are:

Lack of understanding of the business requirements

The implementation of the ERP system can have negative consequences if there is lack of

understanding about the requirements from the system (Behrens & Sedera, 2004). This is one of

the major factors, which can lead to several issues in the implementation as well as in the end

product. Since the requirements are not clear the integration cannot be established effectively,

which can lead to drawbacks in every process leading to slow down of the process and errors

(Behrens & Sedera, 2004).

Not choosing the right Vendor

The software selection is another common mistake made by the organization. The choice of

vendor is very crucial for the success since it is essential to choose a vendor who is aware and

has knowledge of the company’s business. The company should choose a vendor who has the

knowledge of the respective industry, which will enable the vendor to deliver cost-effective and

appropriate business solutions (Ifinedo et al., 2010).

Lack of communication, coordination and leadership

The ERP system implementation needs effective communication among all the stakeholders.

This would enable the vendor to have a clear understanding of the requirement and in turn the

users will be able to understand the capabilities of the system. The lack of communication,

coordination and leadership can result in a system, which might not fully serve the purpose and

might also end up producing errors, which can affect the other business processes (Behrens &

Sedera, 2004). This will also lower the morale of the staff since they might fear that the system is

too difficult to adapt to and it might affect their efficiency as well (Ifinedo et al., 2010).

Enterprise Systems at Central Queensland University

Central Queensland University (CQU) is a public university based in Queensland, Australia

(CQU, 2014). It is the largest and fastest growing university in Australia and the graduates from

this university are among the highest paid in the country (CQU, 2014). CQU was among the first

universities to start comprehensive distance learning in 1974 and started with full-time student

load since 1994, by establishing on-shore teaching site in Sydney followed by Melbourne,

Brisbane and Gold Coast (CQU, 2014). The university with a goal of becoming a leader in

flexible teaching the university along with many others opted for enterprise resource system to

improve its administrative processes. In 1990s the Enterprise Resource Planning (ERP) systems


were the standard option to replace the legacy systems in larger organization, which involved

several processes and department (Hellens et al., 2005). Markus (2001) defines ERP systems as


software packages, which include integration of transaction oriented data and business activities

(Simon & Webster, 2010). According to Pastor (2001), enterprise systems enable cross-
organization integration by embedding business processes and are composed of various modules

(Harley et al., 2006). To enhance the administration process CQU chose PeopleSoft ERP, which

was implemented over a period of three years.

The system delivered to CQU suffered various problems, which include the system ended up

being too time consuming due to use of two separate applications (Abugabah & Sanzogni,

2010). Due to the use of different applications it made the staff wait more than 20 minutes to

access records and involved several steps to retrieve the required results. The system ended up

being very confusing and difficult due to the use of two applications to complete a single task.

The processes became complicated and difficult for the users since the application was not user

friendly and was quite complex for the users to make selections. The parameters used were quite

confusing, which made the work difficult for the end users. The system also had geographic

restriction and the users were able to use all the three systems from computers located on

CQU network. The staffs were not able to access student records from outside CQU campus


effectively, which made it very inconvenient. The applications also had platform restrictions and

the users were not able to access information from other operating systems such as Apple and

Linux (Hellens et al., 2005). Thus, in the first enterprise system of PeopleSoft ERP there were

several drawbacks from the part of university as well as the developer.

The shortfall on the part of university and the developers included lack of communication, the

differences in the administration systems among all the campuses, lack of technical support

since there was no central software developer assigned to support the various divisions in

using the implemented software and the technology used was not very effective since it could

not integrate with other software thus offering limited support in accessing information in

the Student system (Hellens et al., 2005). The other mistake on the part of the university was

that they opted for customizing the system, which resulted in greater operational costs, slower

deployment of technology and reduction of flexibility of the system. After the implementation

of the system a study was carried out to identify the causes of the system failure, which included

interviews and focus groups of the most experienced staff of the university who were also

involved in implementation of the new enterprise system (Abugabah & Sanzogni, 2010). The

issues identified included perceived lack of direction, poor control over implementation process,

distrust of implementation partners assisting with the project, poor leadership, and inadequate

training perception of low morale since there was no effective engagement of the stakeholders

(Abugabah & Sanzogni, 2010). To overcome the in efficiency of the system and to control the

cost of its maintenance the university’s decision of enhancing their system by opting for local

vendor Technology One shows its positive approach of overcoming the issues created by the

previous system.

About TechnologyOne

TechnologyOne is the largest publicly listed software company of Australia, which is in to

development of business-to-business software and creates solutions for over 1000 leading

corporations, government departments and statutory authorities (TechnologyOneCorp, 2014).

The company has the vision of providing single, integrated enterprise solution built on the

modern platform with consistency in the working of the system. TechnologyOne has a holistic

approach towards providing solutions and takes responsibility for developing, selling, marketing

and supporting to the provided solution using new technology and concepts. TechnologyOne not

only has business prospects in Australia but also has increased footprint in New Zealand

TechnologyOneCorp, 2014). It is one of the leading providers of enterprise software solutions to

most of the government departments for financial management. The company provides solution

to Ministry of Agriculture and Forestry, Ministry of Justice, Ministry of Economic Development

and Ministry of Environment (TechnologyOneCorp, 2013). It is a dominant provider of Business

Intelligence and Enterprise Budgeting products (TechnologyOneCorp, 2014). The solutions

provided by the company are highly integrated, which enable the developers and end users to act

effectively on the information provided. The company’s Enterprising Business solution enables

the operational and financial department of the company to work together in controlling the

budget (TechnologyOneCorp, 2013). The solution provides budgeting information in such a

manner that it provides information to end users in terms of business and not accounting. The


approach of the company in building the solution includes working with the customers.

TechnologyOne has provided several solutions to local government departments, which includes

solution for OneCouncil and has delivered solution to integrate information from many

operational systems (TechnologyOneCorp, 2013). The company has implemented an integrated

system, which includes customer management, building, planning, finance, billing, grants

management, human resource and payroll (TechnologyOneCorp, 2014). TechnologyOne has

also provided effective solution to the SGE Credit Union, which has been able to enhance its

efficiency, productivity, data management and generate reports at a faster rate using the

OneBanking solution (TechnologyOneCorp, 2013). The company was able to integrate the new

solution effectively with its core banking system and enabled it to capture data more effectively,

which enabled the Union to increase the productivity, data accuracy and enhance overall

performance of their systems, which enabled the organization to perform more effectively and


efficiently. Thus, the company has supported various business areas by providing integrated

solutions in a manner that it has helped various organizations to increase effectiveness of their

business processes ns increase the overall productivity of the organizations.

CQU by merging with CQU TAFE led to marking a new era of education and training, which

introduced a comprehensive university, which delivers new opportunities for students and

provides new opportunities for the investing on the local skill base. This demanded a better

maintenance of student records due the merging of more information and processes. CQU


and CQU TAFE chose TechnologyOne because of its success in delivering various solutions.

The university chose TehnologyOne after an extensive tendering process and determined that

Technology One can deliver effective solutions for student management and fulfill their long-
term requirements.

Possible Risks to CQU during Implementation of new ERP System by

TechnologyOne

The ineffectiveness of CQU’s old enterprise system was due to several factors, which can act as

risk while implementing the new ERP system to be provided by TechnologyOne

The main risks involved during implementation of the new ERP system at CQU are:

Inconsistency in its existing System

The PeopleSoft enterprise system used various applications within one task, which made the

business process more time consuming and difficult. The existing system cannot be used on

different platforms. Also, the existing system is not very user friendly. This risk factor of

inconsistency in data and applications can make the implementation of new system complex.

The inconsistency can lead to several other risks such as compatibility of the new system with

existing systems (Hellens et al., 2005). The new vendor might have to identify the changes

in system for all departments and since the new system requires integration of data there is

a possibility of losing data or having errors in the data since they would have been stored in

different formats. There is a risk of inconsistency in the data for the StudentOne solution, which

if not handled might make it difficult for staff to carry out certain transactions.

Increased requirements due to merger with CQU TAFE

Due to the merger with CQU TAFE the data integration would be complex and essential.

The merger would involve addition of further processes of student administration, which

might require the developers to integrate different data types and in the course there is a risk

of misinterpreting or calculating certain data. The merger would require the system to add

additional parameters and report development, which can clash with the stored data.

Low morale of the staff due to ineffectiveness of existing system

CQU’s earlier enterprise system implementation was a failure since there was lack of

communication, coordination and leadership with similar approach there is an increased risk

of failure and loads of issues in implementing the new ERP system. With the experience of the

previous enterprise system there is an increased risk of resistance from the people. The people

might not prefer upgrading to new system since they fear it might make their tasks difficult and

time consuming. In the previous implementation process the testing and training were not done

adequately, which can further add to the resistance of the employees and might not involve in the

development and decision making of the new ERP system. There is a risk of non-participation of

the employees in bringing the change effectively. This might not enable the developers to fulfill

the business requirements.

Thus, there is a risk of compatibility of the existing software and systems, data inconsistency and

resistance from the staff, which can further affect the other related processes. There is a risk of

financial loss if the requirements are not clearly defined and documented and if the employees

are not involved during the implementation. Also, if the organization insists on customization,

as done in the case of previous enterprise system can further increase the inconsistency in the

system and data.

Recommendations

ERP systems require significant level of resources, changes and commitment throughout the

organization. The risks involved in the implementation of the system are a major concern since

there is increased investment of time, money and efforts. The failure of the system can disrupt

the business processes to a greater extent, which can not only lead to loss of money but also

business since the system might provide inconsistent data and slow down the processes. CQU

has already faced a significant negative consequence due to the failure of the implementation of

the previous enterprise system. The previous implementation lacked several factors such as lack

of clear understanding of business requirements, communication, leadership and inconsistency

in the systems and software implemented. The impact of the previous mistakes can cause further

risks while implementing the new ERP system, which can reduce the effectiveness of the new

system in spite of choosing the right vendor.

It is recommended that the university should have a collaborative approach in decision making

and planning for the ERP implementation. It is recommended that the top management and all

the stakeholders who would e influenced by the change of the system should be involved in the

implementation process. The top management and the staff should have clear understanding of

the requirements from the system, which should be discussed with the vendor and they should

ensure that those requirements can be met with minimum complexity in the system. It is

recommended that the university should reduce the level of customization, which would make

the system less complex and also allow the system to have greater consistency in the data and the

system. Thus, the confusion would be less and all the end users would be able to use the new


system effectively and efficiently. It is essential that the university integrates the data of CQU

TAFE with the CQU data beforehand so that the developers would be able to create database

accordingly and there would not be any issues in data retrieval and addition. It is recommended

that the management will ensure that there is no resistance from the employees by discussing the

need for change to new system. The management in the implementation of this new system

should encourage the participation of all the stakeholders, which would reduce the resistance and

get them interested in bringing the proposed change. The management should involve to a

greater extent and participate in every decision made in the implementation process and

document all the details right from requirements of the system to the final testing. It is

recommended that the university has effective training to all the users and allow them to actively


participate in the implementation process. The effective testing and involvement of the staff is

recommended so that the inconsistency in the functionality can be identified before the system

goes live. CQU by changing its management approach can avoid all the possible risks involved

in implementing the new system. The risks can be avoided by effective communication,


coordination and involvement in the implementation process.

Conclusion

ERP systems enable organizations to integrate its business processes and increase the efficiency


and effectiveness of the processes by automating them and provide comprehensive information

required by the respective departments. ERP systems are complex systems and require increased


participation by all the stakeholders, clear understanding of the requirements from the system

and effective training and testing of the system before it goes live. CQU’s first enterprise


system implemented in the 1990s did not fulfill the requirements of the university since the

implementation process had several drawbacks. There was increased lack of understanding,

communication and coordination, which led to making the systems more complex and made it

difficult for the end users to use the implemented system. This created dissatisfaction among

the end users and led to several issues in accessing the system. The university’s decision of

adopting new ERP system from a local vendor would enable it to overcome the shortfalls

of the previous system but also involve increased risks due to the underperformance of the

previous emprise system. The possible risks include inconsistency I the systems and software,

employee resistance, increased business requirements due to the merger. By increased employee

and management involvement, standardization and effective training and testing the system

delivered by new vendor, the new ERP system would help in meeting all the requirements of the

university.

References

Abugabah, A & Sanzogni, L (2010), Enterprise Resource Planning (ERP) System in Higher

Education: A literature Review and Implications, International Journal of Social, Management,

Economics and Business Engineering Vol:4 No:11, pp. 361-365

Addo-Tenkorang, R & Helo, P (2011), Enterprise Resource Planning (ERP): A Review

Literature Report, Proceedings of the World Congress on Engineering and Computer Science

2011 Vol II, WCECS 2011, October 19-21, 2011, San Francisco, USA

Behrens, S & Sedera, W (2004), Why Do Shadow Systems Exist after an ERP Implementation?

Lessons from a Case Study, (2004).PACIS 2004 Proceedings. Paper 136.

CQU (2014), viewed 10 July, 2014

http://www.cqu.edu.au/about-us

Hellens, L, Nielsen, S & Beekhuyzen, J (2005), Qualitative Case Studies on Implementation of

Enterprise Wide Systems, Idea Group Inc (IGI)

Harley, B., Wright, C., Hall, R. & Dery, K (2006), Management reactions to technological

change: The example of Enterprise Resource Planning, The Journal of Applied Behavioral

Science 42 (1), pp. 58--75.

Ifinedo, P, Rapp, B, Ifinedo, A & Sundberg, K (2010), Relationships among ERP post-
implementation success constructs: An analysis at the organizational level, Computers in Human

Behavior,Volume 26, Issue 5, pp. 1136–1148

Monk, E & Wagner, B (2012), Concepts in Enterprise Resource Planning, Cengage Learning

Malhotra, R & Temponi, C (2010), Critical decisions for ERP integration: Small business issues,

International Journal of Information Management, Volume 30, Issue 1, pp. 28–37

Magal, S & Word, J (2011), Integrated Business Processes with ERP Systems, Wiley; 1st edition


Phillips, S (2012), Control Your ERP Destiny: Reduce Project Costs, Mitigate Risks, and Design

Better Business Solutions, Street Smart ERP Publications; First edition

Rabaa’I, A, Bandara, W & Gable, G (2009), ERP Systems in the Higher Education Sector: A

Descriptive Case Study, 20th Australian Conference on Information Systems, 2-4 Dec 2009,

Melbourne

Simon, P & Webster, B (2010), Why New Systems Fail: An Insider's Guide to Successful IT

Projects, Cengage Learning PTR; 1 edition

TechnologyOneCorp (2013), SGE Credit Union finds success with TechnologyOne's

OneBanking, viewed 12 July, 2014

http://www.technologyonecorp.com/about-us/media/news/articles/sge-credit-union-finds-
success-with-technologyones-onebanking

TechnologyOneCorp (2014), viewed 10 July, 2014

http://www.technologyonecorp.com/about-us

A. The firewall services are installed on the router. Create the firewall rules to implement

the packet filtering and only allow the specified traffic. The firewall rules are to be

created in the following format.

Rule

Application

No.

Protocol

1 HTTP TCP 0.0.0.0/0 Any 138.77.5.89 80 allow

2. HTTPS TCP 0.0.0.0/0 Any 138.77.5.89 443 allow

3. DNS UDP/

4. DNS UDP/

5. DNS UDP/

6. SMTP UDP 0.0.0.0/0 Any 138.77.5.110 25 allow

7. IMAP UDP 138.77.5.110 143 192.168.1.0/25 any allow

8. HTTP TCP 192.168.1.0/25 Any 0.0.0.0/0 80 allow

9. HTTPS TCP 192.168.1.0/25 Any 0.0.0.0/0 443 allow

10. FTP TCP 192.168.1.0/25 Any 0.0.0.0/0 20,21 allow

Transport

Protocol

Source IP Source

Port

TCP

TCP

TCP

0.0.0.0/0 Any 138.77.5.6 53 allow

138.77.5.6 Any 0.0.0.0/0 53 allow

192.168.1.0/25 Any 138.77.5.6 53 allow

Rule 1.

This rule allows all the traffic directed from any source towards the web server specifically for port

80 which stands for HTTP traffic.

Rule 2.

This rule allows HTTPS traffic directed from any source towards the web server. Destination port 443

stands for HTTPS service r

Rule 3.

This rule allows DNS requests from the internet towards the DNS server.

Rule 4.

This rule allows DNS server to query other DNS server on the internet if it cannot resolve DNS

queries on its own.

Rule 5.

Rule 5 allows internal users to query the DNS server in the DMZ .

Rule 6.

This rule allows the email server to receive emails sent from other mail servers.

Rule 7.

This rule allows the hosts on the inside network to download mails from the mail server onto their

workstations.

Rule 8.

This allows hosts on the inside network to access web services running on port 80 on the outside

network.

Rule 9.

This rule gives outside the inside hosts HTTPS access on the outside network.

Rule 10.

Similarly this rule allows inside hosts to access FTP sites and download files from a FTP site.

Packet Addressing on internal network Packet Addressing on external network

Source IP Src

192.168.1.2 1033 203.206.209.77 80 138.77.5.210 1055 203.206.209.77 80

192.168.1.2 1035 210.10.102.196 443 138.77.5.210 1056 210.10.102.196 443

192.168.1.5 2301 203.206.209.55 21 138.77.5.210 1057 203.206.209.55 21

192.168.1.5 2302 202.2.59.40 443 138.77.5.210 1058 202.2.59.40 443

192.168.1.5 4123 72.5.124.55 80 138.77.5.210 1059 72.5.124.55 80

192.168.1.8 4128 72.5.124.35 21 138.77.5.210 1060 72.5.124.35 21

192.168.1.8 1033 150.101.16.250 80 138.77.5.210 1061 150.101.16.250 80

192.168.1.9 1035 150.101.16.250 443 138.77.5.210 1062 150.101.16.250 443

Dst IP Dst

Port

Source IP Src

Port

PAT stands for Port Address Translation which translates the source address of the internal hosts to

the public IP of the gateway proxy.

It maintains a NAT table which maps all the inside IPs which are translated to a different port. Hence

the resulting packet has its source port and source destination translated as shown in the table.

Question 2: Attack and Defence Research

The major difference between ARP cache poisoning and DNS cache poisoning is that quite evident

from the name. Arp cache poisoning is filling an ARP table of a machine with wrong values primarily

with the intention of performing man in the Middle attack.

DNS caching poisoning is poisoning the DNS entries in DNS servers with wrong values with the

intention if phishing or making a site unreachable. Both these attacks result in manipulating

important values in different machines.

Arp cache poisoning is basically a LAN based attack limiting the participants (victim, source, attacker)

in the same subnet since ARP is protocol operates in one subnet in a LAN network.

DNS on the other hand is a sever based attack and the victim is a DNS server. This can be performed

by compromising a DNS serve cache by any other means and putting a wrong entry for a particular

website or name. Since DNS servers continuously update their entries by querying other DNS servers

across the world a poisoned DNS server cache may poison a number of other DNS servers all across

the world. This could lead to a snowball effect and can affect hundreds of DNS servers all across the

globe. DNS cache poisoning is thus more complex in terms of rectifying as compared to ARP cache

poisoning.

ARP cache poisoning does not have as adverse affects as caused by DNS cache poisoning since the

victim is a local LAN based machine and does not affect other machines. However if the victim is

communicating a confidential information and compromise of such information using a man-in-the-
middle attack can impact business operations in several ways .

There have been various measures to prevent such attacks.

Cisco switches have various features which could prevent these attacks. Some of the features are :-

1. DCHP snooping which creates the database of all the IP address given out by the DHCP

server and binding them to a particular port.

2. Dynamic ARP inspection is a feature which uses the database of DHCP snooping and

validates whether an ARP request is valid or invalid.

3. IP source guard is another feature which checks the validity of a packet and prevents IP

spoofing which may be used to perform ARP cache poisoning.

DNS cache poisoning can be prevented by a new suite of IETF specification called DNSSEC. DNSSEC

uses PKI to validate DNS updates. Each DNS servers generates a public and a private key and digitally

signs all DNS requests and queries using its private key. Any other DNS server communicating with

this DNS server can now trust this DNS server and can update its DNS entries and avoid DNS cache

poisoning of any sort.

References

• Son,S and Shmatikov,V . The Hitchhiker’s Guide to DNS Cache Poisoning

(available at https://www.cs.utexas.edu/~shmat/shmat_securecomm10.pdf)

• Manwani,S . ARP Cache Poisoning Detection and Prevention

(available at http://www.cs.sjsu.edu/faculty/stamp/students/Silky_report.pdf)

• Ateniese, G and Mangard,S . A new Approach to DNS Security (DNSSEC)

(available at http://www.cs.jhu.edu/~ateniese/papers/dnssec.pdf)

Executive Summary

The rapid evolution of electronic devices such as computers and mobile phones has led to

increased criminal activities. It has become very difficult to provide sufficient and appropriate

security to the devices due to increased complexity. The digital forensic investigation method

evolved and provides a procedure to investigate computer crimes. Digital forensic investigation

process involves collection, preservation, analysis and presentation of digital evidence.

Common Goal Health Insurance (CGHI), an international health insurance company and due to

insufficient security efforts has faced a criminal attack wherein the personal health information

has been deleted and there are change in the applications used by the manager and his team

members. The systematic digital forensic investigating model carries out various stages for

collecting, preserving analyzing and presenting the digital evidence. Live Data Forensic System

(LDFS) is an effective tool to collect the evidence and using appropriate acquisition and analysis

approach to collect the evidence the investigation can be effectively carried out.

Introduction 2

Need for Digital Forensic Methodology 3

Resources required to conduct Digital Forensic Investigation 10

Approach for Data/Evidence Identification and Acquisition 11

Steps in the Analysis Phase 11

Conclusion 12

References 14

Introduction

Today, the data and information is stored in the digital format, which enables the organization

to store huge data, which is easily accessible, can be modified and data can be added to it.

But with increase use of networking technologies there is increase in criminal activity and

the attackers steal, manipulate or corrupt the digital data to such an extent that it has a severe

impact on the business. The report discusses about a criminal activity taken place in Common

Goal Health Insurance (CGHI), an international health insurance company. The attacker has

deleted customer’s personal health information as well as made changes in some applications

raising serious security issues in the company. The report discusses the application of digital

forensic in investigating the criminal activity and also discusses the various functions within the

investigation.

Need for Digital Forensic Methodology

With increasing use of computers and internet in the organizations as well as in the personal

life there are increased computer crimes severely impacting the organizational activities. Due to

rapid advancement in technology the criminals apply more sand more sophisticated technology

to avoid detection and carry out the crime with greater deception. Computer crimes involve

different types of offences such as copyright, hacking, fraud and spreading viruses (Richard III et

al., 2007). According to Icove et al. (1995) the crimes can be classified as:

• Personnel security breaches

• Physical security breaches

• Operations security breaches

• Communication and data security breaches

Digital forensic is one of the branch of forensic science, which refers to recovery and

investigation of digital devices and is related only to the computer crimes (Beckett & Slay,

2011). The technical aspect of investigation is subdivided in to computer forensic, network

forensics and mobile device forensics (Lim et al., 2012). The computer forensic refers to the

investigations of the incidents where there is electronic or computer-based evidence of a crime

(Casey, 2011). The crime might be of any type and involve computers or it can be a crime where

data has been stolen. This act is investigated by a process, which involves

• Preservation

• Identification

• Extraction

• Documentation

• Interpretation

Network forensics involves investigation and recovery of information from computer networks,

which is suspected to have been compromised or hacked by an unauthorized person. The

network forensic uses event log analysis and timelining to detect when the event occurred, what

has been accessed, from which IP address the attack has been initiated an which tools were used

(Turner, 2007). In such investigation the network is used for gathering passive information

during the investigation. Data recovery is another part of digital forensic, which involves

salvaging data from damaged or corrupted secondary storage media, which cannot be easily

accessed by a common person (Casey, 2005).

Digital forensics has a holistic approach as compared to network forensic and data recovery and

carries out investigation in three stages, which are acquisition or imaging of exhibits, analysis

and reporting (Sammons, 2012). Digital forensics focuses mainly on recovering all the objective

evidence of a criminal activity since it enables the collection of range of information from the

different digital devices, which might help to gather more details about the criminal activity (Lim

et al., 2012). In network forensics the data and information is mostly collected from the devices,

which are in the network and the data recovery allows the organization to recover data from the

secondary storage, which provides little scope for finding the source of criminal activity (Dezfoli

et al., 2013).

Systematic Digital Forensic Investigation model helps the analysts to have a holistic approach in

investigating the source of the criminal activity, its timeline as per the Country Digital forensic

law, analysis of its severity, preservation of lost data and protecting it from further damage

(Casey, 2011). The use of digital forensic investigation in CGHI would help the auditors to

identify the source of the criminal activity and to identify time and severity of the criminal

activity. Following are the phases followed in this investigation

1. Preparation

This phase refers to preparation for the actual investigation and involves initial understanding of

the nature of the criminal activity and prepare for accumulating the data required for preparing

the evidence for the criminal activity (Richard III et al., 2007). In this phase auditors would

prepare for the access they need, legal constraints and the areas, which they need to carry out the

investigation in.

2. Securing the scene

This stage involves securing the area where the criminal activity was carried out or has been

identified and is restricted to people besides the ones involved in the investigation, which

would help them preserve the evidence from being tampered (Lim et al., 2012). The auditors

would allow only few of the employees to access the areas, which include the manager who

identified the changes in the system and the other employees whose computers have also been

compromised.

3. Survey and Recognition

This phase involves initial survey for evaluating the criminal activity and identifying

the potential sources of the criminal activity, which would be the evidence for the entire

investigation (Beckett & Slay, 2011). This phase considers all the accessories and devices used

by the computer where the criminal activity has occurred. The phase also involves interviewing

the people who use the devices on which criminal activity has occurred (Sommer, 2012). The

auditors would survey all the devices used in the computers where the changes in the system has

been spotted (Richard III et al., 2007). Also, all the employees having an access and using those

computers would be interviewed and the systems would be checked for any unauthorized access

by any employees or any manipulations one in the recent sessions. This will enable the auditors

to recognize any unusual activity and collect various evidences for the exiting data, which can be

used for further investigation.

4. Documenting the Scene

In this stage the entire scene where the criminal activity was done or found is documented

through photographs and by documenting the devices connected the layout of all the devices

etc (Lim et al., 2012). A record of all visible data is carried out and the log of the users of the

systems before the crime was detected is done. The auditors will make a record of all the systems

where the changes in the system has been detected also the auditors will document the activities,

which the users of the computers, which has been affected carry out the devices they normally

use.

5. Communication Shielding

This phase involves blocking all the communication options of the affected computer systems

and devices and is done before collecting the evidences. All the connections to external devices

are removed and the system is not allowed to carry out any function or access any records from

any other device (Beckett & Slay, 2011). The auditors would cease the access of computers from

where the data has been deleted and the system changes have been identified and will be isolated

from all the devices connected to it, which will enable the auditors to ensure there are no further

manipulations done through remote access.

6. Evidence Collection

This phase involves collection of evidence from the digital devices, which are crucial for the

investigation of the criminal activity. The evidences can be volatile and non volatile. Volatile

evidence refers to data on ROM or from any application, which is already running on the system

and it might be lost if the system battery runs out (Agarwal et al., 2011). The non volatile

evidence is the one, which is available on external storage devices such as USB memory sticks

etc (Beckett & Slay, 2011). The auditors would collect the evidence from all the storage devices

used by the employees on the affected computers as well as from their computers, which would

enable them to identify which data has been manipulated and to what extent and when it has

been manipulated.

7. Preservation

This stage involves preserving the evidence collected by packing, storing and transporting them

to the place where it will be investigated (Altheide & Carvey, 2011). In this stage it is ensured

that the evidence is not tampered and is effectively taken to the place where it will investigated

and will be protected from the electromagnetic radiation to avoid any damage to the data in the

storage devices (Lim et al., 2012). The auditors will carry out part of the investigation onsite and

part of it in their office and the devices would be stored effectively in a place, wherein it is not

affected by any external device or radiation and a proper procedure for storing and using it will

be followed.

8. Examination

This stage involves examining of the contents of all the collected evidence by extracting and

the required information from all the devices associated with the computer where the criminal

activity had occurred. This stage involves filtering, validating and matching all the possible data,

which supports in investigating the incident and recovering as much data as possible (Dezfoli

et al., 2013). The auditors will carry out a thorough examination of all the data collected from

the computers from where data was deleted as well as from the computers where changes had

been made to the application (Beckett & Slay, 2011). The examination will provide the forensic

investigators with evidence of the changes made to the application, the time and the extent of

changes.

9. Analysis

This stage involves analyzing the collected data and identifying the significance or use of the

data. It also involves restructuring the data collected from the incident and determining the chain

of possible events and time of occurrence of the criminal activity (Sammons, 2012). The auditors

in this stage would be able to identify the important data and using it to trace the events, which

might have occurred in the entire activity.

10. Presentation

In this stage the analysis done based on the various data collected is presented to the target

audience, which include technical experts of the organization, officers from the legal department

and the management of the organization (Dezfoli et al., 2013). It will include the methodology,

data and techniques used by the forensic analysts to arrive at the stated conclusion. The auditors

in this stage would be able to provide the details on how the entire criminal activity occurred to

the management and the legal experts, which will enable them to take necessary actions.

11. Result and Review

The last stage involves review of the entire investigation and analyze if any further

improvements are required in the investigation and if any further investigations need to be

carried out (Sammons, 2012). The auditors would review if all the concerned people and devices

were analyzed to identify the source of criminal activity and if required further investigation will

be carried out to avoid such incidents in future.

Resources required to conduct Digital Forensic Investigation

Evidence gathering is one of the most important functions of the digital forensic investigation

since the analysis and identification of the source of criminal activity can be obtained from the

evidence gathered. The resource, which would be used for evidence gathering would be Live

Data Forensic System (LDFS), which includes LDFS collection tool and LDFS analysis tool

(Lim et al., 2012). This tool will enable the auditors to collect most of the evidence from the

site in a short period of time. The tool would enable the auditor to analyze and correlate the

data gathered as evidence and collect the data according to the order of volatility of the data

(Lim et al., 2012). The team, which will conduct the investigation, will include members with

certification Certified Forensic Investigation Practitioner (CFIP) and Certified Information

Systems Security Professional (CISSP) having the knowledge of working on different operating

system (Sammons, 2012). These certified members would be capable of carrying out proactive

investigation of the incident and carry out a survey with key stakeholders in the incident. The

team will also be capable of collecting, analyzing and preserving data and also recover the

deleted data.

Approach for Data/Evidence Identification and Acquisition

Evidence identification and acquisition involves preserving all the possible data from the scene

and the systems by using effective evidence gathering techniques. The acquisition should

be carried out by taking photograph of the scene where the criminal activity occurred and

then making an inventory of the evidence to be gathered (Dezfoli et al., 2013). The first step

in acquiring the evidence is to creating mirror copy of the hard disk in a safe location. The

computer should then be switched off and disconnected from all the external devices. The value

or CRC of all the contents should be created, which will enable the investigators to prove the

authenticity and accuracy of the evidence acquired. The evidence acquisition tool, which will be

used, is EnCase, a forensic product of Guidance Software Inc. since it enables the investigators

to acquire data from range of devices, provides comprehensive reports of the findings and

maintains the integrity of the evidence (Sammons, 2012). It enables the acquisition of different

types of evidences including audio, video, documents etc.

Steps in the Analysis Phase

Analysis of System Information

The first and foremost evidence would be gathered from the system, which is affected by the

criminal activity. Under this analysis all kinds of setting elements should be analyzed, which

are required to be revised to avoid any malicious program running on the system (Agarwal et

al., 2011). When system is booted list of processes are run automatically in the registry, which

might have been blocked by the attacker so that any malicious program run in the background

cannot be identified. This can be overcome by using Autorun program, which highlights all the

programs running on the system (Sammons, 2012). It also enables to gather the various type of

data stored in the system.

Analysis of network information

The next step in forensic analysis would involve analyzing the network connection information

of the system. In this analysis the investigator can analyze if the attacker communicated with the

system by opening the network port of the system and also enables the investigator to find if the

computer has been compromised (Beckett & Slay, 2011). In this stage the investigators would

be able to collect the evidence of the attacker and the techniques used by the attacker to affect

the computer. The analysis will also enable the investigator to analyze, which part of data the

attacker has been accessing and manipulating.

Analysis of the external devices

The forensic analysis involves analyzing the external devices, which contain data and might have

been used to transfer the malicious program on the system, which deleted the data of customers

(Beckett & Slay, 2011). The evidence of the programs on the external devices can be collected

through this analysis.

Conclusion

Digital forensic investigation provides a holistic approach in investigation of a criminal activity

carried out on digital devices. Using the systematic digital forensic investigation auditors

can effectively collect all the evidence in a secure manner, preserve it and use it to justify the

reason behind the criminal activity, its source and severity. Live Data Forensic System (LDFS)

is an effective tool for gathering evidence since it correlates the collected data. The evidence

acquisition is one of the important functions and is carried out by first acquiring data from the

system and then from all the external devices to which it is connected. The steps involved in

forensic analysis involve analysis of system, network and analysis of the external devices, which

would enable the investigators to collect the evidence sequentially and accurately. The collected

evidence would help in analyzing and identifying the source of criminal activity at CGHI.

References

Agarwal, A, Gupta, M, Gupta S & Gupta, S (2011), Systematic Digital Forensic Investigation

Model, International Journal of Computer Science and Security , Volume 5, Issue 1, pp. 118-131

Altheide, C & Carvey, H (2011), Digital Forensics with Open Source Tools, Syngress; 1 edition

Beckett, J & Slay, J (2011), Scientific underpinnings and background to standards and

accreditation in digital forensics, Digital Investigation 8 (2012) , pp. 114-121

Casey, E (2005), Handbook of Digital Forensics and Investigation, Academic Press; 1 edition

Casey, E (2011), Digital Evidence and Computer Crime, Academic Press; 3 edition

Dezfoli, F, Dehghantanha, A, Mahmoud, R, Binti, N, Sani, M & Daryabar, F (2013), Digital

Forensic Trends and Future, International Journal of Cyber-Security and Digital Forensics

(IJCSDF) 2(2): pp 48-76

Lim, K, Savoldi, A, Lee, C & Lee, S (2012), On-the-spot digital investigation by means of

LDFS: Live Data Forensic System, Mathematical and Computer Modeling 55 (2012) 223–240

Nelson, B, Phillips, A & Steuart, C (2009), Guide to Computer Forensics and Investigations,

Cengage Learning; 4 edition

Richard III, G, Roussev, V & Marziale, L (2007), Forensic discovery auditing of digital evidence

containers, Digital Investigation 4 (2007), pp. 88-97

Sommer, P (2012), Digital Evidence, Digital Investigation and E-Disclosure: A Guide to

Forensic Readiness, IAAC

Sammons, J (2012), The Basics of Digital Forensics: The Primer for Getting Started in Digital

Forensics, Syngress; 1 edition

Turner, P (2007), Applying a forensic approach to incident response, network investigation and

system administration using Digital Evidence Bags, Digital Investigation 4 (2007), pp. 30-35

Statistics assignment help at Assignmentmakers.com

Statistics Assignment Help and Statistics Homework Help are offered at Assignmentmakers.com. We provide statsitics help at all levels viz school level statistics, college level statistics, graduate level statistics, university level statistics.
When you submit your statistics assignment to us at info@assignmentmakers.com, it goes through the following steps:
1) A statistics assignment help expert goes through your questions and identify the statistics tutor who can solve the assignment nicely.
2) We send you our price quote for the statistics assignment or statistics homework and we will send you the price link for the confirmation of the order.
3) As soon as you make the payment we start working on your statistics assignment or statistics homework.
4) Once our expert statistics tutor finishes working on your assignment we pass it on to the quality checking department who works on the quality, look and feel of your statistics assignment or statistics homework.
5) Once quality checked we deliver you the assignment and wait for your response. In most of the cases students come back to us with excellent replies. But may be you were looking at something else in your statistics assignment or statistics homework help. If such is the case - feel free to get back to us and get all doubts clarified. From the date of submitting your statistics homework or statistics assignment we will provide you free of cost service for next 10 days on that assignment.
Some of the popular statistics topics successfully completed by our writers include –

1. Histograph, Pie, Bar Diagram etc.
2. Mean, Median, Mode, Variance, Standard Deviation etc
3. Sampling
4. Probability
5. Correlation, Regression
6. Data Analysis – Time Series, Multi-variate Analysis, Robust Statistics
7. Mathematical statistics
8. Decision theory
9. Bayesian inference
10. Statistical inference
11. Estimation theory
12. Non-parametric statistics
13. Computational statistics
14. Data filtering
15. Combinatorics
16. Simulation
17. Monte Carlo method
18. Central limit theorem
19. Principal component analysis (PCA)
20. Statistical survey

At Assignmentmakers.com we offer the best help in assignments, homework and online tutoring in Statistics apart from other subjects. Our writers/tutors are professionals and experts in their fields which include subjects like Statistics, Finance, Economics, Marketing, Human Resources, Engineering, Mathematics, English, Accountancy and other subjects.
Assignmentmakers is a pool of expert assignment writers who promises to deliver quality custom made assignments free from plagiarism. We send Turnitin Plagiarism report with each of our assignment to ensure that all our assignments are Plagiarism free. Our writers are well-qualified with years of experience in making reports, articles, essays, discussion papers, thesis, dissertations, disquisitions and all other forms of assignments. Our custom essay writing services have been welcomed by students and professionals all over the world. We not only help with your assignments but provide a comprehensive assignment writing service to suit your requirements. No matter what the topic of your assignment and how strict your deadline is, Assignment Maker is here to take all your worries with an affordable solution.

We have been providing essay writing service for students all over the world – Australia, UK, USA, Canada, New Zealand, UAE, Singapore, Malaysia, India, and other countries. We provide assistance to students from K-12, College and University. We follow a standardized price structure, for more details on our price structure, you can visit our website www.assignmentmakers.com
Our work has 0% plagiarism in it. We do not resell our work i.e. an assignment sent to one student will not be sent to another student who wants help on the same topic. Instead, we start working on the topic from scratch and give the student a new assignment. This is the reason why 90% of our students come back to us. Visit our website http://www.assignmentmakers.com