From: Leandro Lucarella Date: Tue, 16 Nov 2004 19:39:06 +0000 (+0000) Subject: Agrego tp2. X-Git-Tag: svn_import~1 X-Git-Url: https://git.llucax.com/z.facultad/78.01/practicos.git/commitdiff_plain/2f106f576c63372aa9bd6900d30de3344bb23d82?hp=ccfc09413aab27bf846126e8d9ec5cdaaf980016 Agrego tp2. --- diff --git a/Outline.rtf b/Outline.rtf new file mode 100644 index 0000000..7b530c4 --- /dev/null +++ b/Outline.rtf @@ -0,0 +1,251 @@ +{\rtf1\ansi\ansicpg1252\deff0 +{\fonttbl +{\f0\fnil\fcharset0\fprq0\fttruetype Arial;} +{\f1\fnil\fcharset0\fprq0\fttruetype NULL;} +{\f2\fnil\fcharset0\fprq0\fttruetype Dingbats;} +{\f3\fnil\fcharset0\fprq0\fttruetype Symbol;} +{\f4\fnil\fcharset0\fprq0\fttruetype Times New Roman;} +{\f5\fnil\fcharset0\fprq0\fttruetype Courier New;} +{\f6\fnil\fcharset0\fprq0\fttruetype StarSymbol;}} +{\colortbl +\red0\green0\blue0; +\red255\green255\blue255;} +{\stylesheet +{\*\cs5\sl240\slmult1\f0\fs24 Car\'e1cter de numeraci\'f3n;} +{\s22\sl240\slmult1\f0\fs24\sbasedon7 Lista;} +{\s24\sl240\slmult1\fi-431\li720\fs24\sbasedon25\snext31 Lower Roman List;} +{\s26\sl240\slmult1\tx431\fs24\sbasedon17\snext25 Numbered Heading 1;} +{\s27\sl240\slmult1\tx431\fs24\sbasedon18\snext25 Numbered Heading 2;} +{\s28\sl240\slmult1\tx431\fs24\sbasedon19\snext25 Numbered Heading 3;} +{\*\cs12\sl240\slmult1\fs24\sbasedon25 Endnote Text;} +{\*\cs32\sl240\slmult1\f0\fs24 S\'edmbolo de nota final;} +{\*\cs40\sl240\slmult1\f6\fs18 Vi\'f1etas;} +{\s9\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Diamond List;} +{\s29\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Numbered List;} +{\s1\sl240\slmult1\f0\fs56\b\sbasedon10\snext7 Encabezado 1;} +{\*\cs11\sl240\slmult1\f0\fs20\super Endnote Reference;} +{\s6\sl240\slmult1\tx1584\f0\fs24\sbasedon26\snext25 Chapter Heading;} +{\s34\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Square List;} +{\s8\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Dashed List;} +{\s39\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon29\snext31 Upper Roman List;} +{\s20\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Heart List;} +{\s23\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon29\snext31 Lower Case List;} +{\s38\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon29\snext31 Upper Case List;} +{\s4\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Bullet List;} +{\s16\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Hand List;} +{\*\cs15\sl240\slmult1\fs20\sbasedon25 Footnote Text;} +{\s17\sl240\slmult1\sb440\sa60\f0\fs34\b\sbasedon25\snext25 Heading 1;} +{\s18\sl240\slmult1\sb440\sa60\f0\fs28\b\sbasedon25\snext25 Heading 2;} +{\s19\sl240\slmult1\sb440\sa60\f0\fs24\b\sbasedon25\snext25 Heading 3;} +{\s36\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Tick List;} +{\*\cs25\sl240\slmult1\f4\fs24\lang1024\sbasedon31\snext31 Normal;} +{\s7\sl240\slmult1\sa119\f0\fs24\sbasedon31 Cuerpo de texto;} +{\s2\sl240\slmult1\li1440\ri1440\sa119\fs24\sbasedon25\snext31 Block Text;} +{\s13\sl240\slmult1\sb119\sa119\f0\fs20\i\sbasedon31 Etiqueta;} +{\s10\sl240\slmult1\sb240\sa119\f0\fs28\sbasedon31\snext7 Encabezado;} +{\s30\sl240\slmult1\f5\fs24\sbasedon25\snext31 Plain Text;} +{\s33\sl240\slmult1\tx1584\f0\fs24\sbasedon26\snext25 Section Heading;} +{\s21\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Implies List;} +{\s3\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Box List;} +{\s35\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Star List;} +{\*\cs14\sl240\slmult1\f0\fs20\super Footnote Reference;} +{\s37\sl240\slmult1\fi-431\li720\f0\fs24\sbasedon31\snext31 Triangle List;} +{\s41\sl240\slmult1\f0\fs24\sbasedon31 Índice;} +{\s31\sl240\slmult1\f0\fs24 Predeterminado;}} +{\*\listtable +{\list\listtemplateid1067\listsimple{\listlevel\levelnfc0\levelstartat1\levelspace0\levelfollow0\fi-282\li282{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1010} +{\list\listtemplateid1068\listsimple{\listlevel\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1027} +{\list\listtemplateid1069\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1028} +{\list\listtemplateid1070\listsimple{\listlevel\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1029} +{\list\listtemplateid1071\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1030} +{\list\listtemplateid1072\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1031} +{\list\listtemplateid1073\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1032} +{\list\listtemplateid1074\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1033} +{\list\listtemplateid1075\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1034} +{\list\listtemplateid1076\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1035} +{\list\listtemplateid1077\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1036} +{\list\listtemplateid1078\listsimple{\listlevel\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1037} +{\list\listtemplateid1079\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1038} +{\list\listtemplateid1080\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1039} +{\list\listtemplateid1081\listsimple{\listlevel\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1040} +{\list\listtemplateid1082\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1041} +{\list\listtemplateid1083\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1042} +{\list\listtemplateid1084\listsimple{\listlevel\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1043} +{\list\listtemplateid1085\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1044} +{\list\listtemplateid1086\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1045} +{\list\listtemplateid1087\listsimple{\listlevel\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1046} +{\list\listtemplateid1088\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1047} +{\list\listtemplateid1089\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1048} +{\list\listtemplateid1090\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1049} +{\list\listtemplateid1091\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1050} +{\list\listtemplateid1092\listsimple{\listlevel\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1051} +{\list\listtemplateid1093\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1052} +{\list\listtemplateid1094\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1053} +{\list\listtemplateid1095\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1054} +{\list\listtemplateid1096\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1055} +{\list\listtemplateid1097\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1056} +{\list\listtemplateid1098\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1057} +{\list\listtemplateid1099\listsimple{\listlevel\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1058} +{\list\listtemplateid1100\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1059} +{\list\listtemplateid1101\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1060} +{\list\listtemplateid1102\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1061} +{\list\listtemplateid1103\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1062} +{\list\listtemplateid1104\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1063} +{\list\listtemplateid1105\listsimple{\listlevel\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1064} +{\list\listtemplateid1106\listsimple{\listlevel\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1065} +{\list\listtemplateid1107\listsimple{\listlevel\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}}\listid1066}} +{\*\listoverridetable +{\listoverride\listoverridecount0\listid1010\levelnfc0\levelstartat1\levelspace0\levelfollow0\fi-282\li282{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls1} +{\listoverride\listoverridecount0\listid1027\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls2} +{\listoverride\listoverridecount0\listid1028\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls3} +{\listoverride\listoverridecount0\listid1029\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls4} +{\listoverride\listoverridecount0\listid1030\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls5} +{\listoverride\listoverridecount0\listid1031\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls6} +{\listoverride\listoverridecount0\listid1032\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls7} +{\listoverride\listoverridecount0\listid1033\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls8} +{\listoverride\listoverridecount0\listid1034\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls9} +{\listoverride\listoverridecount0\listid1035\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls10} +{\listoverride\listoverridecount0\listid1036\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls11} +{\listoverride\listoverridecount0\listid1037\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls12} +{\listoverride\listoverridecount0\listid1038\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls13} +{\listoverride\listoverridecount0\listid1039\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls14} +{\listoverride\listoverridecount0\listid1040\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls15} +{\listoverride\listoverridecount0\listid1041\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls16} +{\listoverride\listoverridecount0\listid1042\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls17} +{\listoverride\listoverridecount0\listid1043\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls18} +{\listoverride\listoverridecount0\listid1044\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls19} +{\listoverride\listoverridecount0\listid1045\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls20} +{\listoverride\listoverridecount0\listid1046\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls21} +{\listoverride\listoverridecount0\listid1047\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls22} +{\listoverride\listoverridecount0\listid1048\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls23} +{\listoverride\listoverridecount0\listid1049\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls24} +{\listoverride\listoverridecount0\listid1050\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls25} +{\listoverride\listoverridecount0\listid1051\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls26} +{\listoverride\listoverridecount0\listid1052\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls27} +{\listoverride\listoverridecount0\listid1053\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls28} +{\listoverride\listoverridecount0\listid1054\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls29} +{\listoverride\listoverridecount0\listid1055\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls30} +{\listoverride\listoverridecount0\listid1056\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls31} +{\listoverride\listoverridecount0\listid1057\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls32} +{\listoverride\listoverridecount0\listid1058\levelnfc4\levelstartat1\levelspace0\levelfollow0\fi-282\li566{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls33} +{\listoverride\listoverridecount0\listid1059\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls34} +{\listoverride\listoverridecount0\listid1060\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls35} +{\listoverride\listoverridecount0\listid1061\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls36} +{\listoverride\listoverridecount0\listid1062\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls37} +{\listoverride\listoverridecount0\listid1063\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls38} +{\listoverride\listoverridecount0\listid1064\levelnfc3\levelstartat1\levelspace0\levelfollow0\fi-282\li1133{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls39} +{\listoverride\listoverridecount0\listid1065\levelnfc1\levelstartat1\levelspace0\levelfollow0\fi-282\li1416{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls40} +{\listoverride\listoverridecount0\listid1066\levelnfc2\levelstartat1\levelspace0\levelfollow0\fi-282\li850{\leveltext\'02\'00.;}{\levelnumbers\'01;}\ls41}} + +\kerning0\cf0\ftnbj\fet2\ftnstart1\ftnnar\aftnnar\ftnstart1\ftnrestart\ftnrstpg\aftnstart1\aftnrestart\aendnotes\aenddoc\facingp\titlepg{\info}\deftab720\viewkind1\paperw11905\paperh16837\margl1440\margr1440\widowctl +\sectd\sbknone\colsx0\pgncont\ltrsect +\pard\plain\ltrpar\qc\sb240\sa119\s10\sl240\slmult1\itap0{\f0\fs44\lang1033{\*\listtag0}\abinodiroverride\ltrch Storage-based Intrusion Detection} +\par{\listtext\pard\fi-282\li282\sb57 1. }\pard\plain{\ltrpar\ql\fi-282\li282\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1010\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont NULL}{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Numbered List}}{\*\pn\pnql\pnstart1\pnlvlbody\pndec{\pntxtb }{\pntxta .}}\fn-282\li282\ls1\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang0{\*\listtag0}\abinodiroverride\ltrch Compromise independence} +\par}{\listtext\pard\fi-282\li566\sb57 a. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1027\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls2\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Client must not have administrator access to storage server} +\par}{\listtext\pard\fi-282\li566\sb57 b. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1027\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls2\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Server IDS administration must be done using a secured channel} +\par}{\listtext\pard\fi-282\li566\sb57 c. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1027\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls2\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch IDS can be located in several places} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1028\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls3\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Directly in the hardware}{\f0\fs24\lang1033\ltrch{\*\listtag0} (}{\f0\fs24\lang1033{\*\listtag0}IDE,}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}SCSI,}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}etc}{\f0\fs24\lang1033\ltrch{\*\listtag0})} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1028\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls3\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch In a virtual machine as a client} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1028\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls3\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch In a networked remote server} +\par}{\listtext\pard\fi-282\li282\sb57 2. }\pard\plain{\ltrpar\ql\fi-282\li282\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1010\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Numbered List}}{\*\pn\pnql\pnstart1\pnlvlbody\pndec{\pntxtb }{\pntxta .}}\fn-282\li282\ls1\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Warning signs for Storage IDSs} +\par}{\listtext\pard\fi-282\li566\sb57 a. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1029\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls4\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Data or attribute modification} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1030\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls5\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch System files change are usually warnings} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1031\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls6\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Header files} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1031\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls6\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Binary and script executable files} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1031\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls6\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Configuration files} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1030\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls5\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch On system upgrade system files change are not warnings} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1032\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls7\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Warning can be ignored by the administrator} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1032\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls7\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch The administrator can avoid the warnings telling the IDS what files are about to change} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1030\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls5\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Better approach than comparing checksums} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1033\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls8\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Immediate notification} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1033\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls8\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch No reference database maintenance} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1033\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls8\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Avoid relaying on client OS to do checks that can be compromised by intruders} +\par}{\listtext\pard\fi-282\li1133\sb57 D. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1033\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls8\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch It can detect short-term changes made and then undone} +\par}{\listtext\pard\fi-282\li566\sb57 b. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1029\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls4\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Suspicious update patterns} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1034\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls9\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Client system audit logs} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1035\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls10\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Usually append only} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1035\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls10\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch May be periodically}{\f0\fs24\lang1033\ltrch{\*\listtag0} \uc1\u8220\'93}{\f0\fs24\lang1033{\*\listtag0}rotated}{\f0\fs24\lang1033\ltrch{\*\listtag0}\uc1\u8221\'94} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1035\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls10\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Any other update pattern is suspicious} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1034\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls9\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Timestamp reversal} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1036\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls11\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch By manipulating the time stored in inodes an intruder hide some file manipulation} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1036\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls11\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Some programs manipulate this timestamps legitimately} +\par}{\listtext\pard\fi-282\li1416\sb57 I. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1037\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls12\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch This programs usually change time of newly created files only} +\par}{\listtext\pard\fi-282\li1416\sb57 II. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1037\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls12\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Other timestamp manipulation can trigger an alert} +\par}{\listtext\pard\fi-282\li1416\sb57 III. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1037\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls12\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch An intruder can delete and re-create the file but this can be detected with more complex rules} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1034\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls9\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Storage DoS attacks} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1038\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls13\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Allocating all or most of free space} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1038\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls13\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Allocating all or most of inodes or metadata} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1038\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls13\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Resources exhaustion triggers an alarm}{\f0\fs24\lang1033\ltrch{\*\listtag0} (}{\f0\fs24\lang1033{\*\listtag0}administrator attention is needed soon}{\f0\fs24\lang1033\ltrch{\*\listtag0})} +\par}{\listtext\pard\fi-282\li850\sb57 iv. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1034\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls9\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch General warnings} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1039\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls14\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Special attributes modification}{\f0\fs24\lang1033\ltrch{\*\listtag0} (}{\f0\fs24\lang1033{\*\listtag0}like set UID}{\f0\fs24\lang1033\ltrch{\*\listtag0})} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1039\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls14\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Access patterns to well known file types} +\par}{\listtext\pard\fi-282\li1416\sb57 I. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1040\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls15\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Word processor} +\par}{\listtext\pard\fi-282\li1416\sb57 II. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1040\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls15\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Unix password management files} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1039\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls14\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Common patterns of system calls} +\par}{\listtext\pard\fi-282\li1133\sb57 D. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1039\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls14\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Prone to false alarms} +\par}{\listtext\pard\fi-282\li566\sb57 c. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1029\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls4\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Content integrity} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1041\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls16\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Complexity} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1042\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls17\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Must understand the format of a file} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1042\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls17\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch File format may be arbitrarily complex and verification may require access to additional data blocks} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1042\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls17\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Security vs.}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}Performance trade-off decision needed} +\par}{\listtext\pard\fi-282\li1416\sb57 I. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1043\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls18\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Usually there are a few critical files checked} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1041\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls16\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Unix system password file as a study case} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1044\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls19\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Intruders can change root shell,}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}among other things} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1044\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls19\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Can be avoided checking the shell is valid with}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}/etc/shells} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1041\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls16\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Write-ahead logs as a study case} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1045\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls20\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Write-ahead logs can be used to detect intruders actions} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1045\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls20\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Intruders can manipulate the data directly bypassing the logs} +\par}{\listtext\pard\fi-282\li1133\sb57 C. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1045\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls20\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch IDS can ensure logs consistency} +\par}{\listtext\pard\fi-282\li1416\sb57 I. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1046\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls21\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch All changes are reflected in the logs} +\par}{\listtext\pard\fi-282\li1416\sb57 II. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1046\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls21\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch No fake changes appear in the logs} +\par}{\listtext\pard\fi-282\li1416\sb57 III. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1046\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls21\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Triggers an alarm whenever these system invariants are violated} +\par}{\listtext\pard\fi-282\li566\sb57 d. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1029\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls4\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Suspicious content} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1047\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls22\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Virus} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1048\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls23\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Can detect known viruses by its signature} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1048\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls23\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Viruses cannot disable the scanners even after infecting clients} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1047\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls22\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Large number of hidden files} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1049\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls24\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Hidden files are not displayed by normal directory listing interfaces} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1049\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls24\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Their use may indicate that an intruder is using the system as a storage repository} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1047\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls22\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Large number of empty files or directories} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1050\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls25\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch May indicate an attempt to exploit a race condition} +\par}{\listtext\pard\fi-282\li282\sb57 3. }\pard\plain{\ltrpar\ql\fi-282\li282\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1010\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Numbered List}}{\*\pn\pnql\pnstart1\pnlvlbody\pndec{\pntxtb }{\pntxta .}}\fn-282\li282\ls1\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Responding to intrusions} +\par}{\listtext\pard\fi-282\li566\sb57 a. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1051\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls26\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Storage IDS should not interfere with a valid,}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}running system} +\par}{\listtext\pard\fi-282\li566\sb57 b. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1051\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls26\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch A detected intruder action may be a legitimate user action}{\f0\fs24\lang1033\ltrch{\*\listtag0} (}{\f0\fs24\lang1033{\*\listtag0}false alarm}{\f0\fs24\lang1033\ltrch{\*\listtag0})} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1052\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls27\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Default response is to send an alarm} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1053\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls28\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch To the administrator} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1053\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls28\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch To an alert log file} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1052\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls27\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Security vs.}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}potential damage caused by false alarm trade-off decision needed when making other responses} +\par}{\listtext\pard\fi-282\li566\sb57 c. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1051\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls26\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Slow down suspected intruder's storage access} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1054\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls29\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Wait for alarm acknowledge before completing the suspicious request} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1054\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls29\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Increase request latencies} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1054\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls29\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Could be annoying for users when is a false alarm but cause not damage} +\par}{\listtext\pard\fi-282\li566\sb57 d. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1051\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls26\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Isolate intruders via versioning at the file system level} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1055\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls30\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch The file system forks the version tree on suspicious actions} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1055\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls30\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Administrator can legitimate actions to be committed} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1055\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls30\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Forking can interfere with system operation} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1056\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls31\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Hard reintegration of false alarms} +\par}{\listtext\pard\fi-282\li566\sb57 e. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1051\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls26\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Start versioning all data and auditing all storage request when an intrusion is detected} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1057\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls32\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Provides the administrator with information for post-intrusion diagnosis and recovery} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1057\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls32\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Intrusion-related information will likely be lost} +\par}{\listtext\pard\fi-282\li282\sb57 4. }\pard\plain{\ltrpar\ql\fi-282\li282\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1010\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Numbered List}}{\*\pn\pnql\pnstart1\pnlvlbody\pndec{\pntxtb }{\pntxta .}}\fn-282\li282\ls1\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Limitations} +\par}{\listtext\pard\fi-282\li566\sb57 a. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1058\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls33\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Can produce false alarms} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1059\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls34\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Few with specific rules} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1059\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls34\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Grows with more general rules} +\par}{\listtext\pard\fi-282\li566\sb57 b. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1058\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls33\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Can fail to spot some intrusions} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1060\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls35\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Intrusions that not cause storage odd behavior} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1061\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls36\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Networked worms} +\par}{\listtext\pard\fi-282\li1133\sb57 B. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1061\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls36\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Modification of storage in unwatched ways} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1060\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls35\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Can be improved using host IDSs and network IDSs too} +\par}{\listtext\pard\fi-282\li566\sb57 c. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1058\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls33\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033\ltrch{\*\listtag0}\uc1\u8220\'93}{\f0\fs24\lang1033{\*\listtag0}Game}{\f0\fs24\lang1033\ltrch{\*\listtag0}\uc1\u8221\'94 }{\f0\fs24\lang1033{\*\listtag0}of scalation} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1062\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls37\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Intruders will change tactics} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1062\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls37\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Rules must be updated to detect new tactics} +\par}{\listtext\pard\fi-282\li566\sb57 d. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1058\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls33\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Storage IDSs within individual components of decentralized storage systems are unlikely to be effective} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1063\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls38\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Disk array controller is a fin place to storage IDS} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1063\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls38\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Individual disks software striping is not} +\par}{\listtext\pard\fi-282\li1133\sb57 A. }\pard\plain{\ltrpar\ql\fi-282\li1133\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1064\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucltr{\pntxtb }{\pntxta .}}\fn-282\li1133\ls39\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Each of the disks has only part of the file system's state} +\par}{\listtext\pard\fi-282\li1416\sb57 I. }\pard\plain{\ltrpar\ql\fi-282\li1416\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1065\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Upper Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnucrm{\pntxtb }{\pntxta .}}\fn-282\li1416\ls40\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Difficult to check non-trivial rules} +\par}{\listtext\pard\fi-282\li566\sb57 e. }\pard\plain{\ltrpar\ql\fi-282\li566\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1058\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Case List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcltr{\pntxtb }{\pntxta .}}\fn-282\li566\ls33\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Is not free} +\par}{\listtext\pard\fi-282\li850\sb57 i. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1066\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls41\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Processing overhead} +\par}{\listtext\pard\fi-282\li850\sb57 ii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1066\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls41\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Memory resources consumption} +\par}{\listtext\pard\fi-282\li850\sb57 iii. }\pard\plain{\ltrpar\ql\fi-282\li850\sb57\s31\f0\fs24\lang11274{\*\listtag0}{\*\abilist\abilistid1066\abilistparentid0\abilistlevel1\abistartat1{\abifieldfont }{\abilistdecimal .}{\abilistdelim %L.}{\abiliststyle Lower Roman List}}{\*\pn\pnql\pnstart1\pnlvlbody\pnlcrm{\pntxtb }{\pntxta .}}\fn-282\li850\ls41\ilvl0\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}\abinodiroverride\ltrch Security vs.}{\f0\fs24\lang1033\ltrch{\*\listtag0} }{\f0\fs24\lang1033{\*\listtag0}performance trade-off decision needed} +\par}\pard\plain\ltrpar\ql\sl240\slmult1\itap0{\f0\fs24\lang1033{\*\listtag0}}} \ No newline at end of file