Laboratory capacity building for the International Health Regulations (IHR[2005]) in resource-poor countries: the experience of the African Field Epidemiology Network (AFENET) R E V I E W Open Access BMC Public Health
Published: 3 December 2010

Monica Musenero Masanza
Ndlovu Nqobile
David Mukanga
Sheba Nakacubo Gitta

African Field Epidemiology Network
Plot

Mackenzie Vale
P.O. Box 12874Kampala

Laboratory capacity building for the International Health Regulations (IHR[2005]) in resource-poor countries: the experience of the African Field Epidemiology Network (AFENET) R E V I E W Open Access BMC Public Health
Published: 3 December 2010*Correspondence: email@example.com Masanza et al. BMC Public Health 2010, 10(Suppl 1):S8 Masanza et al. BMC Public Health 2010, 10(Suppl 1):S8
Laboratory is one of the core capacities that countries must develop for the implementation of the International Health Regulations (IHR[2005]) since laboratory services play a major role in all the key processes of detection, assessment, response, notifi cation, and monitoring of events. While developed countries easily adapt their wellorganized routine laboratory services, resource-limited countries need considerable capacity building as many gaps still exist. In this paper, we discuss some of the eff orts made by the African Field Epidemiology Network (AFENET) in supporting laboratory capacity development in the Africa region. The eff orts range from promoting graduate level training programs to building advanced technical, managerial and leadership skills to in-service short course training for peripheral laboratory staff . A number of specifi c projects focus on external quality assurance, basic laboratory information systems, strengthening laboratory management towards accreditation, equipment calibration, harmonization of training materials, networking and provision of pre-packaged laboratory kits to support outbreak investigation. Available evidence indicates a positive eff ect of these eff orts on laboratory capacity in the region. However, many opportunities exist, especially to support the roll-out of these projects as well as attending to some additional critical areas such as biosafety and biosecuity. We conclude that AFENET's approach of strengthening national and sub-national systems provide a model that could be adopted in resource-limited settings such as sub-Saharan Africa.

Introduction

In today's interconnected world, the risk of international spread of infectious diseases has greatly increased. Th is was well illustrated by the rapid spread of the recent infl uenza (H1N1) and severe acute respiratory syndrome (SARS) epidemics, where all continents were quickly threatened by an emergent pathogen in one corner of the world. Th e purpose of International Health Regulations (IHR [2005]) is "to prevent, protect against, control and provide a public health response to the international spread of disease in ways that are commensurate with and restricted to public health risks, and which avoid unnecessary interference with international traffi c and trade. " [1]. Article 13 (Public Health Response) of the IHR(2005) obligates States Parties to develop, strengthen and maintain the capacity to respond promptly and eff ectively to public health risks and emergencies of international concern as soon as possible but no later than fi ve years from the entry into force of the regulations [1]. Progress by States Parties toward the attainment of the stated goals is based on eight core capacities, to be implemented by the year 2012.

Core capacity 8 of IHR (2005) obligates World Health Organization (WHO) Member States to establish mechanisms for providing reliable and timely laboratory identifi cation and characterization of infectious agents and other hazards likely to cause public health emergencies of national and international concern, including shipment of specimens to the appropriate laboratories if necessary. Laboratory services therefore play a major role in all the key processes of the IHR, including detection, assessment, response, notifi cation, and monitoring of events.

Developed countries with well-organized routine laboratory services can easily meet this core capacity through existing systems. However, resource-limited countries, especially those in sub-Saharan Africa, need considerable capacity building. Attaining adequate capacities will require functional community, sub-national and national systems. Th erefore, laboratory capacity building for IHR core capacity 8 must by necessity focus on strengthening the routine systems within which events are detected and reported.

For a long time, laboratory services were not considered a priority for most resource-limited health care systems in Africa, resulting in poor infrastructure, low human resource capacity and inappropriate technologies [2]. Th e need for building laboratory diagnostic capacity in Africa has been well articulated over the recent past [2][3][4][5][6]. Conse quently, there have been eff orts to enhance laboratory capacity over the past fi ve years in many sub-Saharan countries. Th ese eff orts have largely been driven by the need for improved laboratory support to surveillance and treatment programs for specifi c diseases such as HIV/ AIDS, malaria, tuberculosis (TB) and avian infl uenza [7] at national and a few regional centers. Indeed, a recent review by Olmsted et al (2010) suggests a general improvement in infrastructure and service provision [8]. However, more challenges still exist, including the lack of suffi cient numbers of well-trained laboratory scientists in public health service and inadequate laboratory management and leadership skills. Th ere is no or limited distribution of available national laboratory guidelines and a lack of internal and external quality assurance systems, which is usually accompanied by low appreciation of quality control. No eff orts have been made towards assist ing laboratories to attain international standards such as ISO 15189 and hence slow progress to accreditation. Other challenges have been the poor quality, limited analysis and utilization of laboratory data; inconsistent and inadequate reagent supply chains; and lack of equipment maintenance [9].

Th e African Field Epidemiology Network (AFENET) is a coalition of Field Epidemiology Training Programs (FETPs) in Africa, initiated in 2005 out of a need to network and facilitate the strengthening of disease surveil lance and public health responses to epidemics in the region. Since then, AFENET has grown in membership from four to ten countries. AFENET is organized around a networking and service concept, operating mainly through cooperation with other agencies, host country health ministries, universities, non-governmental organiza tions (NGOs), the private sector and an extensive network of professionals. Currently, the organization's activities are focused on six strategic priorities, namely: 1) fi eld epidemiology capacity development; 2) public health laboratory capacity development; 3) public health disease surveillance and eff ective response; 4) networking and collaboration; 5) AFENET's institutional develop ment; and 6) information and publications. In this paper, we discuss some of AFENET's experiences in building laboratory capacity in the region.

AFENET's laboratory capacity building eff orts

Human resource development

Th e capacity to plan and implement an eff ective public health laboratory system that meets the IHR core capacity requirements depends on the availability of highlytrained and motivated personnel that are not only technically competent, but also possess strong leadership and managerial skills. For years, there has been a lack of advanced-level training programs for laboratory scientists, and this has contributed to the poor state of the laboratory sector in the region. While laboratory staff could be imparted with technical skills, the fi eld has been short of leadership since laboratory staff are rarely included in the decision-making process of health service planning [10].

Since 1993, AFENET founding member countries have been running a graduate-level program in public health, the Field Epidemiology Training Program (FETP), to build a critical mass of public health leaders who are available to respond to public health challenges in the region. Recognizing the eff ectiveness of this approach in provid ing competent and motivated staff , a proposal was made to leverage the curriculum by adding a laboratory compo nent (known as the Laboratory Track). Th is was piloted in Kenya in 2004 as a Field Epidemiology and Laboratory Training Program (FELTP); laying the framework on which similar programs have been founded in other countries.

Th e generic curriculum for the laboratory track was developed with input from the Kenyan Ministry of Health, universities, and the American Society for Labora tory Medicine, and has since been adapted by other countries. Admission requires a bachelor's degree in medicine or other related sciences. Although detailed content may diff er slightly from program to program, they generally aim at developing a similar set of basic competencies, as detailed by Kariuki et al (2008) [10]. Th e program combines short didactic courses and laboratory bench work to impart skills in advanced laboratory science; the use of computers in public health; basic and fi eld epidemiology, biostatistics, and public health surveillance; the epidemiology and diagnosis of communicable and non-communicable disease; and management and leadership. Th is is a two year program with residents spending 65-75% of this time in fi eld placement. Table 1 summaries the current status of residents enrolled or graduated from the Laboratory Track program.

So far, 75 trainees have been enrolled and 20 have graduated from the Laboratory Track in the six FELTPs. To our knowledge, these are the fi rst advanced-level training programs focus ing on public health laboratories, combining technical, managerial and leadership skills in this region. Even FETPs without a designated Laboratory Track are contri buting by enrolling laboratory personnel for train ing in Field epidemiology. For example, the Zimbabwe and Uganda FETPs have so far trained six and two laboratory personnel, respectively.

Th e training is designed to impart a ripple eff ect throughout the region. Th is is achieved through three approaches: 1) by utilizing the existing programs to train "seed" personnel from other countries in the region, who will then play a central role in the development of national programs; 2) by encouraging graduates to partici pate in mentoring programs in other countries; and 3) by having residents and graduates conduct short courses. For example, the Kenya program has trained residents from Ghana, Southern Sudan, Tanzania, and Uganda. Th e Nigeria, South Africa, and Tanzania pro grams were mentored by graduates of the Kenya program. Ideally, as more countries gain the capacity to run their own FELTPs, there will be an algorithmic growth of trained professionals in the region.

Th e graduate-level training is complemented by short in-service training courses for mid-level managers and other peripheral laboratory staff to enhance systems for routine laboratory operations in district/provincial levels. Th e short courses employ two innovative approaches: 1) jointly training medical and laboratory personnel primarily on laboratory matters; and 2) incorporating a 3-month fi eld mini-project with presentations of fi ndings before a panel. Over 500 fi eld staff have been trained in these short courses. Th e short course curricula are available as open resources, and AFENET provides technical support to any country desiring to conduct these courses at any time [12]. Th rough the graduate and short course trainings, AFENET is playing a critical role in fasttracking the building of a sustainable senior-level cadre of laboratory personnel that will champion the attainment and maintenance of IHR core capacities in the region. Moreover, there is evidence that if appropriate steps are taken, the retention rate of these graduates in their countries of origin is quite high [11].

Laboratory outbreak investigation kit

To enhance timely laboratory support during outbreak investigations, as well as to facilitate the learning of the FELTP trainees, AFENET packages and distributes a comprehensive outbreak response kit to countries where disease outbreaks occur regularly. Th e contents are adapted according to the specifi c country's needs and most frequent diseases. Th is kit has been provided to Ministries of Health in Uganda, Kenya, Zimbabwe, Ethiopia and Ghana. Th e generic kit content and guidelines are available at the AFENET website.

Laboratory quality assurance: The HIV external quality assurance (EQA) project

Th e unreliability of laboratory results is cited as one of the major limitations to laboratory support for health care in Africa [2]. Th e utility of laboratory systems in the implementation of the IHR is also greatly dependent on the reliability and quality of laboratory results. However, applicable and cost-eff ective models for achieving accurate and reliable laboratory results in the low-income African countries have yet to be optimized.

One of the areas where external quality assurance (EQA) is critical is in the monitoring of the routine HIV rapid testing. Most countries in the region depend on retesting as the primary means of monitoring the quality of HIV serologic testing. Th is approach is expensive, timeconsuming and logistically challenging in decentralized settings [13]. Traditionally, HIV external quality assurance programs use liquid serum or plasma specimens that require special cold storage and transportation condi tions. Th e biohazard risks and costs of this approach have resulted in national quality assurance programs being weak, and consistent quality assurance is generally lacking in lower-tier laboratories [13].

In 2009, AFENET, in collaboration with the U.S. Centers for Disease Control and Prevention (CDC) and the mandated national institutes in Uganda and Tanzania, began a pilot HIV EQA project using the recently developed dried tube specimen (DTS) Profi ciency Testing (PT) panels. Th is approach addressed a number of the technical and logistical challenges of re-testing as reported in the Atlanta and Kenya studies [13]. Th e DTS is a cost-eff ective approach and is easy to prepare, stable at high temperatures and can be transported by mail to any part of the country. Working with CDC, in-country teams and the host country health ministries, 200 laboratory and nonlaboratory testing sites in each country were selected. DTS panels are produced by the national reference laboratories and distributed to these sites on a quarterly basis (or depending on country algorithm) through the postal services. After testing at the sites, the results are sent back to the reference laboratories for analysis and scoring. Feedback reports are generated and poorly performing sites are provided with support supervision visits and/or retraining. Th e project supports the mailing costs, data entry and laboratory scientists to provide technical backup.

Preliminary data received from the fi rst PT round reported 80% and 91% response rates in Uganda and Tanzania, respectively. Reasons for poor performance were identifi ed per sites. Common problem areas include failing to follow national testing algorithms, not mastering proper pipetting tech nique, failing to follow DTS reconstitution procedures, new or untrained testing staff , and clerical errors in recording test results in both registers and PT report forms. Proper corrective actions, including on-site train ing and demonstrations, were taken.

Th is project provides an opportunity to assess parameters for eff ective EQA systems in Africa, such as local production of EQA materials and the utilization of the local mailing and transport systems. Th rough this project we hope to identify cost-eff ective ways of designing and implementing EQA systems, especially for rapid diagnostics that are expected to play an increasing role in the region.

Basic Laboratory Information Systems (BLIS) project

At the core of IHR practice is reliable information. In most African settings, laboratory data is stored in a format that makes retrieval, analysis and summarization for public health action diffi cult. Laboratory information is often captured in multiple reports and may be inaccurate, non-standardized and illegible.

Th e Basic Laboratory Information System (BLIS) is an easy-to-use software that can be used as an eff ective alternative to paper-based approaches to enhance laboratory data management. As such, labs move a step towards accreditation by using BLIS to improve labora tory information management. Moreover, if properly inte grated into the laboratory management practices, BLIS addresses document and record management, inven tory control and forecasting. Laboratory sites imple menting BLIS receive an initial evaluation prior to installation of the software which is customised to the facility needs. Th e laboratory receives hardware as well as training. Ongoing information technology support is provided by AFENET personnel. Use and management of laboratory data is assessed by monitoring ease of access and retrieval of patient data, as well as laboratory quality indicators like turnaround time.

Lessons coming from the fi eld indicate that BLIS is making data storage and analysis easier. However, computer literacy at low-tier laboratories remains a challenge.

With readily available and timely information, public health responses to diseases of international concern can be guided appropriately.

Laboratory networking

Where resources are scarce and inequitably distributed, networking may reduce the gaps between diff er ent populations. WHO advocates for the establish ment of national public health networks to ensure the timely exchange of information and the adequate support of laboratory services at all levels. At both the national and sub-national levels, only a few countries have functional public health laboratory networks in place. In order to strengthen public health capacity within Africa, AFENET created an AFENET-Lab unit to oversee the networking and implementation of laboratory strength en ing initiatives. One of the unit's mandates is to promote public health net working and cross-border collaborations between sub-national, national, regional and inter national public health laboratories and laboratorians for information sharing, technical support, training and other capacity building programs. We believe that this will enhance labora tory capacity by reducing the isolation of peri pheral laboratories and enabling them to access network resources. AFENET-Lab began a pilot laboratory net working project in Uganda in 2009, when a memorandum of understanding was signed with the Ministry of Health, Biomedical Laboratory Network (BLN), Uganda Medical Laboratory Technology Association (UMLTA) and Uganda Association of Biomedical Scientists (UABMS).

Strengthening Laboratory Management towards Accreditation (SLMTA) program

Accreditation is a means of certifying the competence of a laboratory to perform specifi c types of testing and it enhances customer confi dence in accepting testing results. Medical laboratories are accredited by attaining requirements for quality and competency based on international standards, namely ISO 15189. Accredited laboratories therefore play a critical role in providing reliable information to inform IHR decision-making and guiding public health response. Currently, there are very few accredited laboratories in Africa and most of these belong to private sector or international research organiza tions. Th e accreditation process requires stringent conditions that have been largely unattainable by most public health laboratories in Africa.

To address the paucity of accredited laboratories in the African region, the WHO Regional Offi ce for Africa (WHO AFRO) established a stepwise approach for laboratories to attain the required standards. Th is approach supports laboratories at all levels through a series of evaluations using demonstrated improvements, which are recognized and rewarded for the progress [14,15].

To support this accreditation process, the Strengthening Laboratory Management towards Accreditation (SLMTA) program -a training and mentoring toolkit for laboratory improvement and accreditation was developed. Th e purpose of the SLMTA trainings is to strengthen laboratory management for immediate and measurable laboratory improvement and to accelerate the process toward lab accreditation by WHO AFRO. AFENET, as a regional partner, took the lead in creating the momentum for the SLMTA roll out update which is posted on the AFENET-Lab website.

AFENET, working with other partners, has so far provided technical assistance by conducting baseline assessments and trainings in Rwanda, Zimbabwe and Swaziland. AFENET is therefore well positioned to support diff erent countries in the roll out of SLMTA.

To garner support for this eff ort, AFENET collaborated with the WHO, CDC, and the Ugandan Ministry of Health to organize a workshop for senior policymakers to advocate for laboratory accreditation. Over 40 public health experts, including offi cials from the health ministries of Uganda, Kenya, Tanzania, Rwanda, and Ethiopia met in July 2010 in Kampala. Countries expressed their commitment to develop national laboratory policies and strategic plans that incorporate laboratory accreditation within the next coming year.

Equipment calibration

Laboratory equipment maintenance and calibration is one of the key components of improving the quality of laboratory services, and is also critical in moving laboratories towards the stepwise WHO AFRO accredi tation scheme. Additionally, quality equipment is essential to produce the valid and reliable laboratory results needed to inform decision-making in outbreak situations. Th e lack of working equipment has aff ected the eff ective delivery of health care in resource-poor settings. Often, laboratory equipment does not function properly because regular maintenance services are unavailable, particularly for ancillary equipment. Very little eff ort has been directed towards laboratory equip ment calibration. Th e few automated laboratory machines that come with service contracts are typically the only equipment that receive regular maintenance. Additionally, the existing commercial services providers have remained costly, making it diffi cult for health ministries to be able to maintain all the laboratory equipment.

AFENET, in collaboration with CDC and other partners such as Global Health Systems Solutions (GHSS), has organized training sessions to create a pool of local and regional biomedical engineers and equipment technicians able to meet the demands of labora tory equipment maintenance and calibration on a regular basis. Th is training creates regional capacity that reduces the costs of having the laboratory equipment serviced and calibrated. Th e trained cadres are part of the health ministry institutions, thereby ensuring that capacity to address equipment calibration is readily available. Th e biomedical engineers and equipment technicians are trained on servicing and calibration of a variety of laboratory equipment. Th ese cadres are then sent back to their countries to provide equipment servicing and calibration support, particularly to the laboratories enrolled for accreditation.

Six participants, two from each country, from Kenya, Tanzania and Cameroon went through the rigorous practical training in calibration and maintenance of pipettes, microscopes, heating blocks, incubators, autoclaves, microplate washers and readers, vortex stirrer, centrifuges, refrigerators and freezers. Pre-and postassessment tests were conducted, and results showed an increase in the knowledge gained during the training. Table 2 shows the scores. Th ere is a great need to support these seed staff so they can scale up this training and acquire standardized calibration tools for these countries.

Harmonization of laboratory training materials

Until recently, diff erent partners have been conducting various laboratory capacity building trainings in Uganda without following a standard curriculum or using standardized learning materials. A number of development partners have implemented various trainings to build laboratory capacity for health services in Uganda. Consequently, a single laboratory may receive a number of diff erent training materials from various well-meaning organizations, and this can be overwhelming to an already understaff ed laboratory. To address this problem, the training sub-committee of the Uganda National Health Laboratory Technical and Advisory Committee (LTC) received fi nancial and tech nical support from AFENET to put together a compre hensive training package to equip laboratory workers with the management skills they require to be eff ective in their positions. Th e training packages are a compilation of learning materials from various partners that were customized to meet the requirements of agreed upon curriculum. Th e curriculum is practical oriented and targets not only laboratory-specifi c needs, but also general management skills to achieve overall system strengthening for health services.

Challenges and opportunities

Challenges Decision-making can be an arduous process in AFENET's large network because of the multiplicity of players and divergent interests. Th e limited appreciation of the laboratory as a priority area for capacity building slows down the buy-in for various initiatives by national authorities. One of the major challenges AFENET has encountered is limited funding, which often restricts what can be done or is insuffi cient to maintain an eff ort till it has reached a sustainable level.

Opportunities

AFENET and its partners have done a commendable job, and there are still many opportunities for improving the capacity of the laboratory sector. Available funding has so far enabled AFENET to develop and demonstrate eff ective approaches; however, most of these programs have yet to be implemented. It is AFENET's vision that every country in the region should have its own FELTP and enhance peripheral personnel skills through short course training. Th e SLMTA process is also an opportunity to support more laboratories towards accreditation. Laboratory mentoring is also critical especially for improving performance in peripheral laboratories.

In addition, gaps still exist in biosecurity and biosafetly, an area in which AFENET is just beginning to build training capacity. Specifi cally, there is a need for training on the handling, packaging and shipment of infectious substances. Improving biosecurity is another major opportunity that still exists. Other gaps include programs that build capacity in logistics management, strengthening of national public health laboratory networks, rolling out mid-level manager training and external quality assurance.

Conclusions

Detection, response, notifi cation and monitoring of PHEICs are the key components of the IHR and all require robust laboratory support. Th erefore, capacity building for the IHR must by necessity also focus on strengthening the routine laboratory systems within which events are detected and reported. AFENET is purposefully building capacity that runs through the entire laboratory structure from the lowest level to referral facilities by leveraging on the network approach. We believe this approach will build laboratory capacity at lower levels where these events usually occur, and thus ensure timely and adequate laboratory support. With adequate support, AFENET's approach provides a logical, sustainable and strategic model with a multiplicative eff ect that can enable countries in resource limited settings attain and sustain the IHR laboratory capacity (core capacity 8).

Table 1 .
1Residents and graduates of Laboratory Track programs in AFENET member FELTPsYear
Current
Total
Program
Started
Graduates
Trainees
Enrollment

Kenya
2004
20
12
32

South Africa
2007
0
15
15

Nigeria
2008
0
8
8

Tanzania
2008
0
13
13

Rwanda
2010
0
4
4

WAFELTP*
2010
0
3
3

Totals
20
55
75

*West Africa Field Epidemiology Program, based in Ouagadougou, but serves
four French speaking countries -Burkina Faso, Togo, Mali and Niger.

Masanza et al. BMC Public Health 2010, 10(Suppl 1):S8 http://www.biomedcentral.com/1471-2458/10/S1/S8
Masanza et al. BMC Public Health 2010, 10(Suppl 1):S8 http://www.biomedcentral.com/1471-2458/10/S1/S8 Page 6 of 7
AbbreviationsAcknowledgementsWe would like to acknowledge the input of Dr. Peter Nsubuga into the design of many of the programs we are reporting about. We appreciate our colleagues at CDC, ministries of health, and other partners who have worked tirelessly to design and implement these programs. We would also like to thank Dr. Monday Busuulwa and Mr. Aloysious Bingi of AFENET for reviewing and making editorial input.Authors' contributionsMMM contributed towards conceptualization, data collection, drafting and fi nal revisions of the version to be published; NN contributed to the technical content of the information presented, conception and design of the projects, drafting and reviewing the article; DM contributed towards the conceptualization, drafting and revising the article it for important intellectual content; SG contributed towards the intellectual content and fi nal revisions of the version to be published.Competing interestsThe authors declare that they have no competing interests.
World Health Organization: International Health Regulations. Second EditionWorld Health Organization: International Health Regulations (2005). Second Edition; 2008.

Laboratory medicine in Africa: a barrier to eff ective health care. C A Petti, C R Polage, T C Quinn, A R Ronald, M A Sande, Clin Infect Dis. 423Petti CA, Polage CR, Quinn TC, Ronald AR, Sande MA: Laboratory medicine in Africa: a barrier to eff ective health care. Clin Infect Dis 2006, 42(3):377-82.

Are laboratory services coming of age in sub-Saharan Africa. I Bates, K Maitland, Clin Infect Dis. 423Bates I, Maitland K: Are laboratory services coming of age in sub-Saharan Africa. Clin Infect Dis 2006, 42(3):383-4.

Okeke, Diagnostic insuffi ciency in Africa. 42Okeke IN: Diagnostic insuffi ciency in Africa. Clin Infect Dis 2006, 42(10):1501-3.

Medical laboratory services in Africa deserve more. A S Muula, F C Maseko, Clin Infect Dis. 42101503Muula AS, Maseko FC: Medical laboratory services in Africa deserve more. Clin Infect Dis 2006, 42(10):1503.

Achilles heel" of global eff orts to combat infectious diseases. R Berkelman, G Cassell, S Specter, M Hamburg, K : Klugman, The, Clin Infect Dis. 4210Berkelman R, Cassell G, Specter S, Hamburg M, Klugman K: . The "Achilles heel" of global eff orts to combat infectious diseases. Clin Infect Dis 2006, 42(10):1503-4.

K Mcclurea, J Arbiqueb, A Rendellb, P Rizzo-Pricec, CLSI: Building Laboratory Capacity in Africa. 31McClurea K, Arbiqueb J, Rendellb A, Rizzo-Pricec P: CLSI: Building Laboratory Capacity in Africa. Clin Micro News 2009, 31(13): 95-99.

Strengthening laboratory systems in resource-limited settings. S S Olmsted, M Moore, R C Meili, H C Duber, J Wasserman, P Sama, B Mundell, L H Hilborne, Am J Clin Pathol. 1343Olmsted SS, Moore M, Meili RC, Duber HC, Wasserman J, Sama P, Mundell B, Hilborne LH: Strengthening laboratory systems in resource-limited settings. Am J Clin Pathol 2010, 134(3):374-80.

World Health Organization: Everybody business: strengthening health systems to improve health outcomes: WHO's framework for action. GenevaWorld Health Organization: Everybody business: strengthening health systems to improve health outcomes: WHO's framework for action. Geneva, 2007

Laboratory Epidemiologists: Skilled Partner in Field Epidemiology and Disease Surveillance in Kenya. M K Njenga, D Traicoff, C Tetteh, S Likimani, J Oundo, R Breiman, J Nyamongo, H Burke, P Nsubuga, White Me, 29Njenga MK, Traicoff D, Tetteh C, Likimani S, Oundo J, Breiman R, Nyamongo J, Burke H, Nsubuga P, and White ME: Laboratory Epidemiologists: Skilled Partner in Field Epidemiology and Disease Surveillance in Kenya. Journal of public health policy 2008, 29(2):149-64

D Mukanga, O Namusisi, S N Gitta, G Pariyo, M Tshimanga, A Weaver, M Trostle, Field Epidemiology Training Programmes in Africa-Where are the graduates? Human Resources for Health. 818Mukanga D, Namusisi O, Gitta SN, Pariyo G,Tshimanga M, Weaver A, Trostle M: Field Epidemiology Training Programmes in Africa-Where are the graduates? Human Resources for Health 2010, 8:18.

The African Field Epidemiology Network: Laboratory training course: curriculum handbook. The African Field Epidemiology Network: Laboratory training course: curriculum handbook. [http://www.afenet.net/downloads/lab_manual_ web.pdf ].

Dried tube specimens: a simple and cost-eff ective method for preparation of HIV profi ciency testing panels and quality control materials for use in resource-limited settings. B S Parekha, J Anyanwua, H Patela, M C Downera, M Kaloua, C Gichimub, B S Keipkerichb, N Clementb, M Omondia, O Mayera, C Y Oua, J N Nkengasonga, J Virol Meth. Parekha BS, Anyanwua J, Patela H, Downera MC, Kaloua M, Gichimub C, Keipkerichb BS, Clementb N, Omondia M, Mayera O, Oua CY, Nkengasonga JN: Dried tube specimens: a simple and cost-eff ective method for preparation of HIV profi ciency testing panels and quality control materials for use in resource-limited settings . J Virol Meth 2009 [http://www.ustfhiv. org/cms/documents/DTS_J_Virol_Methods_2009.pdf ].

Accessed 14. Accessed 14 Sep 2010.

The World Health Organization African Region Laboratory Accreditation Process: Improving the Quality of Laboratory Systems in the African Region. G M Gershy-Damet, P Rotz, D Cross, E H Belabbes, F Cham, J B Ndihokubwayo, G Fine, C Zeh, P A Njukeng, S Mboup, D E Sesse, Phd7, T Messele, D L Birx, J N Nkengasong, 10.1186/1471-2458-10-S1-S8Am J Clin Path. 134Gershy-Damet GM, Rotz P, Cross D, Belabbes EH, Cham F, Ndihokubwayo JB, Fine G, Zeh C, Njukeng PA, Mboup S, Sesse DE, PhD7, Messele T, Birx DL, Nkengasong JN: The World Health Organization African Region Laboratory Accreditation Process: Improving the Quality of Laboratory Systems in the African Region. 2010. Am J Clin Path, 134:393-400. doi:10.1186/1471-2458-10-S1-S8

Laboratory capacity building for the International Health Regulations (IHR[2005]) in resource-poor countries: the experience of the African Field Epidemiology Network (AFENET). M M Masanza, BMC Public Health. 108Cite this article as. Suppl 1Cite this article as: Masanza MM, et al.: Laboratory capacity building for the International Health Regulations (IHR[2005]) in resource-poor countries: the experience of the African Field Epidemiology Network (AFENET). BMC Public Health 2010, 10(Suppl 1):S8.


Incidence Handling and Response System (make the computer network more secure and capable enough to withstand any kind of attack.)
2009

ProfR Dhananjay firstname.lastname@example.com
Dept.of Computer Engg.. Sardar Patel Institute Of Technology (SPIT)
Principal Pillai's Institute of Information Technology (PIIT)
Student Sardar Patel Institute of Technology(SPIT)
Mumbai, Mumbai, New PanvelIndia., India., India

Asst Kalbande
Dept.of Computer Engg.. Sardar Patel Institute Of Technology (SPIT)
Principal Pillai's Institute of Information Technology (PIIT)
Student Sardar Patel Institute of Technology(SPIT)
Mumbai, Mumbai, New PanvelIndia., India., India

Professor
Dept.of Computer Engg.. Sardar Patel Institute Of Technology (SPIT)
Principal Pillai's Institute of Information Technology (PIIT)
Student Sardar Patel Institute of Technology(SPIT)
Mumbai, Mumbai, New PanvelIndia., India., India

Mr Manish Singh
Dept.of Computer Engg.. Sardar Patel Institute Of Technology (SPIT)
Principal Pillai's Institute of Information Technology (PIIT)
Student Sardar Patel Institute of Technology(SPIT)
Mumbai, Mumbai, New PanvelIndia., India., India

Prof.DrG T Thampi email@example.com
Dept.of Computer Engg.. Sardar Patel Institute Of Technology (SPIT)
Principal Pillai's Institute of Information Technology (PIIT)
Student Sardar Patel Institute of Technology(SPIT)
Mumbai, Mumbai, New PanvelIndia., India., India

Incidence Handling and Response System (make the computer network more secure and capable enough to withstand any kind of attack.)

IJCSIS) International Journal of Computer Science and Information Security
212009IncidenceIncidence HandlingComputer SecurityInformation SecurityDisaster RecoveryBlocking The Attacks
A computer network can be attacked in a number of ways. The security-related threats have become not only numerous but also diverse and they may also come in the form of blended attacks. it becomes difficult for any security system to block all types of attacks. this gives rise to the need of an incidence handling capability which is necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited and restoring the computing services. incidence response has always been an important aspect of information security but it is often overlooked by security administrators. in this paper, we propose an automated system which will handle the security threats and make the computer network capable enough to withstand any kind of attack. we also present the state-of-the-art technology in computer, network and software which is required to build such a system.

I. INTRODUCTION

In an organization, thousands of possible signs of incidents may occur each day. The organizations that are attacked typically call a Computer Security and Incident Response Team(CSIRT) to handle the incident.However, CSIRTs are not accessible to all . A system can be built which utilizes the services of host-based and network-based IDPSs, firewalls,antivirus and other tools to detect incidents, auditing and forensic tools to gather evidence of incident,implements event correlation and centralized logging to intelligently analyze and classify incidents,mitigate incidents and restore the system to a stable state.We aim at developing such an automated system. We make use of the required softwares and tools to build the system in the following way:

• We convert Snort which is an network IDS into an adaptive IDS/IPS . • We make use of host-based IDS i.e Tripwire to ensure the integrity of critical system files and directories by identifiying all changes made to them. • We use the sleuth kit to examine the file system and layout of disks and other media of the suspected computer • We install Clam AntiVirus toolkit to scan the files and emails too using command line. • We make use of SSH protocol to establish a secure connection between two systems • We use Tcpdump to sniff packets over network.

A. Network Intrusion Detection System (NIDS)

NIDS are intrusion detection systems that capture data packets traveling on the network media (cables, wireless) and match them to a database of signatures. Depending upon whether a packet is matched with an intruder signature, an alert is generated or the packet is logged to a file or database.

Packet Capture Library:

Once captured, packets are passed to a packet decoder, so that they can be translated into an IDS's internal data structure that provide a uniform basis for packet analysis.

Preprocessor:

Preprocessors are very important for any IDS to prepare data packets to be analyzed against rules in the detection engine.

The Detection Engine:

The detection engine is the most important part of an IDS. Its responsibility is to detect if any intrusion activity exists in a packet.

Output Plug-in:

If suspicious activity is identified by the Detection Engine, output plug-ins are called to generate administrative alerts. Now in this project , we configure snort and run it in IDS mode so that the packets or alerts are logged into a file say alerts.ids in /var/log/snort directory. We make use of classification.config located in /etc/snort to filter the log file alerts.ids and separate the ipaddresses from where the attacks such as portscan or ICMP flooding attack were launched.We perform the above operation by writing a shell script which will block the attacker's ipaddress using the command: Route -add host ipaddress reject;

The ICMP ping flooding can be stopped by using the following command for iptables:
Iptables -A input
Thus snort detects all possible types of attacks and classifies them using the classification.config file. The shell script matches the alerts with the classification , classifying the attacks and acts accordingly. Thus in this way we build an adaptive IDS/IPS system that will block all major types of attacks like Denial of Service, Trojan, portscans and others.

B. Host Intrusion Detection System (HIDS)

Host-based intrusion detection systems or HIDS are installed as agents on a host. These intrusion detection systems can look into system and application log files to detect any intruder activity. Some of these systems are reactive, meaning that they inform you only when something has happened. Some HIDS are proactive; they can sniff the network traffic coming to a particular host on which the HIDS is installed and alert you in real time.

Open Source Tripwire

Tripwire is a program that helps Linux Administrators detect "unauthorized activity" on their computers by creating a baseline database (digitally signed by you using a Passphrase that you mention during installation of the product) of all the files on the computer, including information about each file's size and last modification date. It generates the baseline by taking a snapshot of specified files and directories in a known secure state. (For maximum security, Tripwire should be installed and the baseline created before the system is at risk from intrusion.) Once it is generated, you can then check the current state of your system against the original baseline database and get a report of all the files that have been modified, deleted or added. The baseline database consists of checksum numbers generated by encryption algorithms from the file's contents. Using Tripwire for intrusion detection and damage assessment helps you keep track of system changes and can speed the recovery from a break-in by reducing the number of files you must restore to repair the system.

Modes of operation

Tripwire runs in one of four modes: Database Generation, Database Update, Integrity Checking, or Interactive Update mode. Database Generation $ tripwire --init The /usr/local/lib/tripwire directory contains the Tripwire database of your system's files (*.twd) named as host.twd, where host is the host-name of the linux machine and a report directory where Tripwire reports are stored. Database Update $ tripwire --update Integrity check $ tripwire --check > /tmp/report.txt It will then proceed to check your filesystem against the database and will create a file called report.txt in /tmp which will contain information on what Tripwire discovered.

C.The Sleuth Kit

The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file and volume system forensic analysis tools. The file system tools allow you to examine file systems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.The volume system (media management) tools allow you to examine the layout of disks and other media. The Sleuth Kit supports DOS partitions, BSD partitions (disk labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT disks. With these tools, you can identify where partitions are located and extract them so that they can be analyzed with file system analysis tools Timelines: Creating a timeline of system activity will give an investigator clues regarding where to probe further. The timelines in The Sleuth Kit allow one to quickly get a high-level look at system activity, such as when files were compiled and when archives were opened. TSK allows you to generate timelines of activity from a variety of sources. Autopsy allows you to also create timelines using the TSK tools.At a high level, timeline generation is a two step process. In the first step, temporal data is gathered from various data sources (such as file systems, registries, logs, etc.) and saved to the body file format. This step is done using the 'fls' tool in TSK or other tools, which are listed below. The second step is to sort and merge all of the temporal data into a single timeline. This step is done using the 'mactime' script in TSK.

• Data Gathering The primary method for collecting temporal data from file systems is to run fls with the '-m' flag. The fls command saves its output to a file in the body file format. Sample fls command: # fls -m "C:/" -o 63 -r images/disk.dd > body.txt • Mactime mactime creates an ASCII timeline of file activity based on the output of the fls tool. It can be used to detect anomalous behavior and reconstruct events. mactime reads the body file (using the '-b' argument), which contains a line for each file or event. mactime then sorts the data based on its temporal data and prints the result. It can optionally use a starting date or a date range to limit the data being printed. Sample mactime output:
#

D. The Clam Antivirus Toolkit

Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The important facilities provided by ClamAV, relevant to this project are:

• Fast, multi-threaded daemon with support for onaccess scanning

• Scans within archives and compressed files (also protects against archive bombs), including zip, rar, arj, gzip, bzip2, etc.

• Support for other special file formats including rtf, doc, pdf, etc.

• Advanced database updater with support for scripted updates and digital signatures Unlike rlogin or telnet SSH encrypts the login session, making it impossible for intruders to collect clear-text passwords.SSH is designed to replace common methods for remotely logging into another system through a command shell. A related program called scp replaces older programs designed to copy files between hosts such as ftp or rcp. Using secure methods to remotely log in to other systems will decrease the security risks for both your system and the remote system.SSH (or Secure SHell) is a protocol for creating a secure connection between two systems. In the SSH protocol, the client machine initiates a connection with a server machine.The following safeguards are provided by SSH:

After an initial connection, the client verifies it is connecting to the same server during subsequent sessions.

• The client transmits its authentication information to the server, such as a username and password, in an encrypted format.

• All data sent and received during the connection is transferred using strong, 128 bit encryption, making it extremely difficult to decrypt and read.

• The client has the ability to use X11 applications launched from the shell prompt. This technique, called X11 forwarding, provides a secure means to use graphical applications over a network.Because the SSH protocol encrypts everything it sends and receives, it can be used to secure otherwise insecure protocols. Using a technique called port forwarding, an SSH server can become a conduit to secure insecure protocols, like POP, increasing overall system and data security. To reduce the load on the machine when the user might be doing some other work, and to facilitate a semi-automation of the system, the scripts to run snort, tripwire, antivirus, chkrootkit, and backups are added to crontabs. In Linux, crontabs are located at /var/spool/cron/tabs. Whatever scripts are added to this file are executed periodically, as specified .

There are five fields representing the time / periodicity of execution. The fields represent different date parts in the following order:

1. minute (from 0 to 59) 2. hour (from 0 to 23) 3. day of month (from 1 to 31) 4. month (from 1 to 12) 5. day of week (from 0 to 6) (0=Sunday)

A. Tripwire File Integrity Checking

The system then scans the report generated by tripwire and matches the modified files to this list. If a match is found, the system requests that the administrator replace that particular file. #! /bin/sh # tripshell.sh nice tripwire --check for file in `grep "Modified object name:" /tmp/report.txt | cutc 24-` do grep `basename "$file"` /$HOME/severity_levels.txt > /dev/null 2>&1 if [ $? -eq 0 ] then echo "Critical File: $file modified!" echo "Please replace $file with a clean backed up version" fi done exit 0

Our system scans the file system automatically every day after noon, when the load on the machine is relatively less. This is done by adding tripshell.sh to cron jobs. 00 12 * * * $HOME/tripshell.sh > /dev/null 2>&1

B. Snort-IDS

Our system blocks attacks with the help of snort. This is done by adding the rogue IP address to Iptables and specifying that it be blocked from attempting to communicate with our machine. It also effectively prevents attacks by the same attacker.

#! /bin/sh grep -i -e " Unknown Traffic" -e "information leak" -e "nonstandard protocol or event" -e "scan" -e "Trojan" -e "Denial of service" -e "attack" -e "suspicious" -e "system call" -e "Misc activity" -e "vulnerable" -e "privilege gain" -e "client was using an unusual port" -e "executable code was detected" -e "information leak" -e "bad traffic" -e "unusal" -e "violation" -e "Attempt to login by a default username and password" -e "Decode of an RPC Query" /var/log/snort/alerts.ids >> /var/log/snort/scanreport cut -d ':' -f7 /var/log/snort/scanreport|cut -c11-25|sort -u|grepv "192.168.45.203"|grep -v "-"|sort -u -b |cat -n > blockaddress files=$(cat blockaddress) for var in $files do echo "i am inside" echo "$var" iptables -A INPUT -s $var -p icmp --icmp-type echo-request -m length --length 1500:0xffff -j DROP route add -host $var reject done echo "the following addresses have been blocked permanently" cat blockaddress C. Chkrootkit chkrootkit is a tool to locally check for signs of a rootkit. It contains a chkrootkit: shell script that checks system binaries for rootkit modification. The following tests are made: aliens, dirname, echo, egrep, env, find, fingerd, gpm, grep, hdparm, su, ifconfig, inetd, inetdconf, rpcinfo, rlogind, rshd, slogin, sendmail, sshd, syslogd, tar, tcpd, top, telnetd, timed, traceroute, and write. ifpromisc.c checks whether the interface is in promiscuous mode, chklastlog.c checks for lastlog deletions, chkwtmp.c checks for wtmp deletions, check_wtmpx.c checks for wtmpx deletions (Solaris only), and chkproc.c checks for signs of LKM Trojans. The code snippet below shows that the above tests are carried out and if a rootkit has been found then the sys admin(root) is mailed an alert. After configuring clamscan and freshclam by doing appropriate modification to /etc/clamav/freshclam.conf, the anti-virus software is all ready to be used. All that remains to be done is to run the antivirus scan periodically, and ensure that the virus signatures database is regularly updated. Our system ensures this by scanning the system every day after noon, when the machine has less load. This is done by adding the following line to crontabs, 00 12 * * * $HOME/antivirus.sh > /dev/null 2>&1 The script antivirus.sh looks like this, #! /bin/sh # antivirus.sh nice freshclam nice clamscan --no-summary -il $HOME/antivirus_infected_list -r /usr 2> /dev/null nice clamscan --no-summary -il $HOME/antivirus_infected_list -r /bin 2> /dev/null nice clamscan --no-summary -il $HOME/antivirus_infected_list -r /etc 2> /dev/null nice clamscan --no-summary -il $HOME/antivirus_infected_list -r /boot 2> /dev/null for file in `cut -d ":" -f1 $HOME/antivirus_infected_list` do grep `basename "$file"` $HOME/severity_levels.txt > /dev/null 2>&1 if [ $? -eq 0 ] then echo "Critical File: $file infected!" echo "Please replace $file with a clean backed up version" else echo "$file is infected!" rm -i $file fi done exit 0

E. Evidence Gathering

Various tools are available to gather data from a partition or a Hard drive, to simplify the process we used a built-in utility called 'dd' because it is available in all the Linux distributions. The 'dd' command was also used because it creates an image of a partition without modifying the access times of that partition and its files, which is extremely important from the point of view of gathering evidence and not tampering with it. Below is the code snippet for creating a disk image of the partition named '/dev/sda1' to '/home/jai/data.dd'. dd if=/dev/sda1 of=/home/jai/data.dd bs=4096 \ conv=notrunc,noerror Here : if = input file of = output file bs = bytes conv = Convert the file as specified by the CONVERSION argument(s). Here notrunc means don't truncate files and noerror means continue after read errors.

F. Evidence Analysis

The sleuth kit include a lot of functions related to File system analysis, Data recovery, and Timeline creation & analysis. Creating a timeline of system activity will give an investigator clues regarding where to probe further. The timelines in The Sleuth Kit allow one to quickly get a highlevel look at system activity, such as when files were compiled and when archives were opened. TSK allows you to generate timelines of activity from a variety of sources.We will analyze the disk image created earlier using the 'fls' and 'mactime' included in the sleuth kit. The 'fls' command requires the '-m' argument with the '-r' flag to gather all files. This step walks through the directory hierarchy and outputs a line for each file in the file system. This command needs to be run for each partition in a disk image. fls -m / -r home/ihrs/data.dd > bodyline.txt #The output of the above command goes to bodyline.txt in the #standard bodyline format of TSK 2.0 mactime -b bodyline.txt > timeline.txt #the output of the above command goes to timeline.txt which #contains MAC times for every file in the disk image from here #on we can use 'grep' to find out MAC times for suspected files. #M=Modified, A=access, C=created times. #sample grep command below grep "\/dev\/" timeline.txt > timeline.dev.txt #this command creates a MAC times for the /dev directory in the #partition

G. SSH Backups

The backup commands in our system use SSH to encrypt data over network and rsync to copy and sync files over the network.The script is added to crontab to automate the time of back ups at user discretion. SSH allows automated remote login with private key-public key encryption and is hence used in our system.

Key pair generation

On the machine you want to log in to, type ssh-keygen -t to generate the key pair.  Here jai@server is the user on server which has read permissions to /home/jai/bin and bin dir from client side is sent to jai@server. We have automated the script by adding it as a cron job i.e. Backups occur every Friday at 5 pm. 00 17 * * 5 $HOME/bin/backup.sh > /dev/null 2>&1

IV.TESTING

The project was deployed on a computer in a college network and tested against a variety of attacks. The software worked successfully and was able to block majority of the attacks. For example, we performed an intense port-scan attack using N-map software on a computer before and after installing our software on the machine. N-map is used by a hacker or an attacker for OS-fingerprinting in which he tries to find out the vulnerable ports that are open , the operating system of the victim's machine and other details that are required to launch an attack. After performing the test, we got the following result. The above two figures are the screenshots taken from the computer from which we launched the portscan attack on the victim machine using Nmap portscanner. As we can see from figure 1 , Nmap is able to detect an open port which has the SSH service running on the victim computer .The attacker can use this knowledge to devise ways to penetrate into the victim's machine through the open ports. But when we install and deploy our project on the same machine, the output of Nmap indicates that all ports on the victim machine are filtered.This is because Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically making things difficult for the attacker. The automated system is able to block a majority of the attacks. This is because the Snort-IDS uses classification.conf file which is able to classify attacks based on their types. The various categories include denial of service, attempted/successful privilege gain, detection of network scan, Trojan activity, suspicious login, ping of death attack, flooding attack, malicious codes and other attacks. The backups are taken care of by the SSH protocol wherein the data is transferred in the encrypted form between client and the backup server.

V.CONCLUSION

We have thus implemented a comprehensive Incidence Handling and Security System, which is capable of handling most of the common security threats. The system covers incidents specified in the scope of the project. The system has been successfully deployed and tested on a machine running Linux Fedora 10, which uses Linux kernel version 2.6.27. The system uses the third party open source tools and software as specified before, and the programming capabilities of the Linux bash shell.

The system can be deployed on any machine working on Linux operating system. However, the component systems should have a variant for that flavor of Linux. Also, the component systems required to be pre-installed on the machine.

VI. FUTURE RESEARCH

The automated system that has been designed is capable of handling all major basic types of attacks. But it is bounded by the limitations of the classification.conf file of the Snort-IDS. It will act on only those attacks which have been listed in the classification file. Though the list of attacks classified in the file should suffice to block a majority of attacks and keep the system secure, we need to add a capability that will make the system immune to blended attacks. Also ,with the wide variety of attacking tools being easily available today, blended attacks become easy and they pose a threat to the system. Since the performance of our automated system is decided by the components that have been integrated, care has been taken to configure all the components properly so that the overall system offers maximum protection with the best of its capabilities.

The components that have been used must be updated with time regularly for best results. There is a scope for addition of more components or replacement of any component with a new one that comes in the market with better services .Although centralized logging has been implemented to help forensics, there is a scope for the development of the customized event-correlator and system auditing as well.

Figure 1 .
1System Context Diagram Of Incidence Handling And Response System II. SOFTWARES AND TOOLS TO BE USED

Figure 2 .
2Architecture Of Network Intrusion Detection System

Figure 3 .
3Working of tripwire

mactime -b body.txt 2002-03-01 > tl.03.01.

Figure 4 .
4The SSH protocol III. IMPLEMENTATION

for rootkits... $safe_chkrootkit | $safe_grep -e INFECTED -e Vulnerable if [ $? -ne 0 ]; then echo -e \\a ${0}: NO SECURITY ALERT: NO possible rootkit infection detected! # email alert message echo "message from ${0}: NO possible rootkit infection detected! Run ${safe_chkrootkit} to see which files are infected"\ | $safe_mail -s "=== NO SECURITY ALERT: possible rootkit infection detected!"

$

Figure 5 .Figure 6 .
56Nmap Output Before Automation Of System Nmap Output After Automation Of System

• Virus database updated multiple times per day For example, to scan all files and sub-directories in the folder '/home', use the following command:Freshclam.is the Clam AntiVirus Database Updater. It is configured by the file freshclam.conf. This file has to be modified by the user in the appropriate way for freshclam to work properly. Some lines that need to be modified in freshclam.conf look like this after modification:SSH allows users to log into host systems remotely.clamscan -r /home
Some return codes of the command, relevant to the project,
are:

0 : No virus found.

1 : Virus(es) found.

54: Can't open file.

Freshclam:

DatabaseDirectory /var/lib/clamav
UpdateLogFile /var/log/clamav/freshclam.log
DatabaseOwner clamav
DNSDatabaseInfo current.cvd.clamav.net
DatabaseMirror db.in.clamav.net
DatabaseMirror database.clamav.net
MaxAttempts 3
Checks 24
NotifyClamd /etc/clamav.conf

E.SSH protocol

Your identification has been saved in /home/bob/.ssh Your public key has been saved in /home/bob/id_rsa.pub. Now copy the private key to the to the .ssh directory of the account on the machine you will be logging in from. scp id_dsa root@foo:~/.ssh/id_dsa Also copy the public key to the allowed list of ssh logins.ssh-keygen
-t
rsa
Generating
public/private
dsa
key
pair.
Enter passphrase (empty for no passphrase): [press enter here]
Enter same passphrase again: [press enter here]
The
key
fingerprint
is:
2e:28:d9:ec:85:21:e7:ff:73:df:2e:07:78:f0:d0:a0 bob@linux
cp id_dsa.pub authorized_keys2

To enable passwordless login type

ssh-add

This sets up remote login between client machine and
backup server.
Now use rsync to send back up data over the network.

rsync -avz /home/jai/bin -e ssh jai@server:/home/jai/bin
sending incremental file list
.....
watashi/

A taxonomy of internet traceback. Ihab Hamadeh, George Kesidis, International Journal of Security and Networks. 11Ihab Hamadeh and George Kesidis, "A taxonomy of internet traceback," International Journal of Security and Networks, Vol. 1, No.1/2, pp. 54 - 61, 2006.

Firewall filtering rules analysis for anomalies detection. Adel Bouhoula, Zouheir Trabelsi, Ezedin Barka, Mohammed-Anis Benelbahri, International Journal of Security and Networks. 33Adel Bouhoula, Zouheir Trabelsi, Ezedin Barka, and Mohammed-Anis Benelbahri, "Firewall filtering rules analysis for anomalies detection," International Journal of Security and Networks, Vol. 3, No. 3, pp. 161 - 172, 2008.

An agent-based framework for intrusion detection alert verification and event correlation. Benjamin Uphoff, Johnny S Wong, International Journal of Security and Networks. 33Benjamin Uphoff and Johnny S. Wong, "An agent-based framework for intrusion detection alert verification and event correlation," International Journal of Security and Networks, Vol. 3, No. 3, pp. 193 -200, 2008.

Computer Security Incident Response Planning: Preparing for the Inevitable. Internet Security Systems, Inc. "Computer Security Incident Response Planning: Preparing for the Inevitable." Internet Security Systems, Inc., 2001. <http://www.iss.net/support/documentation/whitepapers/technical.php> (3 July 2003).

Teaching network security through live exercises. G Vigna, Kluwer Academic Publishersin Security education and critical infrastructuresG. Vigna, "Teaching network security through live exercises," in Security education and critical infrastructures: Kluwer Academic Publishers, 2003, pp. 3-18.

Riccobene Managing Reputation over MANETs IAS. G Bella, G Costantino, S , 4th International Symposium on Information Assurance and Security. M.Rak et al.Naples,ItalyIEEE PressG.Bella,G.Costantino,S.Riccobene Managing Reputation over MANETs IAS 2008, 4th International Symposium on Information Assurance and Security,Sept.2008,Naples,Italy. M.Rak et al. (editors), pages 255-260, IEEE Press

Snort IDS Configuration and Analysis, By. Susan. E. YoungSnort IDS Configuration and Analysis, By Susan. E. Young

. Managing Security with Snort. Managing Security with Snort and IDS Tools, By Kerry Cox and Christopher

A Unix In, O' Nutshell, Reilly, Concepts and Applications. BySumitabha DasUnix In A Nutshell, O'Reilly [10] UNIX:Concepts and Applications,By Sumitabha Das

NIST SP 800-61 : Computer Security Incident Handling Guide. NIST SP 800-61 : Computer Security Incident Handling Guide.

NIST SP 800-83 : Guide to Malware Incident Prevention and Handling [13] Snort -Intrusion Detection System. NIST SP 800-83 : Guide to Malware Incident Prevention and Handling [13] Snort -Intrusion Detection System http://www.snort.org

The Sleuth Kit -Evidenced Gathering and Forensic Analysis. The Sleuth Kit -Evidenced Gathering and Forensic Analysis http://www.sleuthkit.org

. Tripwire-File, Tripwire-File Integrity Checker http://www.tripwire.sourceforge.net

Clam Antivirus. Clam Antivirus http://www.clamav.net

BASH shell. BASH shell http://www.gnu.org/software/bash/bash.html#TOC [18] SSH protocol http://www.ietf.org/rfc/rfc4251.txt

SSH protocol. SSH protocol http://www.redhat.com/docs/manuals/linux/RHL-7.3- Manual/ref-guide/ch-ssh.html