Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
7.2 Future Work
Overall the application does comply with the original design specification that was set
out in Chapter 4; unfortunately there are a few flaws which would need to be
addressed before the application could be fully released. The first flaw was stated in
the conformance testing. The application does not capture the username of the person
that is modifying the files, but it does however capture the username of the person that
is currently logged onto the server.
The second flaw is in the current design of the Client application; currently when the
application starts it prompts the user/administrator to enter a key that would be used to
calculate the HMAC hash, if the user/administrator was in the process of modifying
an event log they could simply not enter the key until the Event Log Service had been
restarted. Perhaps some form of peer based system that allows the servers to remotely
monitor each other would be able to prevent this. Either that or base the HMAC key
on a digital certificate.
A third area that would require more work is with how the server stores the log files.
Currently there is no method in place for being able to check if events have been
added or removed while they were off-site. This could have be addressed by allowing
the client to build a local log file that is identical to that on the server. At a given
interval a hash could be produced on both the client and the server, and then
exchanged with one another. Any discrepancies would then be highlighted.
It would also be good if the system could be tested in a ‘real life’ environment, to see
how it copes with multiple users accessing files at the same time. According to the
tests that have been carried out, in theory, it should work fine, as the event logger
application is monitoring the file system not the users.
69