text:
Anderson Cooper selected as favorite celebrity substitute educator
Thousands vote in NEA's online poll during American Education Week
WASHINGTON - November 19, 2010 -
CNN's Anderson Cooper, popular journalist, author and television personality, would also make a great substitute teacher. That's the verdict rendered by those who voted in the National Education Association's fourth annual Substitute Educator's Day poll, conducted to draw attention to the role that substitute educators play in our nation's schools.
Substitute teachers have traditionally been honored on the Friday of American Education Week (AEW), which is being celebrated November 14–20 this year.
Given the choice among CNN anchor Cooper, actor and reality show star Tony Danza, actress Jennifer Grey, TV personality Rachel Ray, recording artist Taylor Swift and St. Louis Cardinals slugger Albert Pujols, 43 percent of the 700 respondents chose Cooper as the person they'd most like to see in the classroom as a substitute teacher.
As a follow-up to releasing the poll results, NEA will invite Cooper to spend the day as a substitute teacher in a public school.
"As a math teacher myself, I can tell you how critical it is to have well respected substitutes in our public schools," said NEA President Dennis Van Roekel. "During American Education Week, we pay tribute to substitute educators who step in at a moment's notice to carry out lesson plans and maintain a high level of learning."
When asked why they chose Anderson Cooper, one respondent wrote, "Anderson Cooper's work ethic, charisma, passion, integrity, compassion, bravery, knowledge of many subject areas and integrity are the qualities I find most evident in my colleagues in our profession—education. Thus, he would be the perfect substitute."
Cooper has covered many stories that affect America's young people, such as the rise of bullying. Last month, Cooper held a town hall on Anderson Cooper 360° titled Bullying: No Escape; an AC 360 Special Report with PEOPLE Magazine and Cartoon Network.
Online poll respondents included NEA members from across the country and the general public. The poll is just one of the many activities taking place across the nation to celebrate the 89th annual American Education Week. NEA is encouraging everyone to get involved by participating in a local event, volunteering in afterschool programs, attending a school activity, or organizing events.
For more information about American Education Week, visit www.nea.org/aew.
Follow us on twitter at www.twitter.com/NEAMedia
# # #
The National Education Association is the nation's largest professional employee organization, representing
3.2 million elementary and secondary teachers, higher education faculty, education support professionals, school administrators, retired educators and students preparing to become teachers.
CONTACT: Celeste Busser (202) 822-7823, email@example.com


text:
SpotlightCustomPoint Recruiting
Recruiting expertise and decades of experience hiring candidates in positions across the commercialization continuum.
Placing the right candidate is an art that goes far beyond matching candidates' qualifications with opportunities. Learn how our "Always On" recruiting can immediately to find the candidate who is the perfect fit.Learn More

subset: commoncrawl


text:
I had a couple of questions. I'll explain what I have in mind first and then
ask the questions.
I'm working on a search engine for my group which searches in a particualar
directory set which has Word Documents and HTML Files. I made Visual Basic
app that converted all the Word Documents into TEXT and HTML files and looks
for new files at a certain period. I made another VB app that indexes all
the TEXT files. By that I mean, it goes thru the text file and counts the
occurrence of every word ignoring certain words and characters. My original
plan was to put every word in a text file with the name of the file being
the first letter of the word. For example, words like, hello, hi, harry
would go in the file named h.txt. To develop the actual backend to the search
engine, I thought about doing the following. Whenever someone enters a query,
I would simply go to the file and find out where and how many times the word
occurs and arrange the files in the order where the word(s) occur most.
I also wanted to the search using the LIKE operator always. Meaning, if
they entered hello, I want to give results on ****, helloword, sayhello,
One problem I didn't think about before was being able to get the word "sayhello"
since it would be in a different file. So the solution I came up with is
to just have one text file and put all the words in there.
Here are my questions:
- The backend of the search which actually looks through the files and finds
out the search result - should it be done in JSP, Servlets, EJBs or any other
technology? Which one is easier to implement my logic in?
- Instead of having more than 26 files( 1 for each alphabet) or more, if
I make one file, would it somehow affect the run time in how long it gives
back the results?
- Is it better to just do one file to implement the LIKE operator instead
of going thru all 26 files to find words like the user entered?
Please clarify anything if need be to answer my questions.


text:
90% Plus
Email Deliverability
90% Plus
Contact Accuracy
Do you want to market your products and services and connect with people and companies who may be interested in your offerings? Now you can, with this Audit Directors, Managers, Auditors email list. With our Audit Directors, Managers, Auditors email list, finding the right prospects is a surefire way to make great returns on your marketing investment. It's an email list that you can easily integrate into your CRM, ESP, and start using right away!
This is the perfect opportunity for you to choose the right group of companies that are most suitable for your product or service and will work best for your business. We have everything from new business email lists to small business email lists and many more. Audit Directors, Managers, Auditors oversee important aspects of financial operations within their business, ensuring that the books are balanced and everything is accounted for.
So, don't waste your marketing budget on inaccurate data. Improve your ROI with prospecting to the right companies.
Our data is verified through email verification tools like Neverbounce, Zerobounce to filter valid, catch-all and invalid emails. Thereafter, we execute email campaigns on valid and catch-all emails to detect deliverable and hard bounced emails. We filter out hard bounced emails and only add deliverable emails to our file. The complete compliance process ensures our data file has over 90% deliverability.
Contact Accuracy becomes a concern when emails are deliverable and the contact has moved our of the company. To eradicate such contacts, we verify each contact through their Linked In profiles and filter out contacts who have moved out of the company. This validation process ensures 90% plus contact accuracy.
The Phone numbers are manually verified to ensure they are correct direct lines and corporate phone numbers. This process ensures all phone numbers are accurate to execute Telemarketing campaigns.
Once you place an order with us, our compliance process gets initiated to ensure the highest deliverability and accuracy on the data file. You can expect the data delivery within 3-4 business days.
Our data is verified in real-time before data delivery. Our compliance process is rigorous with AI and human intervention to ensure standard SLA of 90% plus email deliverability and contact accuracy.
We take 2-4 business days to deliver the list after we complete the data compliance process and on receipt of complete payment.
We guarantee 90% plus email deliverability and contact accuracy with an assurance of 1 to 1 replacement of bad/invalid contacts.
We will deliver the data file in XLS or CSV format.


text:
Preciosa Flatback Shapes
Take a look at our fabulous range of flatback shapes, which are perfect for creating patterns, designs and areas of interest. The Preciosa crystal glimmers in a number of shapes including regular square, pear and triangle, to the more extravagant chessboard and navette varieties.
Each beautiful shape can be used to embellish stationery and greeting cards, stage costumes or accessories. You can use a unique combination of shapes to create your very own special design. There are endless possibilities with this range of shapes! Many of the designs are also available in a selection of colours.
Do you require help deciding which shapes to buy, or need some inspiration? We're here to help and to give our top tips – for example why not begin by buying the round rivoli and navette shapes to create a flower?


text:
Kilt Flashes are strips fabric which hang from the outside of your socks/hose in colours to match those in your kilt. They are attached to elastic garters which fasten with a hook and latch under the cuff of of your socks/hose.
These kilt flashes are doubled, they have 2 pieces of fabric per flash. They are available in various solid plain colours designed to match your kilt colours. Made from wool braid.


text:
India's exports fell 1.8 pct in the 2012/13 fiscal year, the trade ministry said on Thursday, but they were up for the third straight month in March, offering some relief to the record current account deficit.
The current account deficit has emerged as a big weak spot in Asia's third largest economy since last year. It is expected to have hit about 5 per cent of GDP in the fiscal year that ended in March, but a fall in gold and oil prices along with the uptick in exports since January should take some of the pressure off.
Exports rose 6.97 per cent year-on-year in March to $30.84 billion, while imports fell 2.87 per cent to $41.16 billion, driven by lower spending on oil purchases that month, the ministry said. That reduced the trade deficit in the month to $10.32 billion.
The government of Prime Minister Manmohan Singh has been worried about the impact of falling exports on the overall economy, which likely registered its weakest growth in a decade in the last fiscal year. The trade gap has put pressure on the rupee, feeding inflation.
Exports for the full year were $300 billion, well below a $350 billion target but higher than expected. The rupee extended gains to trade at 54.12/13 as of 11.30 a.m. after the trade figures were released.
Trade Minister Anand Sharma, who gave the full year figures at a meeting of exporters, also announced incentives for external trade.
"We are conscious of the need to enhance exports so that we can address the real challenge of bringing down the trade account deficit, which directly impacts the current account deficit," Sharma said.
The measures included a 2 per cent interest rate subsidy for the beleaguered textile industry, which was once a mainstay of the Indian economy but now struggles to compete with China and Bangladesh for the European and U.S. markets.
"It is a step that's come too late but is nevertheless welcome," said R.K. Dalmia, senior president of Century Textiles. "It will make sure this sector and the country's exports revive again...It's a big boost."
India imports almost all its energy needs, and spent $169 billion on foreign oil in the full fiscal year, 9 per cent more than the year before, a big factor driving the current account deficit.
The annual export contraction revealed on Thursday was the first since 2009/10 and reflected falling orders from the U.S and Europe. Exports have grown in all but four years since 1970/71, Reserve Bank of India data shows.
Sharma said the government had relaxed the rules for special economic zones that have been major drivers for Indian exports in recent years. He also said he was confident a long delayed trade and investment agreement between India and Europe that is expected to significantly increase Indian exports would reach "closure" within the next couple of months.
Finance Minister P. Chidambaram said on Wednesday the current account deficit could be halved in one to two years.
"If exports rise sharply, if the oil prices soften more quickly, the current account deficit could be contained at 2.5 per cent even by next year," he told reporters in New York during a visit to woo back investment in the country's ailing economy.


text:
IMHO the intelligent people who seem to have a blind spot of also being "devout" catholics should get their mirrors adjusted and checked.
It's funny, in the UK, and in Scotland in particular, Catholics are always "devout" and Protestants are always "staunch". You absolutely never hear of staunch Catholics or devout Protestants.
Hmm, I would have used the terms interchangeably myself. I guess I don't get out enough.
Huh...yes Strega, that is odd. And you never hear of atheists speaking in tongues.
That's a bit unjust, I know plenty of intelligent people who for some reason are willing to compartmentalize and do the Catholic thing anyway. We have one on this board; he may be an evading weasel but he's not stupid. Which just makes it worse; he ought to know better.
"The rain it raineth on the just
And also on the unjust fella;
But chiefly on the just, because
The unjust stole the just's umbrella."
[attributed to several people, but it seems to Judge Charles Bowen the most frequently]
I found the picture on the net, and was astounded to discover that a 'for Dummies' book existed for this. It is particularly ironic, in that it would appear to contradict the general Catholic assertion that its religion is too complicated to be easily understood or explained. I didn't add the caption, it was already there. (Although my net-searching skills are finely honed, my 'tinkering with pictures' ability is non-existent)
I posted this to my photo album, because I found it so ironic. I hadn't anticipated it would be commented on, and that people might interpret it in any other way than the ironic way I saw it. However, I don't feel I need to apologise for what other people might see in it :)
I don't feel I need to apologise for what other people might see in it
You should not ever feel the need to apologize for pointing out the truth (comma dammit).
"You should not ever feel the need to apologize for pointing out the truth"
I'd like to use that to write to obnoxious congressmen and other reps in defense to whistle blowers, if that's okay.


text:
"Hi Marlene, With the Superbowl coming up I was thinking of a different dip that I could serve, that would be tasty and also healthier……I came up with a Baba Ghanooj Trio….traditional baba ghanooj, roasted red pepper baba ghanooj and kalamata olive baba ghanooj served with Za'atar pita toasts….the colors look so pretty when served together!"
Thank you Joy Betesh for this great recipe!
Serves 6-8
Baba Ghanooj Trio:
- 3 medium eggplants
- 3 tablespoons tahini paste
- 3 cloves garlic crushed
- 3 teaspoons cumin
- 3 teaspoons salt
- 1/2 cup fresh lemon juice
- 1/4 cup parsley chopped
- 1 red pepper roasted, peeled and pureed
- 1/2 cup kalamata olives pureed with 2 tablespoons of olive juice
Directions for this Kosher Recipe
- Double wrap the eggplants in aluminum foil and roast on the stove top directly over low-med. flame till skin is blistered and eggplant is soft.
- Slice eggplants in half lengthwise and scoop out insides….. discarding the skin.
- Place the eggplants in a bowl and mash with a fork. Add the tahini, garlic, cumin, salt, lemon juice, parsley to eggplants and mix all the ingredients together.
- Transfer mixture to a food processor or blender and process for 1-2 minutes. Eggplant mixture should be creamy.
- Divide the eggplant mixture into 3 portions….leaving one portion as is and then mix the roasted pepper puree into another portion and the olive puree into the last portion. Taste and adjust seasonings.
- Spoon the Baba Ghanooj onto a plate in a circle, starting with the plain, then adding the red pepper Baba Ghanooj and ending with the olive Baba Ghanooj in the center. Garnish with parsley and Za'atar pita toasts.
Za'atar Pita Toasts:
- 3 Pita Breads
- 2 tablespoons Za'atar Spice
- 2 tablespoons Olive Oil
Open the pita breads and cut each round into 8 triangles. Place on a baking tray and sprinkle with the za'atar spice and drizzle with the olive oil. Bake in a 300* oven for 10 minutes or till golden browned.
Joy Betesh
Cartridge World
665 Highway 35, Middletown, NJ, 07748
1815 Highway 35, Oakhurst, NJ, 07755
Call Toll Free for a Quote: 1-888-3-GOT-INK
Related articles
- Joy's Amazing No Knead Olive Bread (thejewishhostess.com)
- Whipped Feta Dip for Hanuka (thejewishhostess.com)


text:
Tee-off in this fantastic free golf game for real courses, real-time multiplayer duels, tournaments and our unique Golf Royale mode!
Just as slime bravely escaped the first laboratory he falls right back into another one made by the same dastardly company that imprisoned him the first time around. He has totally run out of luck.
Only you can help him escape the monstrous experiments that await him in Slime laboratory 2. Be prepared to face the most exciting and challenging levels ever to be seen in by a tiny green ball of slime in a platform adventure game.
Use all of your physics knowledge and game playing skills to avoid being stabbed with spikes, burnt with acid, zapped with lasers, and even torn in half! That's no way to look after a ball of slime so be careful and you may just get to the end and set Slime free once more.
By clicking "Add Slime Laboratory 2 to Your Website", you agree to the Webmaster Terms and Conditions.Add Slime Laboratory 2 to Your Website Help
There are 3 awards in Slime Laboratory 2. View All Awards


text:
Last month Steve Sailer wrote:
Higher IQ people probably tend to be more trusting — high IQ environments tend to be more honest and cooperative.
Stepping away from the presidential election for a moment, allow me to do what the tagline advertises and validate Steve's stereotype.
The GSS routinely asks respondents whether they feel as though most people are trustworthy or not. The following table shows the percentages of people, grouped by intelligence*, who say that "generally speaking, most people can be trusted". For contemporary relevance, to avoid linguistic problems, and to avoid racial confounding, responses are from 2000 onward and restricted to non-Hispanic whites who were born in the US (n = 2,458):
|Really Smarts
|Pretty Smarts
|Pretty Dumbs
|Real Dumbs
People of modest intelligence are correspondingly more likely to assume that someone or something is intentionally taking advantage of them when the evidence is unclear or ambiguous.
Stepping back to the election, this presumably goes some way in explaining Trump's working-class appeal and the allergic reaction many upper-middle class cuckservatives have to him. Foolishly trusting people and institutions unworthy of trust is one of cuckservatism's defining characteristics.
It's also why the FBI investigation redux, in concert with Project Veritas' videos and the steady stream of WikiLeaks' revelations is potentially lethal to the harridan from hell. It's pushing the most inherently trusting, Midwestern-nice Flanderesses to the breaking point. Each of these Clinton scandals that keep piling one on top of another are, individually, much worse than the Watergate scandal that brought down the Nixon administration was. It's getting more and more difficult, even in the lard-filled crevices of Erick Erickson's corpulent mind, to imagine how Trump could be worse than Hillary.
As the West becomes less European, it becomes less trusting. The instinctively high levels of trust intelligent people have is a feature in a society where people and institutions tend to be trustworthy. Such societies are becoming increasingly rare, however, and it will in large part be up to the Joe-bag-of-donuts to save clever sillies from themselves before current demographic trends become irreversible and the Occident gets swallowed up by the tides of darkness forever.
GSS variables used: TRUST(1-2), YEAR(2000-2014), RACECEN1(1), BORN(1), WORDSUM(0-3)(4-5)(6)(7-8)(9-10)
* Respondents are broken up into five categories that roughly forms a normal distribution; Really Smarts (wordsum score of 9-10, comprising 13% of the population), Pretty Smarts (7-8, 26%), Normals (6, 22%), Pretty Dumbs (4-5, 27%), and Real Dumbs (0-3, 12%).


text:
When we had our old Acura Legend, we were addicted to its fuel-economy display. We generally averaged around 21 mpg, which included a 33-mile Walnut Creek-to-San Francisco commute that was 2/3 open freeway and 1/3 brutal congestion (hello, MacArthur Maze and Bay Bridge). On a trip from Portland back down the East Bay, we were running low on gasoline coming down out of the Cascades. The meter showed that we were gaining miles to empty, prompting our friend Brett to exclaim, "This is the best car ever! It actually makes gas!" Wayne Gedes also got hooked on eking fuel economy out of an Acura — in this case, his wife's MDX.
And post-9/11, he made a commitment to use as little fuel as possible, exploring techniques and acronyms that have earned him the title "King of the Hypermilers." We've been known to compare our hairball run from Ozona, TX to Sacramento, CA in an overloaded Durango with a misfire towing an improperly-loaded trailer as some sort of low-speed 24 Heueres du Mans. At one point, we planned to fill up in a town where all of the gas stations were closed. And then we had to climb a mountain. Our tags were out of date, so if a cop pulled over to assist, we were toast. The trailer was our only shield. We had to make it to the top of the mountain, where sweet, nourishing petroleum and caffeine awaited us. And we did, just barely. But it was literally 20 minutes of the most nail-biting, sign-of-the-cross-making, RPM-counting, Blarney-stone tonguing, rabbit-rabbit-on-the-first driving we've ever done. And we've engaged in some rather hairball extralegal stuff over the years.
Hypermiling is all about strategery. And according to this bit in Mother Jones, nobody's better at it than Wayne. We doff our cap to his brilliant 180mpg performance. [Thanks to the Mighty Thnderblt for the tip.]
This Guy Can Get 59 MPG in a Plain Old Accord. Beat That, Punk [Mother Jones]
Honda Accord Hybrid Gets Price Increase, Mileage Decrease [Internal]


text:
A woman relaxing on the sofa 11 is a photo of acworks author. This photo includes Japanese, Female, Female, 30 generations, Arthur tags. To download photo (S, L, M sizes) you need to register the account and log in.
As the free account, you can download for free with some limits.
As the premium account, you can download unlimited, no waiting time, etc. Enjoin premium membership at here


text:
Decision : CONF 001 XVI.73
Other Business: Concerns About the Situation of Architectural Heritage, Both Urban and Rural, in Romania
73. The Secretary-General of ICOMOS read out a telex message from Professor Roberto di Stefano, President of ICOMOS, expressing the grave concern of his Organization about "the situation of architectural heritage, both urban and rural, in Romania". After describing the measures taken by ICOMOS, the message stated that this organization was ready to help the Committee in any way possible. The Committee noted that Romania was not a State Party to the Convention and that when the matter had been raised in the recent 130th session of Unesco's Executive Board, the Director-General had informed that body of the measures he was taking to obtain clarifications form the Romanian authorities on the effects on the architectural heritage of its "rural systematisation" policies. The Committee endorsed the concern expressed by ICOMOS and expressed the wish that this concern be communicated to the Romanian authorities. An observer from a States Party suggested that in the "global study" it would be carrying out ICOMOS could give priority attention to Romanian properties of World Heritage significance.


text:
Have an account?
Need an account?Create an account
Table Of Contents
Internet Edge Solution Overview
Service Availability and Resiliency
Integrated Services Model and Appliance Model
Device Resiliency and Survivability
Internet Edge Solution Overview
December 2, 2010
System Overview
This document describes a set of best practices to successfully designing, implementing, and maintaining an Internet edge. While this document is written with medium and large size enterprises in mind, most of the principles presented here are universal and therefore applicable to other environments as well.
The Internet edge is the network infrastructure that provides connectivity to the Internet, and that acts as the gateway for the enterprise to the rest of the cyber space. The Internet edge serves the other many building blocks (referred by Cisco as places in the network (PINs)) present in a typical enterprise network. This modular building block approach enables flexibility and customization in network design to meet the needs of different size customers and their business models.
As Figure 1 shows, users at the campus access the Internet through the Internet edge; the enterprise website and other public resources are accessible to clients and partners through the Internet edge, mobile and home-based employees may access corporate resources and applications through the Internet edge; and the Internet edge can also provide backup access to remote and branch offices in case the primary WAN links fail.
Figure 1 Internet Edge Topology
As the gateway to the Internet, the Internet edge infrastructure plays a critical role in supporting the services and activities that are fundamental to the operation of the modern enterprise. For this reason, the Internet edge has to be designed to provide service availability and resiliency, to be compliant with regulations and standards, to provide flexibility in accommodating new services and adapt with the time, to be secure, and to facilitate administration (reducing OPEX).
Service Availability and Resiliency
The disruption of e-commerce portals, corporate websites, and communication channels with partners, are all examples of events that could severely inhibit the productivity and even halt the business operation of a corporation. The Internet edge design here proposed incorporates several layers of redundancy to eliminate single points of failure and to maximize the availability of the network infrastructure. The design also uses a wide set of features destined to make the network more resilient to attacks and network failures.
Regulatory Compliance
Standards such as the Payment Card Industry Data Security Standard (PCI DSS) for the payment card industry and regulations like Health Insurance Portability and Accountability Act (HIPAA) for the health industry impose a series of requirements to be followed by organizations, and for which noncompliance may lead to the revocation of licenses, stiff penalties, and even legal actions. The Internet edge design includes a security baseline built-in as intrinsic part of the network infrastructure. The security baseline incorporates a rich set of security practices and functions commonly required by regulations and standards, and provides a solid platform to achieve regulatory compliance.
Modularity and Flexibility
The Internet edge follows a modular design where all components are described by functional roles rather than point platforms. This results in added flexibility when it comes to selecting the best platform for a given functional role, enabling the network to fit your business model and grow with your business. At the same time, this modular design facilitates the implementation of future services and roles, extending the useful life of existing equipment and protecting previous capital investment (CAPEX).
The rise in organized crime use of the Internet, cyber espionage, growing data theft, the increasing sophistication of network attacks, are all examples of the real threats faced by organizations these days. As a key enabler of the business activity, networks need to be designed with security in mind, and to ensure the confidentiality, integrity and availability of applications, endpoints and the network itself. The Internet edge design incorporates security as an intrinsic component of the network architecture, where a rich set of security technologies and capabilities are deployed in a layered approach, but under a common strategy. The selection of technologies and capabilities is driven by the application of the Cisco Security Framework (CSF), a methodology that aims at achieving complete visibility and total control.
Operational Expenditures
As operational expenditures continue to rise, and as the cost of hiring and training personnel increases, designing networks that facilitate operations becomes a fundamental requirement for cost reduction. The Internet edge is designed to accommodate operations, right from deployment and throughout the operational life cycle. In addition to guiding the design and initial deployment, this guide presents an implementation roadmap, allowing users to start with a subset of the design, and systematically implement the remaining technologies and capabilities as they see fit. With a focus on operations, tools and procedures are provided to verify the effectiveness and the proper operation of each network element in the design.
Customer Use Cases
Medium and large size enterprises with more than 500 users onsite typically require Internet access to serve externally-facing data centers, campus users, mobile users, and to provide backup for remote offices.
Public Services DMZ
Traditionally, public-facing services were typically placed on a demilitarized zone (DMZ) for security and control purposes. The DMZ acts as a middle stage between the Internet and organization's private resources, preventing external users from direct access to internal servers and data. In today's network, most public services such as email and web serverfarms are located inside in the data center. DMZs in today's network normally provide network services such as DNS, FTP, NTP, etc. Other services implemented at a DMZ often include the email and web security appliances. See Figure 2.
Figure 2 DMZ Topology
The following are some of the key attributes to be expected in the DMZ design:
•Service availability and resiliency
•Regulatory compliance
•Security: prevent intrusions, data leakage and fraud, and ensure user confidentiality and data integrity
Corporate Internet Access
Users at the campuses access email, instant messaging, web browsing, and other common services through the existing Internet edge infrastructure at the headquarters or regional offices. Depending on the organization's policies, users at the branches may also be forced to access the Internet over a centralized Internet connection, typically at the headquarters. These cases are represented in Figure 3.
Figure 3 Internet Access
The following are some of the key attributes to be expected in the Internet access design:
•Service availability and resiliency
•Regulatory compliance
•Security: prevent network abuse, intrusions, data leakage and fraud, and ensure user confidentiality and data integrity
The Internet edge infrastructure may also provide mobile users and teleworkers with access to private applications and data residing in the organization's network.
This sort of remote access is authenticated and secured with SSL or IPSec VPNs. Access control policies may also be enforced to limit access to only the necessary resources and according to the user's role. Typical services provided to mobile users and teleworkers include email, access to intranet websites, business applications, video on demand, IP telephony, instant messaging, etc. See Figure 4.
Figure 4 Teleworker Topology
The following are some of the key attributes to be expected in the teleworker design:
•Service availability and resiliency
•Regulatory compliance
•Security: prevent network abuse, intrusions, data leakage and fraud, and ensure user confidentiality, data integrity, user segmentation.
The design proposed in this document presents a firewall based teleworker solution. Separate firewalls will be used to segment teleworker traffic from other traffic flows.
Branch Internet Connectivity
Under normal conditions, if the branch has not implemented split-tunneling, all Internet-bound traffic from the branch will have to go through the headend. The Internet-bound traffic will pass through the WAN-edge and out through the Internet edge. It is therefore imperative that all Internet traffic from the branches is treated in a similar fashion to Internet traffic from corporate users. This implies that all monitoring, threat mitigation tools and enforcement policies has to apply to branch-originated Internet-bound traffic.
WAN Backup
To ensure business continuity and service availability, remote offices may implement an Internet connection to be used as a backup of the primary WAN links (see Figure 5). Since the Internet is a public medium, communications to headquarters or regional offices are to be secured with a Virtual Private Network (VPN) technology like IPSec. In this scenario, VPN backup connections are terminated and aggregated at the headquarters or at regional offices. For the same reason, branch routers and other Internet-facing equipment need to be properly hardened.
In case centralized controls and security measures are favored, the organization may enforce a policy to prevent branch users from accessing the Internet directly. In this case, Internet access may be provided centrally at the headquarters or regional offices.
Depending on the bandwidth available, branch users may be limited to a subset of applications during the failover of the primary WAN links.
Figure 5 Internet WAN Backup Topology
The following are some of the key attributes to be expected in the Internet WAN backup design:
•Service availability and resiliency
•Regulatory compliance
•Security: prevent network abuse, intrusions, data leakage and fraud, and ensure user confidentiality and data integrity.
Systems Architecture
Integrated Services Model and Appliance Model
The Internet edge architecture can be implemented using either the integrated model or the appliance model. In the integrated model, various capabilities and functional blocks are integrated within the same appliance.
There are several benefits of integrating security functions on a router or a switch.
1. First, everyone uses routers for routing purposes. Adding security to them reduces the number of boxes one must support and maintain in the network. This significantly reduces the real estate required for equipment and often reduces CAPEX.
2. Second, because the router already takes an active role in the overall network (routing and switching traffic), adding security functions can usually be done without impacting the network design.
3. Third, smaller sites which may not have any administrators exclusively to manage the security can now use network operators to maintain security as well. An integrated router platform series can provide that viable alternative where a router can be used for core IP routing services such as IGP/BGP, QoS, v4/v6 Multicast, NAT, NetFlow, GRE, RTP compression ISSU, and many others. At the same time, it can perform advanced technology function such as firewall, encryption, participating in WAN optimization functions by way of PfR or WCCPv2 along with Cisco WAAS solution. All this can be done at multiple speeds with 5, 10, or 20 Gbps within a single platform.
The benefits of an integrated model are as follows:
•Simplified operations and reduced cost
•Consolidation and service aggregation
•Faster and reliable service deployments
•Reduced carbon footprint-efficient power consumption
On the other hand, many large enterprises prefer to keep routing and advanced services in separate platforms for multiple reasons including but not limited to high availability, use of best-of-breed products, enforcing the boundary of responsibilities between Net-operations (NetOP) and Sec-operations (SecOP), and perhaps sometimes just the preference of the user interface that the existing staff is comfortable with.
The benefits of an appliance model are as follows:
•Organizational NetOP and SecOP boundaries
•Separate feature domains that isolates failures
•Separate feature domains easing management and troubleshooting
•Increased availability
•Better scaling for high-end large implementations
Note The first phase of the design of this Internet solution architecture emphasizes on the appliance model. The second phase of this project will use the integrated model as the main approach in designing the solution.
Common Infrastructure
The use cases described earlier in this document may be implemented under a common shared infrastructure or on independent Internet edges. The later implies building duplicated infrastructures, which results in higher capital expenditures and operational expenses. For this reason, most organizations implement a common Internet edge infrastructure to satisfy the different use cases.
Figure 6 depicts the common elements present in a shared infrastructure.
Figure 6 Common Infrastructure
Common elements in a shared infrastructure include the following:
•Edge routers
The primary function of the edge routers is to route traffic between the organization's network and the Internet. They provide connectivity to the Internet through one or more Internet service providers (ISPs). Edge routers may also provide QoS and rate-limiting. In terms of security, the edge routers act as the first line of defense against external attacks. Access control lists (ACLs), uRPF, and other filtering mechanisms are implemented for antispoofing and to block invalid packets. NetFlow, syslog, SNMP are used to gain visibility on traffic flows, network activity and system status. In addition, edge routers are secured following the practices discussed in the "Baseline Security" section. This includes restricting and controlling administrative access, protecting the management and control planes, and securing the dynamic exchange of routing information.
•Outer switches
The outer switches provide data link layer (Layer 2) connectivity between the edge routers and the firewalls. The outer switches are secured following the principles explained in the "Baseline Security" section. This includes restricting and controlling administrative access, protecting the management and control planes, and securing the switching infrastructure.
The Internet edge design implements firewalls and uses their stateful access control and deep packet inspection to accomplish the following:
–Protect the organization's internal resources and data from external threats by preventing incoming access from the Internet
–Protect public resources served by the DMZ by restricting incoming access to the public services, and by limiting outbound access from DMZ resources out to the Internet
–Control user's Internet-bound traffic
In addition, firewalls may provide address translation (NAT/PAT) and may be used to terminate VPN tunnels. This design will use separate firewalls for teleworker access and corporate connectivity.
Administrative access to the firewalls is also secured following the same principles described in the "Baseline Security" section.
•Inner switches
The inner switches provide network layer (Layer 3) and data link layer (Layer 2) connectivity between the Internet edge and the rest of the enterprise network, typically through the core. The inner switches are configured with a routing process that routes information between the VLANs that connect to the core switches and the firewall inside VLAN.
The function of the inner and outer switches can be collapsed in a single pair of switches. In that case, the inside and outside segments of the firewall need to be properly segmented with VLANs.
The inner switches are secured following the principles explained in the "Baseline Security" section. This includes restricting and controlling administrative access, protecting the management and control planes, and securing the switching infrastructure.
Routing and Switching
As illustrated in Figure 7, the outer switches implement a single Layer 2 segment or VLAN that provides connectivity between the firewalls and the edge routers. This VLAN is the firewall's outside segment. As firewall failover requires all firewall interfaces to be Layer 2 adjacent, the outside VLAN needs to be carried by both outer switches.
Each interface of the edge routers is to be configured as Layer 3 segments. In case a redundant ISP connection is implemented, each Layer 3 interface of the router is likely to be configured with different IP subnets.
The firewalls are configured in hot-standby mode, therefore logically the active and standby units share the same IP addresses. Nevertheless, all firewall interfaces need to be Layer 2 adjacent, which means the VLANs and Layer 2 segments on the firewall need to be trunked across the primary and secondary switches.
Figure 7 Layer 3 and Layer 2 Design
The inner switches are configured with multiple VLANs supporting the DMZ services. All DMZ VLANs converged on the firewalls and do not participate on the switch's routing process. In addition, these switches provide Layer 3 connectivity to the core of the enterprise network through a set of VLANs connecting to the core switches. All VLANs are trunked between the primary and secondary switches.
Note that the functions provided by the inner and outer switches can be collapsed on a single pair of redundant switches. In this case, proper segregation between the inside and outside firewall segments needs to be ensured.
Dynamic routing is implemented by using a combination of BGP and an IGP protocol such as OSPF or EIGRP. The edge routers run external BGP sessions to the ISP routers. These are shown in Figure 8. Assuming the organization owns a CIDR block, the same address space may be announced by the ISP (or ISPs in case of having two providers).
Figure 8 Routing Processes
The firewalls may be configured with static routing or an IGP to inject a default route to the interior of the network. In case of an IGP is used, it is important not to use the same routing process as inside the firewall. As a best practice, different routing processes should be implemented for subnets inside and outside the firewall to allow for better control and reduce the possible effects of an attack on the routing infrastructure.
Internally, an IGP may be used for dynamic routing. This routing process can be configured on the inside interfaces and DMZ interfaces of the firewall. This allows for the dynamic propagation of route information. As described in the "Baseline Security" section, dynamic routing is secured by the enforcement of neighbor authentication, route filtering and device hardening.
High Availability
The Internet edge is built out of many platforms and components that may fail or that may be subject to attack. Designing a redundant architecture helps eliminate single points of failure, therefore improving the availability and resiliency of the network.
The Internet edge is designed with several layers of redundancy including redundant interfaces, standby devices, and topological redundancy.
Redundant Interfaces
The design includes the adoption of redundant interfaces at various points of the architecture to provide alternative paths. Dynamic routing protocols are used for path selection. The design allows for the use of multiple ISP connections, each served by different interfaces.
Standby Devices
The Internet edge design implement redundant firewalls and routers by using the existing firewall failover mechanisms and router redundancy protocols.
The design implements firewall redundancy with a pair of units deployed in stateful active/standby failover mode. In this configuration, at any given time one of the firewalls is active while the other one remains idle in standby mode. Under normal operation, only the active firewall processes network traffic. Firewall configuration is maintained synchronized between the active and standby units. In addition, and thanks to the stateful nature, the active unit shares the connection state and flow information with the stand by unit. When a failure occurs, the standby firewall becomes active and starts processing network traffic.
Firewall redundancy may also be implemented in active/active failover mode, in which case all units process network traffic. This failover mode requires the separation of traffic flows across the active firewalls. This is achieved by defining multiple firewall contexts, which is out of the scope of this document.
The Internet edge design also makes use of a First Hop Redundancy Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP) or Gateway Load Balancing Protocol (GLBP) to allow for redundant routers. These protocols provide transparent failover of the first-hop IP router in segments not configured with a dynamic routing protocol (i.e., firewall outside segment). In this configuration, two routers are set up together in a group, sharing a single IP address that other systems in the segment use as the next hop. One of the two routers is elected as the active router, and it is responsible for handling all traffic sent to the IP address. In the event the active router fails, the standby router takes over.
Topological Redundancy
The Internet edge implements redundant links and devices to extend availability and to make the network more resilient to attacks and errors. Topological redundancy is implemented at both the network as well as the date link level. At the network level, it is implemented by using redundant routers and network links and by using a dynamic routing protocol. At the data link level, redundant switches multiple paths are implemented in conjunction with a spanning tree protocol.
Figure 9 illustrates the high availability design.
Figure 9 Redundancy
Management Network
The Internet edge design includes a management network dedicated to carrying control and management plane traffic such as NTP, SSH, SNMP, syslog, etc. The management network combines out-of-band management and in-band management as illustrated in Figure 10.
Figure 10 Management Network
At the headquarters, where the Internet edge resides, an out-of-band (OOB) management network is implemented by using dedicated switches that are independent and physically disparate from the data network. Routers, switches, and other network devices connect to the OOB network through dedicated management interfaces. The OOB network hosts console servers, network management stations, AAA servers, analysis and correlation tools, NTP, FTP, syslog servers, and any other management and control services. This OOB management network may serve the other places in the network at the headquarters.
Any device outside the edge firewalls are managed in-band, using the same physical and logical infrastructure as the data traffic. Despite being deployed at the headquarters, the outer switches and edge routers are located outside the edge firewall, therefore they are managed in-band. The edge firewalls are responsible of securing the OOB network by permitting control and management connections only from the expected devices. Connecting the outer switches or the edge routers directly to the OOB network is highly discouraged, as it would facilitate the bypass of the firewall protection. Devices residing at the branches are also to be managed in-band, but over a secure VPN connection.
Baseline Security
Effective network security demands the implementation of various security measures in a layered approach and guided under a common strategy. The Internet edge is designed with security in mind, where multiple security technologies and capabilities are strategically deployed throughout the network to complement each other and to collaborate. Under a common strategy, security measures are positioned to provide maximum visibility and control.
This section describes the best practices for securing the infrastructure itself, the control and management planes, setting a strong foundation on which more advanced methods, and techniques can subsequently be built on. Later in this document, each use case will be presented with the additional security design elements required to enhance visibility and control and to secure the data plane.
The following are the key areas of baseline security:
• Infrastructure device access
• Routing infrastructure
• Device resiliency and survivability
• Network telemetry
• Network policy enforcement
• Switching infrastructure
In order to ensure a comprehensive solution, the selection of technologies and capabilities follows the Cisco Security Framework (CSF). CSF provides a method of assessing and validating the security requirements of a system, guiding the selection of security measures to be considered for each particular contextual area.
Infrastructure Device Access
Securing the network infrastructure requires securing the management access to these infrastructure devices. If infrastructure device access is compromised, the security and management of the entire network can be compromised. Consequently, it is critical to establish the appropriate controls in order to prevent unauthorized access to infrastructure devices.
Network infrastructure devices often provide a range of different access mechanisms, including console and asynchronous connections, as well as remote access based on protocols such as Telnet, rlogin, HTTP, and SSH. Some mechanisms are typically enabled by default with minimal security associated with them; for example, Cisco IOS software-based platforms are shipped with console and modem access enabled by default. For this reason, each infrastructure device should be carefully reviewed and configured to ensure only supported access mechanisms are enabled and that they are properly secured.
The key steps to securing both interactive and management access to an infrastructure device are as follows:
•Restrict device accessibility—Limit the accessible ports, restrict the permitted communicators, and the permitted methods of access.
•Present legal notification—Display legal notice developed in conjunction with company legal counsel for interactive sessions.
•Authenticate access—Ensure access is only granted to authenticated users, groups, and services.
•Authorize actions—Restrict the actions and views permitted by any particular user, group, or service.
•Ensure the confidentiality of data—Protect locally stored sensitive data from viewing and copying. Consider the vulnerability of data in transit over a communication channel to sniffing, session hijacking, and man-in-the-middle (MITM) attacks.
•Log and account for all access—Record who accessed the device, what occurred, and when for auditing purposes.
Table 1 CSF Assessment —Infrastructure Device Access
Total Visibility Identify Monitor Correlate
•AAA enforcement
–Centralized AAA and local fallback
–Administrator access
–Privileged level access
•SNMP accounts (community strings or auth/privacy policy)
•Device management best common practices
–Strong password policy
–Per-user accounts
•Remove default accounts and passwords
–AAA server-based accounting
•Configuration change notification and logging
Total Control Harden Isolate Enforce
•Restrict device accessibility
–Transport types
–VTY ACLs
–SNMP ACLs
–IOS login enhancements
•Dedicated management interface
•Management network
•Out-of-band (OOB) management
•Banners (MOTD, EULA)
•Local password protection
–Password encryption
•File transfer and verification
–IOS image verification
•Session management
•Device management best common practices
•Minimum access privileges
Routing Infrastructure
Routing is one of the most important parts of the infrastructure that keeps a network running, and as such, it is absolutely critical to take the necessary measures to secure it. There are different ways routing can be compromised, from the injection of illegitimate updates to DoS specially designed to disrupt routing. Attacks may target the router devices, the peering sessions, and/or the routing information.
The Internet edge design uses the following measures to effectively secure the routing plane:
•Restrict routing protocol membership—Limit routing sessions to trusted peers, validate origin, and integrity of routing updates.
•Control route propagation—Enforce route filters to ensure only valid routing information is propagated. Control routing information exchange between routing peers and between redistributing processes.
•Log status changes—Log the status changes of adjacency or neighbor sessions.
Table 2 CSF Assessment —Routing Infrastructure
Total Visibility Identify Monitor Correlate
•Neighbor authentication
•Routing peer definition
•Route redistribution filtering
•Neighbor adjacency logging
•Logging (syslog, SNMP)
Total Control Harden Isolate Enforce
•BGP TTL security check
•Standby interfaces
•Standby devices
•Element redundancy
•Topological redundancy
•Prefix filtering
•Maximum prefix filtering
•Route redistribution filtering
•Stub routing
•Control plane policing
Device Resiliency and Survivability
Routers and switches may be subject to attacks designed to or that indirectly affect the network availability. Possible attacks include DoS based on unauthorized and authorized protocols, DDoS, flood attacks, reconnaissance, unauthorized access, and more.
The Internet edge design uses the following best practices to ensure the resiliency and survivability of routers and switches:
•Disable unnecessary services—Disable default enabled services that are not required.
•Restrict access to the Infrastructure address space—Deploy ACLs at the network edges to shield the infrastructure from unauthorized access, DoS, and other network attacks.
•Protect control plane—Filter and rate limit traffic destined to the control plane of routers and switches.
•Control switch Content Addressable Memory (CAM) usage—Restrict the MAC addresses that are allowed to send traffic on a particular port.
•Implement redundancy—Eliminate single points of failure using redundant interfaces, standby devices and topological redundancy.
Table 3 CSF Assessment—Device Resiliency and Survivability
Total Visibility Identify Monitor Correlate
•Port Security
•Logging (Syslog, SNMP)
Total Control Harden Isolate Enforce
•Control plane policing
•Standby interfaces
•Standby devices (stateful failover, HSRP/GLBP)
•Topological redundancy
•Disable unnecessary services
Network Telemetry
In order to operate and ensure availability of a network, it is critical to have visibility and awareness into what is occurring on the network at any one time. Network telemetry offers extensive and useful detection capabilities that can be coupled with dedicated analysis systems to collect, trend, and correlate observed activity.
This section highlights the baseline forms of telemetry recommended for network infrastructure devices:
•Time synchronization—Implement Network Time Protocol (NTP) to ensure dates and times in logs and alarms are synchronized.
•Maintain local device traffic statistics—Leverage device global and interface traffic statistics.
•Maintain system status information—Leverage memory, CPU and process status information.
•System logging—Log and collect system status, traffic statistics and device access information.
•Log and account for all access—Record who accessed the device, what occurred, and when for auditing purposes.
•Packet capture—Establish the mechanisms to allow the capture of packets in transit for analysis and correlation purposes.
•URL monitoring—Establish mechanisms to allow for statistical analysis of web usage and web policy enforcement.
Table 4 CSF Assessment—Network Telemetry
Total Visibility Identify Monitor Correlate
•Local device statistics
•System status information
–CPU and memory threshold notification
•CDP best common practices logging (syslog, SNMP, accounting, configuration change notification and logging)
•Packet capture (SPAN/RSPAN, copy/capture VACLs)
Network Policy Enforcement
Baseline network policy enforcement is primarily concerned with ensuring that traffic entering a network conforms to the network policy, including the IP address range and traffic types. Anomalous packets should be discarded as close to the edge of the network as possible, thereby minimizing the risk of exposure.
The Internet edge design implements the following measures:
•Access edge filtering—Control traffic destined to the infrastructure space.
•IP anti-spoofing—Implement packet filters and other dynamic mechanisms to block packets with spoofed IP addresses.
•Web URL monitoring and filtering—Web monitoring and filtering can be achieved by using web security appliances. One can monitor, authenticate and block users web access to previously defined websites
Table 5 CSF Assessment - Network Policy Enforcement
Total Visibility Identify Monitor Correlate
•Logging (syslog, SNMP)
Total Control Harden Isolate Enforce
Access control lists (ACLs)
•Access edge filtering
– iACLs
•IP spoofing protection
– uRPF
– IP source guard
– DHCP/ARP enforcement
•URL filtering
–Reputation analysis
–Web URL monitoring
Switching Infrastructure
Baseline switching security is concerned with ensuring the availability of the Layer 2 switching network. To that end the Internet edge design implements:
•Broadcast domain restriction—Design the Layer 2 infrastructure limiting the size of the broadcast domains.
•Spanning Tree Protocol (STP) Security—Leverage existing features to secure STP.
•VLAN best common practices
Table 6 CSF Assessment—Switching Infrastructure
Total Visibility Identify Monitor Correlate
•Logging (syslog, SNMP)
Total Control Harden Isolate Enforce
•Restrict broadcast domains
•Layer 3 hierarchical design
•STP security
– Disable dynamic trunking
– BPDU guard
– Root guard
•VLAN best common practices
–Disable unused ports and put them in an unused VLAN
–Use a dedicated VLAN ID for all trunk ports
–Avoid using default VLAN 1
–Disable auto-trunking on user facing ports
–Explicitly configure trunking on infrastructure ports
–Use all tagged mode for the native VLAN on trunks
Having explained the common elements building the Internet edge infrastructure, next we describe the functions and detailed designs to satisfy each one of the use cases.
Public Services (DMZ)
The DMZ is the piece of the Internet edge infrastructure that hosts public services. As illustrated in Figure 11, the DMZ design consists of several network devices and functions, which are explained next.
Figure 11 DMZ Design
In this design, the edge routers are responsible for providing a reliable communication path to and from the Internet. The edge routers also serve as the first line of protection against spoofing and other network attacks. The edge routers also act as a collection point for network flow and event information useful for analysis and correlation purposes. Redundancy is achieved by deploying two routers and by configuring a First Hop Redundancy Protocol (FHRP) is configured in their inner interfaces.
The outer switches provide Layer 2 connectivity between the Layer 2 firewalls and the edge routers. Two switches are deployed for redundancy. Since there are no Layer 2 loops in the design, STP is not required. The outer switches provide connectivity to the DDoS mitigation component.
Public services are hosted on a DMZ, and depending on the services offered the DMZ may be implemented as several isolated Layer 2 segments (i.e., one hosting the website and another one for the mail services). The DMZ Layer 2 segments are implemented at the inner switches, which are configured to ensure the isolation of the various Layer 2 segments. Two switches are deployed for redundancy. Servers at the DMZ are protected with endpoint security software that works in conjunction with the intrusion protection system (IDS) and the monitoring and analysis system. Services and applications hosted at the DMZ are protected by a line of stateful firewalls, an intrusion and anomaly detection system, and a DDoS mitigation system.
The edge firewalls secure the DMZ by controlling and inspecting all traffic entering and leaving the DMZ segments. This includes traffic between DMZ, as well as traffic between the DMZ and the Internet and the internal network. For redundancy, firewalls are deployed in stateful active/standby failover mode. Complementary, a secure messaging system is deployed at the DMZ to inspect incoming and outgoing emails and eliminate threats such as e-mail spam, viruses and worms.
The DMZ implements an IDS with the intention to identify and alert on well-known attacks and suspicious activity. Alert and alarm generated by the IDS and the endpoint security software is processed by a monitoring and analysis system for analysis and correlation purposes. Complementary to the IDS, an anomaly detection system is also deployed at the DMZ. This system is responsible of identifying DDoS and other network-based attacks, and it works in conjunction of the DDoS mitigation system deployed at the outer switches. Once an ongoing attack is confirmed on one of the public services (i.e., HTTP), the DDoS mitigation system triggers a traffic redirection to put itself on the traffic path for the affected service, and starts inspecting traffic ensuring only good traffic reaches the server.
Table 7 illustrates how all these components play together as part of the same security strategy.
Table 7 CSF Assessment—Public Services DMZ
Total Visibility Identify Monitor Correlate
•Firewall deep packet inspection
•Secure messaging
•Intrusion detection system (IDS)
•Anomaly detection system (ADS)
•Network management
•Network flow data collection
•Packet capture
•Endpoint monitoring
•Event monitoring
Event analysis and correlation
Total Control Harden Isolate Enforce
•Baseline security
•Stateful firewall
•Link and system redundancy
•Firewall access control policies
•Firewall access control
•Endpoint security
•Secure messaging
Corporate Internet Access
The Internet edge infrastructure provides users at the headquarter or regional offices access to the Internet. Optionally, the same infrastructure may serve users at the branches that are mandated to access the Internet over a centralized connection. The components and functions present in the architecture are depicted in Figure 12.
Figure 12 Internet Access Design
The edge routers are responsible for providing a reliable communication path to and from the Internet. To that end, redundancy is achieved by deploying two routers and by configuring an FHRP in their inner interfaces. The outer switches provide Layer 2 connectivity and are deployed in pair for redundancy.
The edge firewalls protect the interior of the network from the Internet, and are also responsible of enforcing the Internet access policy for internal users. To that end, firewalls enforce access policies, keep track of connection status, and inspect packet payloads. As part of this, the firewalls may be configured to enforce policies destined to limit or block instant messaging and peer-to-peer applications to mitigate network abuse. The edge firewalls also control traffic destined to the DMZ. In addition, the firewalls are in charge of performing port address translation (PAT) for the traffic bound to the Internet.
An intrusion detection and prevention system (IDS/IPS ) is deployed at the level of the inner switches to inspect inside traffic and to alert on known attacks or malicious activity. The IDS/IPS may be configured to alert on activities considered as network abuse or to block traffic that is deemed to be malicious. Alarm information generated by the IDS/IPS is forwarded to a monitoring and analysis system for analysis and correlation purposes.
A web security system is deployed at the level of the inner switches to inspect web traffic bound to the Internet. This web security appliance is in charge of blocking spyware, malware, and other known threats, to provide content filtering and optionally to authenticate user requests.
E-mail communications are inspected by the secure messaging system deployed at the DMZ hosting the mail server. This email security appliance is responsible for analyzing email payloads and eliminating threats such as e-mail spam, viruses, and worms.
The web security firewall (WAF) is responsible for blocking Internet-based web application attacks such as XML attacks at Layer 7. These type of attacks take advantage of Layer-7 vulnerability in the web servers that may go undetected using traditional firewalls. WAFs are especially recommended for corporations implementing e-commerce services.
Endpoints residing at the campuses and other places in the network may be protected with endpoint security software that works in conjunction with the IDS and with the monitoring and analysis system. This collaboration allows for a better calculation of the risk level associated with an event, and the dynamic enforcement of watch lists for systems believed to have been compromised.
Table 8 illustrates how all these components play together as part of the same security strategy.
Table 8 CSF assessment - Corporate Internet Access
Total Visibility Identify Monitor Correlate
•Firewall deep packet inspection
•Web security
•Content filtering
•Secure messaging
•Intrusion Detection System
•Network management
•Network flow data collection
•Packet capture
•Endpoint monitoring
•Event monitoring
Event analysis and correlation
Total Control Harden Isolate Enforce
•Baseline security
•Stateful firewall
•Link and system redundancy
•Firewall access control policies
•Firewall access control
•Intrusion prevention
•Endpoint security
•Content filtering
•Secure messaging
One of the objectives of the Internet edge architecture is to provide mobile users and teleworkers with secure access to applications and data residing at the corporate network. Other services may include IP telephony. Figure 13 shows the infrastructure supporting this function.
Figure 13 Teleworker Access Design
Teleworker and mobile user access is authenticated and encrypted with either SSL or IPSec. These VPN tunnels are terminated on the edge firewalls. The firewalls are not only responsible of authenticating users and terminating the VPN sessions, but also of enforcing per-user or per-group access policies that restrict access to only the necessary resources.
Complementary, an IDS deployed at the firewall inside segment inspects traffic coming and going to the remote users. All alarm information generated by the IDS is forwarded to a monitoring and analysis system for analysis and correlation purposes.
In case remote users use the central e-mail service, the secure messaging system deployed close to the mail server inspects all e-mail communications, analyzing email payloads and eliminating threats such as e-mail spam, viruses, and worms.
In case the organization's policy forces all Internet access throughout a central location, web communications from remote users can also be secured by the web security system is deployed at inner switches level. In addition, remote users may be protected with endpoint security software that works in conjunction with the IDS and with the monitoring and analysis system. This collaboration allows for a better calculation of the risk level associated with an event, and the dynamic enforcement of watch lists for systems believed to have been compromised.
Table 9 illustrates how all these components play together as part of the same security strategy.
Table 9 CSF assessment - Teleworker Access
Total Visibility Identify Monitor Correlate
•Firewall deep packet inspection
•VPN authentication
•Web security*
•Content filtering*
•Secure messaging*
•Intrusion detection system (IDS)
•Network management
•Endpoint security posture
•Event monitoring
Event analysis and correlation
Total Control Harden Isolate Enforce
•Baseline security
•Stateful firewall
•VPN redundancy
•Link and system redundancy
•Per user/group firewall policies
•Firewall access control
•Intrusion prevention
•Endpoint security
•Content filtering*
•Secure messaging*
* In case access to the Internet is only allowed throughout a central location.
WAN Backup
The Internet edge design includes the option of using the Internet as a backup for the WAN links connecting the remote offices (see Figure 14). This requires an Internet connection at the branch offices.
Under this configuration, when the WAN links to a branch fail, traffic is automatically redirected over the Internet and over an authenticated and encrypted VPN connection. The VPN connection can either be permanently established or triggered on demand after a failure is detected. In this design, a dynamic routing protocol is used to identify failures and redirect traffic over the VPN tunnels. The dynamic routing protocol is transported over both the primary WAN links and the VPN tunnels.
The VPN tunnels are terminated at a pair of dedicated routers residing at the Internet edge of the head quarter or regional office. For configuration simplicity, Dynamic Multicast VPN (DMVPN) is used in this design.
For enhanced security and control, the VPN routers are placed behind the edge firewalls and distinct interfaces for encrypted traffic and traffic in clear. The interfaces dedicated to handling the encrypted traffic connect to the firewalls, which shield the VPN routers from a variety of threats by only accepting VPN packets initiated from the known IP addresses assigned to the branches.
The interfaces dedicated to handling the traffic in clear (after decryption) connect directly to the inside segment of the firewall. This assumes that traffic coming inside the VPN tunnels is to be trusted, and therefore no additional controls are required.
In addition, traffic coming from the backup VPN connections can be inspected by the IDS deployed at the firewall inside. All alarm information generated by the IDS is forwarded to a monitoring and analysis system for analysis and correlation purposes.
In case the organization mandates all Internet access to be centralized, the secure messaging system and web security system deployed at the Internet edge may also be used to secure e-mail and web communications.
Finally, remote users may be protected with endpoint security software that works in conjunction with the IDS and with the monitoring and analysis system. This collaboration allows for a better calculation of the risk level associated with an event, and the dynamic enforcement of watch lists for systems believed to have been compromised.
Figure 14 Internet WAN Backup Design
Table 10 illustrates how all these components play together as part of the same security strategy.
Table 10 CSF Assessment—Internet WAN Backup
Total Visibility Identify Monitor Correlate
•VPN authentication
•Firewall deep packet inspection*
•Web security*
•Content filtering*
•Secure messaging*
•Intrusion detection system (IDS)
•Network management
•Endpoint security posture
•Event monitoring
Event analysis and correlation
Total Control Harden Isolate Enforce
•Baseline security
•Stateful firewall
•VPN redundancy
•Link and system redundancy
•Per user/group firewall policies
•Firewall access control*
•Intrusion prevention
•Endpoint security
•Content filtering*
•Secure messaging*
* In case access to the Internet is only allowed throughout a central location.
•Network Security Baseline
•Data Center Design Guides
•WAN/Branch Design Guides


text:
DataONE:GEO reuse study
From OpenWetWare
(Redirected from GEO reuse study)Jump to navigationJump to search
This DataONE OpenWetWare site contains informal notes for several research projects funded through DataONE. DataONE is a collaboration among many partner organizations, and is funded by the US National Science Foundation (NSF) under a Cooperative Agreement.
Analysis of data reuse of NCBI's GEO datasets
Long term Aims
To understand the extent and value of reuse for data stored in the NCBI's GEO database.
Short-term Aims
To fill in the blanks in these sentences:
- We have collected some information using ??? on the GEO database, which is made possible because GEO citations are indexed in ????. We recorded all papers that cite the GEO data per year and the number of data sets in GEO for that year. We examined a subset of XXX of those citing papers to estimate the proportion of citations which (1) reused the original data in a significant way (rather than simply allude to its existence), and (2) did not include an author of the original work (because these authors would have access to the data in the absence of the archive). We also used this sample to record the nature of the reuse, for verification, meta-analysis or new questions.
- For every data set in GEO, there are XXX citations to data. Moreover, GEO is rapidly growing and there is a necessary time lag between deposition and reuse (on average XXX months after deposition), from which we can estimate that the typical paper is likely to generate YYY citations over the short term. This number should increase as more time passes and citations continue to accumulate for each paper, and it is an underestimate because not all citations to the data use standard references that can be tracked by ????. Of these citations, XXX% of them are estimated to results in novel scientific work that could not have been performed with the archive, for a total of XXX new pieces of work for each archived data set.
Research plan and initial work
Useful refs
- Fry, J and Lockyer, S and Oppenheim, C and Houghton, J and Rasmussen, B (2009) Identifying benefits arising from the curation and open sharing of research data produced by UK Higher Education and research institutes. Project Report http://ie-repository.jisc.ac.uk/279/


text:
University of Louisiana
The purchase of a one-year plate term may cause additional fees to be collected at your County Tax Assessor-Collector to establish a single expiration date for both the specialty plates and your vehicle registration. This fee may include up to an additional 12 months of plate fees for a new vehicle with a two-year registration.
Selecting a multi-year term (3-year or 5-year) provides cost-savings benefits, and any potential additional fees to be collected by your County Tax Assessor-Collector office to establish a single expiration date for your specialty plates and your vehicle registration would not appear until you receive your renewal notice from the TxDMV in the year prior to the end of your plate term.


text:
Porsche has a long tradition of building four cylinder hybrid race cars. So it should come as no surprise that Porsche's latest Le Mans contender runs that very traditional powertrain.
As of right now, the only details we have is that the car will have direct injection, four cylinders, and be a hybrid. We had already kind of anticipated that the LMP1 car would have four cylinder power and a hybrid, so this isn't the biggest shock in the world.
But as our friends at Piston Heads point out, Porsche also clumsily added a line to their release that this tech should help add to their road car development. That means a four cylinder road car hybrid fun machine could be on the way.
We've heard that the Macan might get a four cylinder in the base model, and there's also word of a four cylinder for the Cayman and Boxster.


text:
Download Simplified | Live Demo | Buy Copyright Removal: $30
Simplified is a 3-column widget ready impressive wordpress theme. You can change the icon in logo with your custom logo or avatar.
Download Simplified | Live Demo | Buy Copyright Removal: $30
Simplified is a 3-column widget ready impressive wordpress theme. You can change the icon in logo with your custom logo or avatar.
Thanks for theme. very nice ,I will use my wordpress webmaster blog
Hi, very nice Theme! I'm using it on my new blog, but i had a problem. When I click on a post, the white background disapears and some others weird stuff happens too. Anybody report this bug too?
Hello, I found the problem. It was a extra in the end of the comments.php file.
Looks great ;
how much for a custom theme ?
With a tasty AJAXified collection of plugins, it looks just awesome.
Any news on the update? Maybe someone can post a quick fix here?
No new version coming?
hey guys…the template has a problem when u are in the post page..
the bg image doesnt appear..how to fix the bug
Humberto Says:
June 17th, 2007 at 6:22 pm
Hi, very nice Theme! I'm using it on my new blog, but i had a problem. When I click on a post, the white background disapears and some others weird stuff happens too. Anybody report this bug too?
= Yes This is a bug
Humberto Says:
June 17th, 2007 at 7:09 pm
Hello, I found the problem. It was a extra in the end of the comments.php file.
Thats Correct again, but he forgot to mention, what is actually "extra"
Here is the solution: Open comments.php
Go to Line 109 ( may be different in your version, so just scroll to the bottom )
Here you will find that Ravish has closed the DIV tag twice, Just delete the second one, and you are done.
By the way, thanks Ravish for great theme structure, I am porting it to meet my choice.
@ kandah and others regarding the white bg issue…
Open comments.php
Remove one of the and save.
Issue fixed
seems like you cannot paste php code on here!
Remove one of the at the bottom of the comments.php file…
Yes, funny things happens.. I'll try that fix Humberto suggested.
great it works now. It's an extra at the end of the comments.php file, just delete it. Hope this helps!
extra ""
This web site just keeps erasing the most important information! It's the closing "div" tag.
Hi, why can't I put quotation on my post. And list with bullet is also not working. Anything to change in css???
great it works now. It's an extra at the end of the comments.php file, just delete it. Hope this helps!
my right column is missing adsense and images for first post. Anyone experiencing this? All other pages have adsense and whatever Ive placed in the right column.
Was going to use this theme on my own blog, however I'm having the same problems mentioned above..
Shame, such a nice theme too.
I like this theme a lot, too! But does someone know how I can increase the font-size, since I'm having Chinese characters on my blog, and they would be more legible if they were bigger. I looked through the style.css file and tried out a lot, but I couldn't figure it out. (But I don't understand much about it neither).
Thanks a lot!
I'm not sure if this is the bug you explained below: but while using it I also had problems that the right sidebar won't be there when I had a comment to a post.
It's in comments.php: there was one instead of and a after that missing. It's quite at the beginning of the file. Probably that's why there was an additional at the end of the file.
sorry this is me again. Is this normal or a bug that I can't put the "
thanks for this theme
navigation problem solved
in home.php
replace this line
-The Necenzurat
it's that simple ; simplified !
I like this theme alot too. But the contents of the right sidebar are often pushed down below the post. Also, the text is a very small fixed size.
There is definitely a bug in this theme. The right column gets pushed down to after the post comments. This occurs often when showing a single post. Perhaps the problem is in comments.php? To see it in action (assuming I'm still using this theme by the time you get there):
The problem is indeed in the comments.php file. I loaded it into a PHP editor that has collapsible sections, and it shows the div tags are not properly paired. I have fixed this problem on my site.
I love this theme, and I have downloaded the latest version but for some reason it breaks big time in firefox just as is without anything added to it, yet it doesn't in the demo…but when I view it in firefox on my install ,the left sidebar is at the top in the middle of the page with the content underneath it, and then the right sidebar is next to that, But if I shrink all the text so its tiny it all fits….?. does anybody know what I need to tweak as Its an awesome theme!…thanks
Wow, it's simple and clean, that made it looks so uniqe and fresh. Everytime I look at a theme, I say I'm going to use this one on this site. But this time, it's really going to be my choose. I consider to buy copyright removal as well.
May I ask something: Did the theme support version 2.5.1?
I love this theme, I think it's fantastic! Unfortunately it does have a few issues (they don't stop me from using it but they are frustrating).
A big problem I have is that I have made enough posts so there is more than one page, however there is no link to get there. Right now I can only go to previous posts by using the archives. Not sure if it's a theme problem or something I've done wrong.
A minor niggle I have can be viewed on the live demo. When clicking on a post with no comments on trackbacks, the headings on the right do not match those on the left.
I'd love to have an update to the comments left here as this is truly the best wordpress theme I've ever seen!
I'm trying to create a wordpress page which will show all the links with link categories i.e. I'm trying to use wp_list_bookmarks(). However it just doesnt seem to be working when I put the following in the body of the page:
What I'm figuring is it just doesnt run the php code and treats it as text. I tried creating a custom page with just calling the head and footer but then I get a "Page not found" error which doesnt make sense.
Any advice?
I like this theme alot too. But the contents of the right sidebar are often pushed down below the post. Also, the text is a very small fixed size.
I'm experimenting two problems with Losemymind with sidebar 1.0 theme:
1.date entry is wrong, appear 2007 instead 2008
2.tags under the post are not displayed, there is only a gray bar without any tags…
Can anyone help me?
I don't know php…
Thanks, Vic
This is one Hell of theme , I Must say…..Looks cool and the Colours great……………and easy 2 modify……you can do lot with this theme…
and also…..I find this theme is SEO friendly….dont ask How….But…test it here at http://www.rama.cc and its a Killer////
Well done Guys….
Soon I will upgrade and Purchase this theme…
Rama Zotti
I use thies Theme http://www.sparblog.com but the plugin Wp-Sticky doesnt works , can u tell me why ?
@Sharon You can use the theme several times after buying the copyright removal but you can't redistribute it.
I am trying to look at the live demo but keep getting a database error
Error establishing a database connection
Please advise
this theme is very good and i like it.
All of the above suggestions about fixing the comment block fixed one problem but broke another. I don't know if anyone else had the same problem, but if you're still looking for a fix, you can get an updated version of the comments.php file here: http://i.nconspicuo.us/2009/01/19/simplified-wordpress-theme-simplified-theme-fix/
new coming?
why new versiyon not for coming ?
To those having trouble with the right sidebar on the homepage, I found the problem – it's in home.php and ironically it's a missing closing DIV tag before it calls the right sidebar.
and as for the missing tags under the posts, even though it shows tag graphics, it's coded to only show categories.
it's a nice theme for sure, but with these hair pulling bugs and additional work required to make it make sense, the author should be paying us each $30.
Excellent Theme. 3 Column design is useful.
I'm using the theme at http://www.schnaeppchenfuchs.com It's beautfil, I love it
When will the new theme
I like this theme alot too. But the contents of the right sidebar are often pushed down below the post. Also, the text is a very small fixed size.


text:
Sorry, that page isn't here
You can view our most popular glasses below.
Imagine XS
Sepia Kiss
Love my new glasses! Frames are comfortable and great quality.
I recommend this product
Leather Tray
Very cute item..keeps my glasses moving around on my bathroom counter and keeps it all tidy!
I recommend this product
Illusion M
Gold Shadow
I love them so much! They look really good and everyone loves them on me
I recommend this product
Area L
Pink Tortoise
This is my second set of Area frames, I also have the clear. These are just as beautiful as the clear but seem wider on my face which I love even though they are exactly the same size.
I recommend this product
I have a small head so usually I end up fitting children's glasses better than adults. The unfortunate thing there is a lot of kids' glasses just don't look as nice. I love these glasses!! They fit perfectly, and the rose color sort of has a tan to it so they are very subtle. I hope Bonlook keeps these smaller frames around - they're the best I've found.
I recommend this product
Myrtle Petite
Sepia Kiss
I'm extremely happy with these glasses! They're super cute and very affordable. I love the fact that Bonlook has petite frames for smaller faces. Also, the online ordering process was so easy and I really appreciated receiving status updates at every stage of the process. Overall, this purchase was a great experience :)
I recommend this product
Mud Clear
Glasses look good, frames fit perfectly and I received excellent service both in store and on the website. Thanks!!!
I recommend this product
Black Copper
Customer service was outstanding. This was my first time ordering glasses online and it couldn't have been easier. Thank you, Bonlook!
I recommend this product


text:
(Pocket-lint) - Motoring reviews, or rather the people who write them, have a penchant for favouring cars that are powerful and fun to drive down a twisting B-road. But let's face facts. Most people don't care about driving like that, and when it comes to shelling out their hard earned cash, want something they can depend on for years to come.
Which is why the Toyota Yaris has always been a favourite in the small car class with buyers, but you won't see it winning many tests. It's just dependable, easy to drive transport. Yet far from being another dull-as-beige Toyota, the first two generations of Yaris built on this dependability with character and clever design features. With this new, third generation, the company claims they've gone even further - building a car for people like us at Pocket-Lint, loaded with clever ideas and stuffed full of tech at reasonable prices. Sounds promising, doesn't it?
The first generation Yaris included a, futuristic for the time, set of digital gauges, a sliding rear seat allowing you to choose between passenger and luggage space. There was a higher-than-normal seating position, meaning the car felt, and was, spacious inside, but was short and easy to park on the road. It also had bags of that hard to quantify thing called personality.
The second generation Yaris squared off the corners and dialed down personality, but kept lots of the clever design. So we'd like to know who's stolen the clever bits and thrown them in the rubbish bin while they were designing this new model? Without any of this smart packaging, the Yaris is a car devoid of personality and with very little to distinguish it in a very competitive and diverse market. Which is a shame.
Inside, you get lots of space but the contrast colour insert on the dash in front of the passenger is as interesting as it gets. It's not bad per-se, but nor is it innovative like a Honda Jazz, or full of soft-touch plastics like a Polo.
Great credit goes to Toyota for seeing the light of reality and building the Yaris's integrated SatNav option into a wider tech pack priced at a point which might just make you think twice about that off-the shelf TomTom unit and all its trailing wires.
The system's called Toyota 'Touch and Go'. The first level (Toyota Touch) includes CD/MP3/WMA player, Bluetooth hands-free and audio streaming, a USB port, and a rear-view camera for reversing – all accessed and shown through a 6.1inch touchscreen. This is standard on TR, SR and T Spirit (i.e. all but the base car) models. Upgrade to 'Touch and Go' and you'll get full pan-European sat nav with speed camera and safety alerts, Google local search function and live update services: such as parking availability, petrol prices and so on. It's a £500 option, but if you order a Yaris in 2011, they'll chuck it in for free.
And it works well, with easy phone pairing and music streaming. So it's a shame these functions are built into a centre console unit which is badly positioned for the driver. The screen sits canted slightly toward the passenger side of the car because of the shape of the dash.
Beyond this, ignore the base spec T2, and all models in the range are well equipped with air-conditioning, seven airbags and a host of other kit as standard.
This is safe, steady driving which is never going to spit you off the road backwards and into a ditch. The brakes are good, the gearbox light and for a car in this class it's pretty refined at motorway speeds. Yet the ride is curiously hard - it never settles down, which spoils the refinement. And the weighting of the clutch is oddly springy, which make the Yaris far harder to drive smoothly than it should given it's billing and likely customers. Expect to see one being lurched away from Sainsbury's car park soon, by someone in a flat cap, accompanied by a flourish of revs and slipping of clutch.
The thicker C-pillar this third generation car has acquired makes it harder to park too. And while that reversing camera's a nice-to-have-tech gadget, why on earth would you need it? This isn't an SUV, so it should be easier to see out of and position than it is.
We drove the most powerful 1.33 petrol engine. It was smooth and powerful enough, (there's a smaller 1.0 petrol and a 1.4 diesel engine too) and the CO2 emissions are decently low. It returned nearly 50mpg in our hands, so expect more if your drive gently. We were disappointed not to see stop-start as standard on a brand new model of car though.
You won't be surprised to read that - while it's far from a bad car - we aren't giving it a glowing recommendation either.
The tech packages and high level of equipment are appealing and, in many ways, the Yaris's real saving grace. But unless you absolutely must have a sat nav system that's capable of turning down the radio while it barks instructions at you, we'd recommend you buy something else and put up with the trailing wires of a TomTom.
All of which is a great shame. Toyota has long been known for its quality and dependability, but the first two Yaris's added to that by being fun and full of clever ideas that gave them character and made them real star buys in the class. Now, it's rare to find a car that isn't well built and won't be reliable over the first five years of its life. And anyway, if that's your primary concern, may we point you in the direction of Kia's new Rio - with its seven year warranty - or Honda's ingeniously designed Jazz (the 'Fit' in the US), which repeatedly tops the reliability tables wherever its sold.
And if you're just after a good small car, a Polo or a Fiesta deserves a space on your drive far more than this new Yaris does. It's only those sensibly thought through tech packs that haul the new Yaris up to a three star rating. The smaller iQ proves Toyota still has the ability to build a car with smart, innovative features, a characterful design and make it fun to drive. It's just a pity they left all of that out of the mix in the new Yaris.


text:
A genetic investigation into the illegal trade of sailfin dragons has unearthed a surprise: a new species of the rainbow-colored lizards that resemble small dinosaurs. The finding highlights just how little is known about these mysterious and threatened animals.
Sailfin lizards (genus Hydrosaurus) look like they were pulled from a child's coloring book. As the water-loving reptiles mature, their faces, dorsal crests, and saillike tails shift from a drab green and gray to vibrant shades of neon purple, cyan, and harlequin. That's made them a popular target for an illegal pet trade which—along with destruction of their habitat in the Philippines, eastern Indonesia, and New Guinea—has decimated their numbers. In the wild, only juveniles remain in most populations, says Cameron Siler, the curator of herpetology at the University of Oklahoma, Norman.
To learn more about the enigmatic animals, Siler and his colleagues swept the black markets of Manila, a trade hub, collecting DNA samples from the toenails and scales of 20 sailfin dragons between 2011 and 2012. They then compared these specimens to the genetic material of 80 animals whose origins traced across the sailfins' four major island habitats: the Philippines, Sulawesi, Halmahera, and New Guinea.
When the researchers determined the evolutionary ties between the lizards based on their DNA, they discovered that the three accepted Hydrosaurus species are actually four. Sailfin lizards from Sulawesi in Indonesia were originally grouped with the species from New Guinea more than 140 years ago, but the genetic survey suggests that Sulawesi dragons are a separate lineage, the team reports in the January issue of Biological Conservation.
The study has solid geographical sampling, and the team's statistical analysis of two DNA genomes—mitochondrial and nuclear—shows pretty good evidence for the new species, says Bryan Stuart, a curator of herpetology at the North Carolina Museum of Natural Sciences in Raleigh, who was not involved in the work. "We don't very often see forensic studies like this." Additional specimens from New Guinea are needed to fully confirm the new species, but the findings are convincing, he says.
According to the team's genetic comparisons, all the smuggled dragons seem to have come from a single location in the Philippines: the Bicol Peninsula on Luzon Island. The area is home to large swaths of sailfin habitat, Siler says, but this could change because very few coastal habitats are protected. Protected regions in the Philippines are mainly concentrated in the mountainous highlands where a high density of primary forest remains, he notes. Although this benefits many species, including several endangered birds, it leaves hydrosaurs and other coastal fauna exposed. Siler and colleagues found that current laws in the Philippines protect less than 10% of existing habitats that are suitable for sailfin dragons. The native Philippine species, Hydrosaurus pustulatus, is listed as a vulnerable species by the International Union for Conservation of Nature.
The genetic forensics used in the current study could aid conservation efforts for reptiles and amphibians across Southeast Asia, especially turtles, which Stuart says are poached and smuggled from every country in Asia. When large shipments are caught, officials often face the dilemma of what to do with animals confiscated far from their home range. "You don't want to start mixing genetic lineages in the wild or captivity that might not normally breed with one another," he says. This study provides a blueprint for responsibly incorporating them into captive breeding programs, he says, or very carefully reintroducing them back to their area of origin.


text:
BROOKSHIRE – Nine days. Two entirely different viewpoints.
A little more than a week ago, kicker Randy Bullock was the easiest Texan to rip and often was. The former Texas A&M standout had missed all three of his field-goal attempts Week 2 against Tennessee, and Bullock's 1-for-5 start to his first season as the Texans' kicker left him open to public ridicule and internet trolling.
"It's tough. It's so easy to say, 'Hey, turn the page.' No. It's not that easy," veteran punter Shane Lechler said Tuesday. "You've got to try to do it. And my hat's off to him. He stuck in there and gutted it out. Because I know people were on him and on him hard. … But he handled it great."
Bullock's team pulled off a 30-24 overtime victory against the Titans at Reliant Stadium. But come-from-behind glory evaded the fifth-round pick of the 2012 NFL draft, and everyone from coach Gary Kubiak to Bullock acknowledged the 23-year-old kicker had to immediately do a better job to keep the one he had.
"That was really strange. I'd never had a game like that before," Bullock said. "That was very frustrating. Honestly, the whole situation toward the end of the game was really strange, too. … Shane and I talked about it — it was something he'd never experienced either, in 14 years in the league."
Last Monday morning, Texans special teams coach Joe Marciano found Bullock at his locker and asked the kicker if he was doing OK. Bullock quickly replied.
"I can't wait til Sunday," he told Marciano. "This week can't go by fast enough."
Six days later, Bullock came through. He went 3-for-3 Sunday in Baltimore, recording all nine of the Texans' points and improving to 4-for-8 this season. Bullock nailed kicks of 27, 29 and 47 yards, becoming one of the Texans' few bright points during a depressing 30-9 blowout loss to the Ravens.
His team exited the East Coast searching for answers, hoping its third consecutive weak overall performance would become an early season wake-up call. In contrast, Bullock left Baltimore with renewed confidence, knowing he'd officially buried Week 2.
"It was a big game for me. It was a rebound game," Bullock said. "I couldn't have done anything differently. That's exactly how I wanted to come back. Nothing changed throughout the week – my preparation or anything like that. It was kind of a fluke game, the game before. All I could do was get my head back on straight and do what I know I can do."
Lechler spent more than a decade in Oakland with Sebastian Janikowski, one of the premier kickers in the game. To reach Bullock post-Titans, Lechler related Janikowski's early NFL struggles, while stressing the Texans needed a kicker whose personal belief never wavered.
"A kicker's got to be confident in himself and that's definitely what (Bullock) is. He's very head-strong, very confident in his abilities," Lechler said. "And that's the kind of guy you want. I don't want a guy that's going to go, 'Man, I hope I make this.' No. It's, 'Dude, I know I'm going to make this. It's just a matter of how far do we want to kick it.' "
Tuesday, Bullock and Lechler were united away from football. Joined by Weeks, the kicking trio appeared at Brookwood Community – a nonprofit residential facility and vocational program for functionally disabled adults — to give back to residents.
A smiling Bullock shook hands and signed autographs, one perfect outing and a world removed from 0-for-3 against the Titans.
"It was a great experience," Bullock said. "It's the first time I've been out here, but it seemed like everybody really enjoyed it."
Twitter: ChronBrianSmith


text: Planning a trip to California? With major metro areas such as Los Angeles and San Diego, along with top attractions including Hollywood, San Diego Zoo and Golden Gate Bridge, you are sure to have a unique and memorable experience. Take in all the great sights that California has to offer with a hire car from Enterprise Rent-A-Car. Choose from one of our popular airport locations or find the perfect car at a neighbourhood branch. Search for a car rental location or browse the list below.