text:
Special Publication 800-12: An Introduction to Computer Security - The NIST Handbook
This chapter illustrates how a hypothetical government agency (HGA) deals with computer security issues in its operating environment.140 It follows the evolution of HGA's initiation of an assessment of the threats to its computer security system all the way through to HGA's recommendations for mitigating those risks. In the real world, many solutions exist for computer security problems. No single solution can solve similar security problems in all environments. Likewise, the solutions presented in this example may not be appropriate for all environments.
|This example can be used to help understand how security issues are examined, how some potential solutions are analyzed, how their cost and benefits are weighed, and ultimately how management accepts responsibility for risks.
This case study is provided for illustrative purposes only, and should not be construed as guidance or specific recommendations to solving specific security issues. Because a comprehensive example attempting to illustrate all handbook topics would be inordinately long, this example necessarily simplifies the issues presented and omits many details. For instance, to highlight the similarities and differences among controls in the different processing environments, it addresses some of the major types of processing platforms linked together in a distributed system: personal computers, local-area networks, wide-area networks, and mainframes; it does not show how to secure these platforms.
This section also highlights the importance of management's acceptance of a particular level of risk--this will, of course, vary from organization to organization. It is management's prerogative to decide what level of risk is appropriate, given operating and budget environments and other applicable factors.
HGA has information systems that comprise and are intertwined with several different kinds of assets valuable enough to merit protection. HGA's systems play a key role in transferring U.S. Government funds to individuals in the form of paychecks; hence, financial resources are among the assets associated with HGA's systems. The system components owned and operated by HGA are also assets, as are personnel information, contracting and procurement documents, draft regulations, internal correspondence, and a variety of other day-to-day business documents, memos, and reports. HGA's assets include intangible elements as well, such as reputation of the agency and the confidence of its employees that personal information will be handled properly and that the wages will be paid on time.
A recent change in the directorship of HGA has brought in a new management team. Among the new Chief Information Officer's first actions was appointing a Computer Security Program Manager who immediately initiated a comprehensive risk analysis to assess the soundness of HGA's computer security program in protecting the agency's assets and its compliance with federal directives. This analysis drew upon prior risk assessments, threat studies, and applicable internal control reports. The Computer Security Program Manager also established a timetable for periodic reassessments.
Since the wide-area network and mainframe used by HGA are owned and operated by other organizations, they were not treated in the risk assessment as HGA's assets. And although HGA's personnel, buildings, and facilities are essential assets, the Computer Security Program Manager considered them to be outside the scope of the risk analysis.
After examining HGA's computer system, the risk assessment team identified specific threats to HGA's assets, reviewed HGA's and national safeguards against those threats, identified the vulnerabilities of those policies, and recommended specific actions for mitigating the remaining risks to HGA's computer security. The following sections provide highlights from the risk assessment. The assessment addressed many other issues at the programmatic and system levels. However, this chapter focuses on security issues related to the time and attendance application. (Other issues are discussed in Chapter 6.)
HGA relies on the distributed computer systems and networks shown in Figure 20.1. They consist of a collection of components, some of which are systems in their own right. Some belong to HGA, but others are owned and operated by other organizations. This section describes these components, their role in the overall distributed system architecture, and how they are used by HGA.
Most of HGA's staff (a mix of clerical, technical, and managerial staff) are provided with personal computers (PCs) located in their offices. Each PC includes hard-disk and floppy-disk drives.
The PCs are connected to a local area network (LAN) so that users can exchange and share information. The central component of the LAN is a LAN server, a more powerful computer that acts as an intermediary between PCs on the network and provides a large volume of disk storage for shared information, including shared application programs. The server provides logical access controls on potentially sharable information via elementary access control lists. These access controls can be used to limit user access to various files and programs stored on the server. Some programs stored on the server can be retrieved via the LAN and executed on a PC; others can only be executed on the server.
To initiate a session on the network or execute programs on the server, users at a PC must log into the server and provide a user identifier and password known to the server. Then they may use files to which they have access.
One of the applications supported by the server is electronic mail (e-mail), which can be used by all PC users. Other programs that run on the server can only be executed by a limited set of PC users.
Several printers, distributed throughout HGA's building complex, are connected to the LAN. Users at PCs may direct printouts to whichever printer is most convenient for their use.
Since HGA must frequently communicate with industry, the LAN also provides a connection to the Internet via a router. The router is a network interface device that translates between the protocols and addresses associated with the LAN and the Internet. The router also performs network packet filtering, a form of network access control, and has recently been configured to disallow non-e-mail (e.g., file transfer, remote log-in) between LAN and Internet computers.
The LAN server also has connections to several other devices.
The system components contained within the large dashed rectangle shown in Figure 20.1 are managed and operated by an organization within HGA known as the Computer Operations Group (COG). This group includes the PCs, LAN, server, console, printers, modem pool, and router. The WAN is owned and operated by a large commercial telecommunications company that provides WAN services under a government contract. The mainframe is owned and operated by a federal agency that acts as a service provider for HGA and other agencies connected to the WAN.
PCs on HGA's LAN are used for word processing, data manipulation, and other common applications, including spreadsheet and project management tools. Many of these tasks are concerned with data that are sensitive with respect to confidentiality or integrity. Some of these documents and data also need to be available in a timely manner.
The mainframe also provides storage and retrieval services for other databases belonging to individual agencies. For example, several agencies, including HGA, store their personnel databases on the mainframe; these databases contain dates of service, leave balances, salary and W-2 information, and so forth.
In addition to their time and attendance application, HGA's PCs and the LAN server are used to manipulate other kinds of information that may be sensitive with respect to confidentiality or integrity, including personnel-related correspondence and draft contracting documents.
Different assets of HGA are subject to different kinds of threats. Some threats are considered less likely than others, and the potential impact of different threats may vary greatly. The likelihood of threats is generally difficult to estimate accurately. Both HGA and the risk assessment's authors have attempted to the extent possible to base these estimates on historical data, but have also tried to anticipate new trends stimulated by emerging technologies (e.g., external networks).
As for most large organizations that control financial assets, attempts at fraud and embezzlement are likely to occur. Historically, attempts at payroll fraud have almost always come from within HGA or the other agencies that operate systems on which HGA depends. Although HGA has thwarted many of these attempts, and some have involved relatively small sums of money, it considers preventing financial fraud to be a critical computer security priority, particularly in light of the potential financial losses and the risks of damage to its reputation with Congress, the public, and other federal agencies.
Attempts to defraud HGA have included the following:
Of greater likelihood, but of perhaps lesser potential impact on HGA, are errors in the entry of time and attendance data; failure to enter information describing new employees, terminations, and transfers in a timely manner; accidental corruption or loss of time and attendance data; or errors in interagency coordination and processing of personnel transfers.
Errors of these kinds can cause financial difficulties for employees and accounting problems for HGA. If an employee's vacation or sick leave balance became negative erroneously during the last pay period of the year, the employee's last paycheck would be automatically reduced. An individual who transfers between HGA and another agency may risk receiving duplicate paychecks or no paychecks for the pay periods immediately following the transfer. Errors of this sort that occur near the end of the year can lead to errors in W-2 forms and subsequent difficulties with the tax collection agencies.
HGA's building facilities and physical plant are several decades old and are frequently under repair or renovation. As a result, power, air conditioning, and LAN or WAN connectivity for the server are typically interrupted several times a year for periods of up to one work day. For example, on several occasions, construction workers have inadvertently severed power or network cables. Fires, floods, storms, and other natural disasters can also interrupt computer operations, as can equipment malfunctions.
Another threat of small likelihood, but significant potential impact, is that of a malicious or disgruntled employee or outsider seeking to disrupt time-critical processing (e.g., payroll) by deleting necessary inputs or system accounts, misconfiguring access controls, planting computer viruses, or stealing or sabotaging computers or related equipment. Such interruptions, depending upon when they occur, can prevent time and attendance data from getting processed and transferred to the mainframe before the payroll processing deadline.
Other kinds of threats may be stimulated by the growing market for information about an organization's employees or internal activities. Individuals who have legitimate work-related reasons for access to the master employee database may attempt to disclose such information to other employees or contractors or to sell it to private investigators, employment recruiters, the press, or other organizations. HGA considers such threats to be moderately likely and of low to high potential impact, depending on the type of information involved.
Most of the human threats of concern to HGA originate from insiders. Nevertheless, HGA also recognizes the need to protect its assets from outsiders. Such attacks may serve many different purposes and pose a broad spectrum of risks, including unauthorized disclosure or modification of information, unauthorized use of services and assets, or unauthorized denial of services.
As shown in Figure 20.1, HGA's systems are connected to the three external networks: (1) the Internet, (2) the Interagency WAN, and (3) the public-switched (telephone) network. Although these networks are a source of security risks, connectivity with them is essential to HGA's mission and to the productivity of its employees; connectivity cannot be terminated simply because of security risks.
In each of the past few years before establishing its current set of network safeguards, HGA had detected several attempts by outsiders to penetrate its systems. Most, but not all of these, have come from the Internet, and those that succeeded did so by learning or guessing user account passwords. In two cases, the attacker deleted or corrupted significant amounts of data, most of which were later restored from backup files. In most cases, HGA could detect no ill effects of the attack, but concluded that the attacker may have browsed through some files. HGA also conceded that its systems did not have audit logging capabilities sufficient to track an attacker's activities. Hence, for most of these attacks, HGA could not accurately gauge the extent of penetration.
In one case, an attacker made use of a bug in an e-mail utility and succeeded in acquiring System Administrator privileges on the server--a significant breach. HGA found no evidence that the attacker attempted to exploit these privileges before being discovered two days later. When the attack was detected, COG immediately contacted the HGA's Incident Handling Team, and was told that a bug fix had been distributed by the server vendor several months earlier. To its embarrassment, COG discovered that it had already received the fix, which it then promptly installed. It now believes that no subsequent attacks of the same nature have succeeded.
Although HGA has no evidence that it has been significantly harmed to date by attacks via external networks, it believes that these attacks have great potential to inflict damage. HGA's management considers itself lucky that such attacks have not harmed HGA's reputation and the confidence of the citizens its serves. It also believes the likelihood of such attacks via external networks will increase in the future.
HGA's systems also are exposed to several other threats that, for reasons of space, cannot be fully enumerated here. Examples of threats and HGA's assessment of their probabilities and impacts include those listed in Table 20.1.
HGA has numerous policies and procedures for protecting its assets against the above threats. These are articulated in HGA's Computer Security Manual, which implements and synthesizes the requirements of many federal directives, such as Appendix III to OMB Circular A-130, the Computer Security Act of 1987, and the Privacy Act. The manual also includes policies for automated financial systems, such as those based on OMB Circulars A-123 and A-127, as well as the Federal Manager's Financial Integrity Act.
Several examples of those policies follow, as they apply generally to the use of administration of HGA's computer system and specifically to security issues related to time and attendance, payroll, and continuity of operations.
HGA's Computer Operations Group (COG) is responsible for controlling, administering, and maintaining the computer resources owned and operated by HGA. These functions are depicted in Figure 20.1 enclosed in the large, dashed rectangle. Only individuals holding the job title System Administrator are authorized to establish log-in ID's and passwords on multiuser HGA systems (e.g., the LAN server). Only HGA's employees and contract personnel may use the system, and only after receiving written authorization from the department supervisor (or, in the case of contractors, the contracting officer) to whom these individuals report.
COG issues copies of all relevant security policies and procedures to new users. Before activating a system account for new users, COG requires that they (1) attend a security awareness and training course or complete an interactive computer-aided-instruction training session and (2) sign an acknowledgment form indicating that they understand their security responsibilities.
Authorized users are assigned a secret log-in ID and password, which they must not share with anyone else. They are expected to comply with all of HGA's password selection and security procedures (e.g., periodically changing passwords). Users who fail to do so are subject to a range of penalties.
Examples of Threats to HGA Systems
Potential Threat
|Accidental Loss/Release of Disclosure-Sensitive Information
|Accidental Destruction of Information
|Loss of Information due to Virus Contamination
|Misuse of System Resources
|Unauthorized Access to Telecommunications Resources *
|Natural Disaster
|* HGA operates a PBX system, which may be vulnerable to (1) hacker disruptions of PBX availability and, consequently, agency operations, (2) unauthorized access to outgoing phone lines for long-distance services, (3) unauthorized access to stored voice-mail messages, and (4) surreptitious access to otherwise private conversations/data transmissions.
Users creating data that are sensitive with respect to disclosure or modification are expected to make effective use of the automated access control mechanisms available on HGA computers to reduce the risk of exposure to unauthorized individuals. (Appropriate training and education are in place to help users do this.) In general, access to disclosure-sensitive information is to be granted only to individuals whose jobs require it.
The time and attendance application plays a major role in protecting against payroll fraud and errors. Since the time and attendance application is a component of a larger automated payroll process, many of its functional and security requirements have been derived from both governmentwide and HGA-specific policies related to payroll and leave. For example, HGA must protect personal information in accordance with the Privacy Act. Depending on the specific type of information, it should normally be viewable only by the individual concerned, the individual's supervisors, and personnel and payroll department employees. Such information should also be timely and accurate.
Each week, employees must sign and submit a time sheet that identifies the number of hours they have worked and the amount of leave they have taken. The Time and Attendance Clerk enters the data for a given group of employees and runs an application on the LAN server to verify the data's validity and to ensure that only authorized users with access to the Time and Attendance Clerk's functions can enter time and attendance data. The application performs these security checks by using the LAN server's access control and identification and authentication (I&A) mechanisms. The application compares the data with a limited database of employee information to detect incorrect employee identifiers, implausible numbers of hours worked, and so forth. After correcting any detected errors, the clerk runs another application that formats the time and attendance data into a report, flagging exception/out-of-bound conditions (e.g., negative leave balances).
Department supervisors are responsible for reviewing the correctness of the time sheets of the employees under their supervision and indicating their approval by initialing the time sheets. If they detect significant irregularities and indications of fraud in such data, they must report their findings to the Payroll Office before submitting the time sheets for processing. In keeping with the principle of separation of duty, all data on time sheets and corrections on the sheets that may affect pay, leave, retirement, or other benefits of an individual must be reviewed for validity by at least two authorized individuals (other than the affected individual).
Protection Against Unauthorized Execution
Only users with access to Time and Attendance Supervisor functions may approve and submit time and attendance data -- or subsequent corrections thereof -- to the mainframe. Supervisors may not approve their own time and attendance data.
Only the System Administrator has been granted access to assign a special access control privilege to server programs. As a result, the server's operating system is designed to prevent a bogus time and attendance application created by any other user from communicating with the WAN and, hence, with the mainframe.
The time and attendance application is supposed to be configured so that the clerk and supervisor functions can only be carried out from specific PCs attached to the LAN and only during normal working hours. Administrators are not authorized to exercise functions of the time and attendance application apart from those concerned with configuring the accounts, passwords, and access permissions for clerks and supervisors. Administrators are expressly prohibited by policy from entering, modifying, or submitting time and attendance data via the time and attendance application or other mechanisms.141
Protection against unauthorized execution of the time and attendance application depends on I&A and access controls. While the time and attendance application is accessible from any PC, unlike most programs run by PC users, it does not execute directly on the PC's processor. Instead, it executes on the server, while the PC behaves as a terminal, relaying the user's keystrokes to the server and displaying text and graphics sent from the server. The reason for this approach is that common PC systems do not provide I&A and access controls and, therefore, cannot protect against unauthorized time and attendance program execution. Any individual who has access to the PC could run any program stored there.
Another possible approach is for the time and attendance program to perform I&A and access control on its own by requesting and validating a password before beginning each time and attendance session. This approach, however, can be defeated easily by a moderately skilled programming attack, and was judged inadequate by HGA during the application's early design phase.
Recall that the server is a more powerful computer equipped with a multiuser operating system that includes password-based I&A and access controls. Designing the time and attendance application program so that it executes on the server under the control of the server's operating system provides a more effective safeguard against unauthorized execution than executing it on the user's PC.
Protection Against Payroll Errors
The frequency of data entry errors is reduced by having Time and Attendance clerks enter each time sheet into the time and attendance application twice. If the two copies are identical, both are considered error free, and the record is accepted for subsequent review and approval by a supervisor. If the copies are not identical, the discrepancies are displayed, and for each discrepancy, the clerk determines which copy is correct. The clerk then incorporates the corrections into one of the copies, which is then accepted for further processing. If the clerk makes the same data-entry error twice, then the two copies will match, and one will be accepted as correct, even though it is erroneous. To reduce this risk, the time and attendance application could be configured to require that the two copies be entered by different clerks.
In addition, each department has one or more Time and Attendance Supervisors who are authorized to review these reports for accuracy and to approve them by running another server program that is part of the time and attendance application. The data are then subjected to a collection of "sanity checks" to detect entries whose values are outside expected ranges. Potential anomalies are displayed to the supervisor prior to allowing approval; if errors are identified, the data are returned to a clerk for additional examination and corrections.
When a supervisor approves the time and attendance data, this application logs into the interagency mainframe via the WAN and transfers the data to a payroll database on the mainframe. The mainframe later prints paychecks or, using a pool of modems that can send data over phone lines, it may transfer the funds electronically into employee-designated bank accounts. Withheld taxes and contributions are also transferred electronically in this manner.
The Director of Personnel is responsible for ensuring that forms describing significant payroll-related personnel actions are provided to the Payroll Office at least one week before the payroll processing date for the first affected pay period. These actions include hiring, terminations, transfers, leaves of absences and returns from such, and pay raises.
The Manager of the Payroll Office is responsible for establishing and maintaining controls adequate to ensure that the amounts of pay, leave, and other benefits reported on pay stubs and recorded in permanent records and those distributed electronically are accurate and consistent with time and attendance data and with other information provided by the Personnel Department. In particular, paychecks must never be provided to anyone who is not a bona fide, active-status employee of HGA. Moreover, the pay of any employee who terminates employment, who transfers, or who goes on leave without pay must be suspended as of the effective date of such action; that is, extra paychecks or excess pay must not be dispersed.
Protection Against Accidental Corruption or Loss of Payroll Data
The same mechanisms used to protect against fraudulent modification are used to protect against accidental corruption of time and attendance data -- namely, the access-control features of the server and mainframe operating systems.
COG's nightly backups of the server's disks protect against loss of time and attendance data. To a limited extent, HGA also relies on mainframe administrative personnel to back up time and attendance data stored on the mainframe, even though HGA has no direct control over these individuals. As additional protection against loss of data at the mainframe, HGA retains copies of all time and attendance data on line on the server for at least one year, at which time the data are archived and kept for three years. The server's access controls for the on-line files are automatically set to read-only access by the time and attendance application at the time of submission to the mainframe. The integrity of time and attendance data will be protected by digital signatures as they are implemented.
The WAN's communications protocols also protect against loss of data during transmission from the server to the mainframe (e.g., error checking). In addition, the mainframe payroll application includes a program that is automatically run 24 hours before paychecks and pay stubs are printed. This program produces a report identifying agencies from whom time and attendance data for the current pay period were expected but not received. Payroll department staff are responsible for reviewing the reports and immediately notifying agencies that need to submit or resubmit time and attendance data. If time and attendance input or other related information is not available on a timely basis, pay, leave, and other benefits are temporarily calculated based on information estimated from prior pay periods.
HGA's policies regarding continuity of operations are derived from requirements stated in OMB Circular A-130. HGA requires various organizations within it to develop contingency plans, test them annually, and establish appropriate administrative and operational procedures for supporting them. The plans must identify the facilities, equipment, supplies, procedures, and personnel needed to ensure reasonable continuity of operations under a broad range of adverse circumstances.
COG Contingency Planning
COG is responsible for developing and maintaining a contingency plan that sets forth the procedures and facilities to be used when physical plant failures, natural disasters, or major equipment malfunctions occur sufficient to disrupt the normal use of HGA's PCs, LAN, server, router, printers, and other associated equipment.
The plan prioritizes applications that rely on these resources, indicating those that should be suspended if available automated functions or capacities are temporarily degraded. COG personnel have identified system software and hardware components that are compatible with those used by two nearby agencies. HGA has signed an agreement with those agencies, whereby they have committed to reserving spare computational and storage capacities sufficient to support HGA's system-based operations for a few days during an emergency.
No communication devices or network interfaces may be connected to HGA's systems without written approval of the COG Manager. The COG staff is responsible for installing all known security-related software patches in a timely manner and for maintaining spare or redundant PCs, servers, storage devices, and LAN interfaces to ensure that at least 100 people can simultaneously perform word processing tasks at all times.
To protect against accidental corruption or loss of data, COG personnel back up the LAN server's disks onto magnetic tape every night and transport the tapes weekly to a sister agency for storage. HGA's policies also stipulate that all PC users are responsible for backing up weekly any significant data stored on their PC's local hard disks. For the past several years, COG has issued a yearly memorandum reminding PC users of this responsibility. COG also strongly encourages them to store significant data on the LAN server instead of on their PC's hard disk so that such data will be backed up automatically during COG's LAN server backups.
To prevent more limited computer equipment malfunctions from interrupting routine business operations; COG maintains an inventory of approximately ten fully equipped spare PC's, a spare LAN server, and several spare disk drives for the server. COG also keeps thousands of feet of LAN cable on hand. If a segment of the LAN cable that runs through the ceilings and walls of HGA's buildings fails or is accidentally severed, COG technicians will run temporary LAN cabling along the floors of hallways and offices, typically restoring service within a few hours for as long as needed until the cable failure is located and repaired.
To protect against PC virus contamination, HGA authorizes only System Administrators approved by the COG Manager to install licensed, copyrighted PC software packages that appear on the COG-approved list. PC software applications are generally installed only on the server. (These stipulations are part of an HGA assurance strategy that relies on the quality of the engineering practices of vendors to provide software that is adequately robust and trustworthy.) Only the COG Manager is authorized to add packages to the approved list. COG procedures also stipulate that every month System Administrators should run virus-detection and other security-configuration validation utilities on the server and, on a spot-check basis, on a number of PCs. If they find a virus, they must immediately notify the agency team that handles computer security incidents.
COG is also responsible for reviewing audit logs generated by the server, identifying audit records indicative of security violations, and reporting such indications to the Incident-Handling Team. The COG Manager assigns these duties to specific members of the staff and ensures that they are implemented as intended.
The COG Manager is responsible for assessing adverse circumstances and for providing recommendations to HGA's Director. Based on these and other sources of input, the Director will determine whether the circumstances are dire enough to merit activating various sets of procedures called for in the contingency plan.
Division Contingency Planning
HGA's divisions also must develop and maintain their own contingency plans. The plans must identify critical business functions, the system resources and applications on which they depend, and the maximum acceptable periods of interruption that these functions can tolerate without significant reduction in HGA's ability to fulfill its mission. The head of each division is responsible for ensuring that the division's contingency plan and associated support activities are adequate.
For each major application used by multiple divisions, a chief of a single division must be designated as the application owner. The designated official (supported by his or her staff) is responsible for addressing that application in the contingency plan and for coordinating with other divisions that use the application.
If a division relies exclusively on computer resources maintained by COG (e.g., the LAN), it need not duplicate COG's contingency plan, but is responsible for reviewing the adequacy of that plan. If COG's plan does not adequately address the division's needs, the division must communicate its concerns to the COG Director. In either situation, the division must make known the criticality of its applications to the COG. If the division relies on computer resources or services that are not provided by COG, the division is responsible for (1) developing its own contingency plan or (2) ensuring that the contingency plans of other organizations (e.g., the WAN service provider) provide adequate protection against service disruptions.
HGA's protection against information disclosure is based on a need-to-know policy and on personnel hiring and screening practices. The need-to-know policy states that time and attendance information should be made accessible only to HGA employees and contractors whose assigned professional responsibilities require it. Such information must be protected against access from all other individuals, including other HGA employees. Appropriate hiring and screening practices can lessen the risk that an untrustworthy individual will be assigned such responsibilities.
The need-to-know policy is supported by a collection of physical, procedural, and automated safeguards, including the following:
HGA's current set of external network safeguards has only been in place for a few months. The basic approach is to tightly restrict the kinds of external network interactions that can occur by funneling all traffic to and from external networks through two interfaces that filter out unauthorized kinds of interactions. As indicated in Figure 20.1, the two interfaces are the network router and the LAN server. The only kinds of interactions that these interfaces allow are (1) e-mail and (2) data transfers from the server to the mainframe controlled by a few special applications (e.g., the time and attendance application).
Figure 20.1 shows that the network router is the only direct interface between the LAN and the Internet. The router is a dedicated special-purpose computer that translates between the protocols and addresses associated with the LAN and the Internet. Internet protocols, unlike those used on the WAN, specify that packets of information coming from or going to the Internet must carry an indicator of the kind of service that is being requested or used to process the information. This makes it possible for the router to distinguish e-mail packets from other kinds of packets--for example, those associated with a remote login request.142 The router has been configured by COG to discard all packets coming from or going to the Internet, except those associated with e-mail. COG personnel believe that the router effectively eliminates Internet-based attacks on HGA user accounts because it disallows all remote log-in sessions, even those accompanied by a legitimate password.
The LAN server enforces a similar type of restriction for dial-in access via the public-switched network. The access controls provided by the server's operating system have been configured so that during dial-in sessions, only the e-mail utility can be executed. (HGA policy, enforced by periodic checks, prohibits installation of modems on PCs, so that access must be through the LAN server.) In addition, the server's access controls have been configured so that its WAN interface device is accessible only to programs that possess a special access-control privilege. Only the System Administrator can assign this privilege to server programs, and only a handful of special-purpose applications, like the time and attendance application, have been assigned this privilege.
HGA relies on systems and components that it cannot control directly because they are owned by other organizations. HGA has developed a policy to avoid undue risk in such situations. The policy states that system components controlled and operated by organizations other than HGA may not be used to process, store, or transmit HGA information without obtaining explicit permission from the application owner and the COG Manager. Permission to use such system components may not be granted without written commitment from the controlling organization that HGA's information will be safeguarded commensurate with its value, as designated by HGA. This policy is somewhat mitigated by the fact that HGA has developed an issue-specific policy on the use of the Internet, which allows for its use for e-mail with outside organizations and access to other resources (but not for transmission of HGA's proprietary data).
The risk assessment team found that many of the risks to which HGA is exposed stem from (1) the failure of individuals to comply with established policies and procedures or (2) the use of automated mechanisms whose assurance is questionable because of the ways they have been developed, tested, implemented, used, or maintained. The team also identified specific vulnerabilities in HGA's policies and procedures for protecting against payroll fraud and errors, interruption of operations, disclosure and brokering of confidential information, and unauthorized access to data by outsiders.
Falsified Time Sheets
The primary safeguards against falsified time sheets are review and approval by supervisory personnel, who are not permitted to approve their own time and attendance data. The risk assessment has concluded that, while imperfect, these safeguards are adequate. The related requirement that a clerk and a supervisor must cooperate closely in creating time and attendance data and submitting the data to the mainframe also safeguards against other kinds of illicit manipulation of time and attendance data by clerks or supervisors acting independently.
Unauthorized Access
When a PC user enters a password to the server during I&A, the password is sent to the server by broadcasting it over the LAN "in the clear." This allows the password to be intercepted easily by any other PC connected to the LAN. In fact, so-called "password sniffer" programs that capture passwords in this way are widely available. Similarly, a malicious program planted on a PC could also intercept passwords before transmitting them to the server. An unauthorized individual who obtained the captured passwords could then run the time and attendance application in place of a clerk or supervisor. Users might also store passwords in a log-on script file.
Bogus Time and Attendance Applications
The server's access controls are probably adequate for protection against bogus time and attendance applications that run on the server. However, the server's operating system and access controls have only been in widespread use for a few years and contain a number of security-related bugs. And the server's access controls are ineffective if not properly configured, and the administration of the server's security features in the past has been notably lax.
Unauthorized Modification of Time and Attendance Data
Protection against unauthorized modification of time and attendance data requires a variety of safeguards because each system component on which the data are stored or transmitted is a potential source of vulnerabilities.
First, the time and attendance data are entered on the server by a clerk. On occasion, the clerk may begin data entry late in the afternoon, and complete it the following morning, storing it in a temporary file between the two sessions. One way to avoid unauthorized modification is to store the data on a diskette and lock it up overnight. After being entered, the data will be stored in another temporary file until reviewed and approved by a supervisor. These files, now stored on the system, must be protected against tampering. As before, the server's access controls, if reliable and properly configured, can provide such protection (as can digital signatures, as discussed later) in conjunction with proper auditing.
Second, when the Supervisor approves a batch of time and attendance data, the time and attendance application sends the data over the WAN to the mainframe. The WAN is a collection of communications equipment and special-purpose computers called "switches" that act as relays, routing information through the network from source to destination. Each switch is a potential site at which the time and attendance data may be fraudulently modified. For example, an HGA PC user might be able to intercept time and attendance data and modify the data enroute to the payroll application on the mainframe. Opportunities include tampering with incomplete time and attendance input files while stored on the server, interception and tampering during WAN transit, or tampering on arrival to the mainframe prior to processing by the payroll application.
Third, on arrival at the mainframe, the time and attendance data are held in a temporary file on the mainframe until the payroll application is run. Consequently, the mainframe's I&A and access controls must provide a critical element of protection against unauthorized modification of the data.
According to the risk assessment, the server's access controls, with prior caveats, probably provide acceptable protection against unauthorized modification of data stored on the server. The assessment concluded that a WAN-based attack involving collusion between an employee of HGA and an employee of the WAN service provider, although unlikely, should not be dismissed entirely, especially since HGA has only cursory information about the service provider's personnel security practices and no contractual authority over how it operates the WAN.
The greatest source of vulnerabilities, however, is the mainframe. Although its operating system's access controls are mature and powerful, it uses password-based I&A. This is of particular concern, because it serves a large number of federal agencies via WAN connections. A number of these agencies are known to have poor security programs. As a result, one such agency's systems could be penetrated (e.g., from the Internet) and then used in attacks on the mainframe via the WAN. In fact, time and attendance data awaiting processing on the mainframe would probably not be as attractive a target to an attacker as other kinds of data or, indeed, disabling the system, rendering it unavailable. For example, an attacker might be able to modify the employee data base so that it disbursed paychecks or pensions checks to fictitious employees. Disclosure-sensitive law enforcement databases might also be attractive targets.
The access control on the mainframe is strong and provides good protection against intruders breaking into a second application after they have broken into a first. However, previous audits have shown that the difficulties of system administration may present some opportunities for intruders to defeat access controls.
HGA's management has established procedures for ensuring the timely submission and interagency coordination of paperwork associated with personnel status changes. However, an unacceptably large number of troublesome payroll errors during the past several years has been traced to the late submission of personnel paperwork. The risk assessment documented the adequacy of HGA's safeguards, but criticized the managers for not providing sufficient incentives for compliance.
COG Contingency Planning
The risk assessment commended HGA for many aspects of COG's contingency plan, but pointed out that many COG personnel were completely unaware of the responsibilities the plan assigned to them. The assessment also noted that although HGA's policies require annual testing of contingency plans, the capability to resume HGA's computer-processing activities at another cooperating agency has never been verified and may turn out to be illusory.
Division Contingency Planning
The risk assessment reviewed a number of the application-oriented contingency plans developed by HGA's divisions (including plans related to time and attendance). Most of the plans were cursory and attempted to delegate nearly all contingency planning responsibility to COG. The assessment criticized several of these plans for failing to address potential disruptions caused by lack of access to (1) computer resources not managed by COG and (2) nonsystem resources, such as buildings, phones, and other facilities. In particular, the contingency plan encompassing the time and attendance application was criticized for not addressing disruptions caused by WAN and mainframe outages.
Virus Prevention
The risk assessment found HGA's virus-prevention policy and procedures to be sound, but noted that there was little evidence that they were being followed. In particular, no COG personnel interviewed had ever run a virus scanner on a PC on a routine basis, though several had run them during publicized virus scares. The assessment cited this as a significant risk item.
The risk assessment concluded that HGA's safeguards against accidental corruption and loss of time and attendance data were adequate, but that safeguards for some other kinds of data were not. The assessment included an informal audit of a dozen randomly chosen PCs and PC users in the agency. It concluded that many PC users store significant data on their PC's hard disks, but do not back them up. Based on anecdotes, the assessment's authors stated that there appear to have been many past incidents of loss of information stored on PC hard disks and predicted that such losses would continue.
HGA takes a conservative approach toward protecting information about its employees. Since information brokerage is more likely to be a threat to large collections of data, HGA risk assessment focused primarily, but not exclusively, on protecting the mainframe.
The risk assessment concluded that significant, avoidable information brokering vulnerabilities were present--particularly due to HGA's lack of compliance with its own policies and procedures. Time and attendance documents were typically not stored securely after hours, and few PCs containing time and attendance information were routinely locked. Worse yet, few were routinely powered down, and many were left logged into the LAN server overnight. These practices make it easy for an HGA employee wandering the halls after hours to browse or copy time and attendance information on another employee's desk, PC hard disk, or LAN server directories.
The risk assessment pointed out that information sent to or retrieved from the server is subject to eavesdropping by other PCs on the LAN. The LAN hardware transmits information by broadcasting it to all connection points on the LAN cable. Moreover, information sent to or retrieved from the server is transmitted in the clear--that is, without encryption. Given the widespread availability of LAN "sniffer" programs, LAN eavesdropping is trivial for a prospective information broker and, hence, is likely to occur.
Last, the assessment noted that HGA's employee master database is stored on the mainframe, where it might be a target for information brokering by employees of the agency that owns the mainframe. It might also be a target for information brokering, fraudulent modification, or other illicit acts by any outsider who penetrates the mainframe via another host on the WAN.
The risk assessment concurred with the general approach taken by HGA, but identified several vulnerabilities. It reiterated previous concerns about the lack of assurance associated with the server's access controls and pointed out that these play a critical role in HGA's approach. The assessment noted that the e-mail utility allows a user to include a copy of any otherwise accessible file in an outgoing mail message. If an attacker dialed in to the server and succeeded in logging in as an HGA employee, the attacker could use the mail utility to export copies of all the files accessible to that employee. In fact, copies could be mailed to any host on the Internet.
The assessment also noted that the WAN service provider may rely on microwave stations or satellites as relay points, thereby exposing HGA's information to eavesdropping. Similarly, any information, including passwords and mail messages, transmitted during a dial-in session is subject to eavesdropping.
The discussions in the following subsections were chosen to illustrate a broad sampling143 of handbook topics. Risk management and security program management themes are integral throughout, with particular emphasis given to the selection of risk-driven safeguards.
To remove the vulnerabilities related to payroll fraud, the risk assessment team recommended144 the use of stronger authentication mechanisms based on smart tokens to generate one-time passwords that cannot be used by an interloper for subsequent sessions. Such mechanisms would make it very difficult for outsiders (e.g., from the Internet) who penetrate systems on the WAN to use them to attack the mainframe. The authors noted, however, that the mainframe serves many different agencies, and HGA has no authority over the way the mainframe is configured and operated. Thus, the costs and procedural difficulties of implementing such controls would be substantial. The assessment team also recommended improving the server's administrative procedures and the speed with which security-related bug fixes distributed by the vendor are installed on the server.
After input from COG security specialists and application owners, HGA's managers accepted most of the risk assessment team's recommendations. They decided that since the residual risks from the falsification of time sheets were acceptably low, no changes in procedures were necessary. However, they judged the risks of payroll fraud due to the interceptability of LAN server passwords to be unacceptably high, and thus directed COG to investigate the costs and procedures associated with using one-time passwords for Time and Attendance Clerks and supervisor sessions on the server. Other users performing less sensitive tasks on the LAN would continue to use password-based authentication.
While the immaturity of the LAN server's access controls was judged a significant source of risk, COG was only able to identify one other PC LAN product that would be significantly better in this respect. Unfortunately, this product was considerably less friendly to users and application developers, and incompatible with other applications used by HGA. The negative impact of changing PC LAN products was judged too high for the potential incremental gain in security benefits. Consequently, HGA decided to accept the risks accompanying use of the current product, but directed COG to improve its monitoring of the server's access control configuration and its responsiveness to vendor security reports and bug fixes.
HGA concurred that risks of fraud due to unauthorized modification of time and attendance data at or in transit to the mainframe should not be accepted unless no practical solutions could be identified. After discussions with the mainframe's owning agency, HGA concluded that the owning agency was unlikely to adopt the advanced authentication techniques advocated in the risk assessment. COG, however, proposed an alternative approach that did not require a major resource commitment on the part of the mainframe owner.
The alternative approach would employ digital signatures based on public key cryptographic techniques to detect unauthorized modification of time and attendance data. The data would be digitally signed by the supervisor using a private key prior to transmission to the mainframe. When the payroll application program was run on the mainframe, it would use the corresponding public key to validate the correspondence between the time and attendance data and the signature. Any modification of the data during transmission over the WAN or while in temporary storage at the mainframe would result in a mismatch between the signature and the data. If the payroll application detected a mismatch, it would reject the data; HGA personnel would then be notified and asked to review, sign, and send the data again. If the data and signature matched, the payroll application would process the time and attendance data normally.
HGA's decision to use advanced authentication for time and attendance Clerks and Supervisors can be combined with digital signatures by using smart tokens. Smart tokens are programmable devices, so they can be loaded with private keys and instructions for computing digital signatures without burdening the user. When supervisors approve a batch of time and attendance data, the time and attendance application on the server would instruct the supervisor to insert their token in the token reader/writer device attached to the supervisors' PC. The application would then send a special "hash" (summary) of the time and attendance data to the token via the PC. The token would generate a digital signature using its embedded secret key, and then transfer the signature back to the server, again via the PC. The time and attendance application running on the server would append the signature to the data before sending the data to the mainframe and, ultimately, the payroll application.
Although this approach did not address the broader problems posed by the mainframe's I&A vulnerabilities, it does provide a reliable means of detecting time and attendance data tampering. In addition, it protects against bogus time and attendance submissions from systems connected to the WAN because individuals who lack a time and attendance supervisor's smart token will be unable to generate valid signatures. (Note, however, that the use of digital signatures does require increased administration, particularly in the area of key management.) In summary, digital signatures mitigate risks from a number of different kinds of threats.
HGA's management concluded that digitally signing time and attendance data was a practical, cost-effective way of mitigating risks, and directed COG to pursue its implementation. (They also noted that it would be useful as the agency moved to use of digital signatures in other applications.) This is an example of developing and providing a solution in an environment over which no single entity has overall authority.
After reviewing the risk assessment, HGA's management concluded that the agency's current safeguards against payroll errors and against accidental corruption and loss of time and attendance data were adequate. However, the managers also concurred with the risk assessment's conclusions about the necessity for establishing incentives for complying (and penalties for not complying) with these safeguards. They thus tasked the Director of Personnel to ensure greater compliance with paperwork-handling procedures and to provide quarterly compliance audit reports. They noted that the digital signature mechanism HGA plans to use for fraud protection can also provide protection against payroll errors due to accidental corruption.
The assessment recommended that COG institute a program of periodic internal training and awareness sessions for COG personnel having contingency plan responsibilities. The assessment urged that COG undertake a rehearsal during the next three months in which selected parts of the plan would be exercised. The rehearsal should include attempting to initiate some aspect of processing activities at one of the designated alternative sites. HGA's management agreed that additional contingency plan training was needed for COG personnel and committed itself to its first plan rehearsal within three months.
After a short investigation, HGA divisions owning applications that depend on the WAN concluded that WAN outages, although inconvenient, would not have a major impact on HGA. This is because the few time-sensitive applications that required WAN-based communication with the mainframe were originally designed to work with magnetic tape instead of the WAN, and could still operate in that mode; hence courier-delivered magnetic tapes could be used as an alternative input medium in case of a WAN outage. The divisions responsible for contingency planning for these applications agreed to incorporate into their contingency plans both descriptions of these procedures and other improvements.
With respect to mainframe outages, HGA determined that it could not easily make arrangements for a suitable alternative site. HGA also obtained and examined a copy of the mainframe facility's own contingency plan. After detailed study, including review by an outside consultant, HGA concluded that the plan had major deficiencies and posed significant risks because of HGA's reliance on it for payroll and other services. This was brought to the attention of the Director of HGA, who, in a formal memorandum to the head of the mainframe's owning agency, called for (1) a high-level interagency review of the plan by all agencies that rely on the mainframe, and (2) corrective action to remedy any deficiencies found.
HGA's management agreed to improve adherence to its virus-prevention procedures. It agreed (from the point of view of the entire agency) that information stored on PC hard disks is frequently lost. It estimated, however, that the labor hours lost as a result would amount to less than a person year--which HGA management does not consider to be unacceptable. After reviewing options for reducing this risk, HGA concluded that it would be cheaper to accept the associated loss than to commit significant resources in an attempt to avoid it. COG volunteered, however, to set up an automated program on the LAN server that e-mails backup reminders to all PC users once each quarter. In addition, COG agreed to provide regular backup services for about 5 percent of HGA's PCs; these will be chosen by HGA's management based on the information stored on their hard disks.
HGA concurred with the risk assessment's conclusions about its exposure to information-brokering risks, and adopted most of the associated recommendations.
The assessment recommended that HGA improve its security awareness training (e.g., via mandatory refresher courses) and that it institute some form of compliance audits. The training should be sure to stress the penalties for noncompliance. It also suggested installing "screen lock" software on PCs that automatically lock a PC after a specified period of idle time in which no keystrokes have been entered; unlocking the screen requires that the user enter a password or reboot the system.
The assessment recommended that HGA modify its information-handling policies so that employees would be required to store some kinds of disclosure-sensitive information only on PC local hard disks (or floppies), but not on the server. This would eliminate or reduce risks of LAN eavesdropping. It was also recommended that an activity log be installed on the server (and regularly reviewed). Moreover, it would avoid unnecessary reliance on the server's access-control features, which are of uncertain assurance. The assessment noted, however, that this strategy conflicts with the desire to store most information on the server's disks so that it is backed up routinely by COG personnel. (This could be offset by assigning responsibility for someone other than the PC owner to make backup copies.) Since the security habits of HGA's PC users have generally been poor, the assessment also recommended use of hard-disk encryption utilities to protect disclosure-sensitive information on unattended PCs from browsing by unauthorized individuals. Also, ways to encrypt information on the server's disks would be studied.
The assessment recommended that HGA conduct a thorough review of the mainframe's safeguards in these respects, and that it regularly review the mainframe audit log, using a query package, with particular attention to records that describe user accesses to HGA's employee master database.
The assessment
recommended that HGA:
As with previous risk assessment recommendations, HGA's management tasked COG to analyze the costs, benefits, and impacts of addressing the vulnerabilities identified in the risk assessment. HGA eventually adopted some of the risk assessment's recommendations, while declining others. In addition, HGA decided that its policy on handling time and attendance information needed to be clarified, strengthened, and elaborated, with the belief that implementing such a policy would help reduce risks of Internet and dial-in eavesdropping. Thus, HGA developed and issued a revised policy, stating that users are individually responsible for ensuring that they do not transmit disclosure-sensitive information outside of HGA's facilities via e-mail or other means. It also prohibited them from examining or transmitting e-mail containing such information during dial-in sessions and developed and promulgated penalties for noncompliance.
This chapter has illustrated how many of the concepts described in previous chapters might be applied in a federal agency. An integrated example concerning a Hypothetical Government Agency (HGA) has been discussed and used as the basis for examining a number of these concepts. HGA's distributed system architecture and its uses were described. The time and attendance application was considered in some detail.
For context, some national and agency-level policies were referenced. Detailed operational policies and procedures for computer systems were discussed and related to these high-level policies. HGA assets and threats were identified, and a detailed survey of selected safeguards, vulnerabilities, and risk mitigation actions were presented. The safeguards included a wide variety of procedural and automated techniques, and were used to illustrate issues of assurance, compliance, security program oversight, and inter-agency coordination.
As illustrated, effective computer security requires clear direction from upper management. Upper management must assign security responsibilities to organizational elements and individuals and must formulate or elaborate the security policies that become the foundation for the organization's security program. These policies must be based on an understanding of the organization's mission priorities and the assets and business operations necessary to fulfill them. They must also be based on a pragmatic assessment of the threats against these assets and operations. A critical element is assessment of threat likelihoods. These are most accurate when derived from historical data, but must also anticipate trends stimulated by emerging technologies.
A good security
program relies on an integrated, cost-effective collection of physical,
procedural, and automated controls. Cost-effectiveness requires
targeting these controls at the threats that pose the highest risks
while accepting other residual risks. The difficulty of applying
controls properly and in a consistent manner over time has been
the downfall of many security programs. This chapter has provided
numerous examples in which major security vulnerabilities arose
from a lack of assurance or compliance. Hence, periodic compliance
audits, examinations of the effectiveness of controls, and reassessments
of threats are essential to the success of any organization's security
to Chapter 20 | Back
to SP 800-12 Home Page || Go to Cross Reference Page
July 22, 2014
Page created: July 1, 2004


text:
There are 2 items in this category
sort by: Best Selling | Price Low-High | Price High-Low | Rating | Packages
'Fantastic product easy to put into car, looks lovely and my daughter is very comfortable in this.'
Laura B - Cambridgeshire
'We were really impressed with this product when it arrived. It arrived really quickly and in excellent...'
Claire - Castleford

subset: commoncrawl


text:
The Iroquois Nationals put up an Iroquois Locker Room Video from this Summer's World Lacrosse Championships and it's really kind of amazing! So there is a lightning delay? WHO CARES? We're going to have a good time in the locker room instead! That's the winning attitude right there!
Tag Archives | Iroquois
Lyle Thompson is Lacrosse Magazine's Person of the Year
Lacrosse Magazine, the flagship publication of US Lacrosse, has named the University at Albany senior attackman and Iroquois Nationals All-World Team member Lyle Thompson its 2014 Person of the Year.
Ty Thompson First Epoch Lacrosse Pro Stock Model
Ty Thompson is the first to be honored with a signature piece of gear from Epoch Lacrosse. The Ty Pro Stock shaft is a limited edition Dragonfly Gen.5 C30.
The Best Iroquois Nationals Documentary of 2014
If this isn't the most visually appealing, impactful and all around informative documentary focusing on the Iroquois Nationals, then I have no idea what is. U-verse does incredible work when it comes to lacrosse, they did a fantastic job with their piece on John Tavares that they did earlier in the year, I just wish […]
The History of the Two Row Wampum and Hiawatha Belt
With the popularity of the Thompson family came the rise of the modern game of lacrosse's connection to its Native roots. Tim Weston of Blue Collar Lax uses the Thompson Lacrosse i6 head and Two Row Wampum Marc Mesh to illustrate lacrosse and Haudenosaunee history!
UPDATED: Team USA Backs Out Of Bowhunter Cup
Over on the Iroquios Nationals site, IroquoisNationals.org, it is being reported that Team USA has withdrawn from the Bowhunter Cup. This is the news we didn't want to hear.
The Iroquois' 'Little War' for Independence
Winona LaDuke explains how lacrosse is a microcosm of the Iroquois Nation's fight for sovereignty. "The history of lacrosse is also the history of attempts by the Iroquois Nation—the longest-standing democracy in North America—to gain recognition under international law."
2014 FIL WLC: Nations That Impressed!
The 2014 FIL World Lacrosse Championship was the largest gathering of men's national teams ever. 38 teams played in the 2014 FIL event and we got to see a glimpse of the future right now. I'm going to run down some of the nations, and regions, that really impressed this Summer!
Strong Canada squad defeats Iroquois 12-6 for 2014 Championship birth
The Canadians have bounced back from the loss to Team USA on opening night to remain undefeated since and propelling themselves back in to the gold medal game. Thursday night in front of 7,889 fans, Canada stepped their game up in preparation for the rematch.
Social Sneak Peek – International Gear 1
Thumbing through social media sites, I've found a ton of sick international gear to show anyone who hasn't seen it. We arrive in Denver Tuesday night, so after then we won't have to turn to social media anymore for sneak peeks!
Treasures of eBay: National Pride
In honor of the 2014 World Lacrosse Championship goin' down in Denver starting on the 10th of July, we've discovered some of most patriotic lacrosse gear floating around on eBay.
Iroquois Nationals Announce 27-Man Roster for FIL World Championships
The Iroquois Nationals have released the team's 27-man roster for the upcoming FIL World Lacrosse Championships to be held in Denver, Colorado, from July 10 to July 19.
Throwback Thursday: USA Vs Canada 2010
Welcome to Throwback Thursday! In honor of the FIL World Championships kicking off on July 10th in Denver, CO we dug up a little video from the 2010 World Championships in Manchester, England, featuring the USA and Canada. Both teams read like a who's who of lacrosse, and the goals scored were insane. There's just […]
Iroquois National Team Update with Coach Cam Bomberry
Cam Bomberry, legendary player and the Director of Lacrosse for the Iroquois National Team, provides an update preparations for the FIL World Championships.
Scrimmage Photos: Cortland Vs Iroquois
NCAA D3 contender Cortland State took on the Iroquois Nationals in a preseason scrimmage for the Red Dragons and a World Games warm up/work out for the Nationals.


text:
Milan Fashion Week Live: Best of the Collections
Direct from the runway to your wardrobe, Esquire delivers the most practical, up-to-the-minute sartorial analysis of the top new designer men's wear for fall. Right now.
By The Fashion Editors
Z Zegna: The Takeaway
Remember those army green pants you've got stored away? If they're cut this nicely, you might find yourself wearing them again this fall.
Dan Lecca


text:
Extensions suitable for this stair gate are Lindam 14cm sure shut LD168W, Lindam 28cm sure shut LD168W and Lindam 7cm sure shut White
Order in the next 19 hours 14 minutes and select next working day for delivery to mainland UK on Tuesday
The Lindam Easy Fit Plus Deluxe Gate features a wider walk through and a new slim line easy to hold handle which continues to be the most superior and trusted safety gates on the market. Incorporation the Lindam 4 point U shaped pressure fit power frame for ultimate strength when in position, as well as triple opening action, double locking option. The gate is one or two way opening for maximum flexibility. Made from a strong steel construction. The gate is assembled and ready to use. Fits openings from 75cm to 82cm and extends up to 138cm with separate extensions.
The stairgates are really easy to use and feel sturdy when my little one tries to pull himself up to stand. The only downside was the boxes and the gates were very dirty and needed a clean.
Secondary lock causes gate to stick.
Needed a gate to stop our pet dog coming into the living room and getting fur everywhere but still feel like he is around us to keep things clean for when baby arrives. Its working a treat
The stair gate is easy enough to use once in place. It does require you to not have anything in your hand in order to open it. I put it with the door opening the wrong way at first and had a fight with it to put it back in place as it is hard to grip the pad to ensure it doesn't turn along with the bolt.
We already had a Lindam gate so knew it to be a good product. This stair gate is sturdy and I like the pressure fit as it means we don't need to drill into the walls! Perfect and safe product for keeping my nearly walking 9 month old - who delights in mounting the stairs at any opportunity! - safe from the dangers of gravity.
These are exclusive customer reviews unless otherwise stated. Specifications of goods are subject to change.
Click for audio and text help.
Click for audio and text help.
Click for audio and text help.
Click for audio and text help.
This product is available as a pre-order. This means that we do not currently have the item in stock but we are expecting it shortly. You can place an order for this product now your expected shipping date will be 25-12-2014
A place where people come together to discuss our products and services, ask questions and seek advice.
to be a part of it.


text:
- Advice
- Games
- Toys
- Entertainment
- School Stuff
- Sports
Star Wars KOTOR II: The Sith Lords Video Game ReviewFeb 15, 2005
The sequel to the best Star Wars video game ever is out for the PC and Xbox. Here's our Force-a-licious video game review!
Learn About Luge!Feb 16, 2005
Does sliding down an icy track at 80 miles per hour on a sled with no brakes sound like fun? Welcome to the world of luge. Check out these pictures, facts and photos on ice luge.
Dear Dish-It, Are We Going Out?Feb 15, 2005
I gave this guy a Valentine's card and he gave me one. He's really sweet. Does this mean we're going out?
Overview of OceansFeb 17, 2005
Oceans cover 70% of the Earth's surface, but how much do you know about them? Do you know why it's blue? Or why it's so salty? Get the 411 here!
Neopets Trading Card Game: Curse of Maraqua Sneak Peek 5Feb 16, 2005
It's chaos in Neopia as the Curse of Maraqua expansion set for the Neopets TCG arrives! Here's our sneak peek.
The Yu-Gi-Oh! Online Dueling Video Game is Coming!Feb 18, 2005
Want to duel against other Yu-Gi-Oh! players online? Check out this info on the Yu-Gi-Oh! Online video game!
Simon's Blog - February 15, 2005Feb 16, 2005
I had a bit of a surprise on Valentine's Day. I ran into Kara and talked to her for the first time in months.
Pioneers of Hip HopFeb 16, 2005
Some of your fave artists today wouldn't be making the music you love if it weren't for some pioneering musicians before them. Check 'em out!
The Tiger's Apprentice :: Book One Book ReviewFeb 21, 2005
An ordinary boy is suddenly thrown into a world of magic and monsters after his grandmother mysteriously dies.
Girls Living in Style Bedroom Accessories ReviewFeb 18, 2005
Does your bedroom need a serious makeover? Quit whining and just do something about it with Girls Living in Style!


text:
November 14, 2012
Angels in Need is a phenominal organization that works to help orphans and disadvantaged children in Romania and locally in North Mecklenburg, NC. The organization allows us to become angels for special needs children, which in turn affords us the opportunity to be truly blessed by those children.
More feedback
Will you volunteer or donate to this organization?
How much of an impact do you think this organization has?
When was your last experience with this nonprofit?
MY ROLE:General Member of the Public


text:
Theodore's Big FriendTalk1
this wiki
| Theodore's Big Friend/
Theodore and the Stubborn Ship
Jeff Rosen
|Previous episode
|Next episode
Theodore's Big Friend retitled Theodore and the Stubborn Ship is the fourteenth episode of the third season episode.
Theodore dreads spending the entire night next to a ship that had treated him so rudely. The tug knows that Cumberland's special engines enable him to steer without a tug's help, but that doesn't excuse the ship's silent rebuff of Theodore's greeting or his refusal to move out of the middle of the Harbour. Theodore is assigned to make sure that no one collides with the visitor in the dark. Trying to make the best of a bad situation, Theodore starts a conversation about how he misses Emily, who is away on an ocean assignment. Cumberland startles Theodore by sharing that he, too, misses a special friend. They realize that everyone, big or small, can have similar feelings. And Cumberland learns that he may not need a tugboat, but he does need a friend.
- Theodore
- Cumberland
- Hank
- Foduck
- The Dispatcher
- Northumberland
- Emily (mentioned)
- Kingston (cameo)
- Fundy (cameo)
- Phillip or Filmore (cameo)
- Henry Eben (does not speak)
- Lilly (does not speak)
- Bedford (does not speak)
- Conrad Explorer (does not speak)
- Rebecca (does not speak)
- Benjamin Bridge (does not speak)
- First and only appearance of Conrad Explorer.
- When the harbour master says "The big ship said nothing" the top of the set can be seen.


text:
Valerie's StoryFor years, I tried to find a recipe for stuffed shells and/or manicotti that included meat in the filling. So, after lots of experimenting, I came up with my own! My husband and kids beg me to make this - they say it is the best pasta dish ever!
Blue Ribbon Recipe
Notes from the Test Kitchen:
This a a terrific variation of a stuffed shells recipe. The silky cream cheese is the perfect off-set for the slightly spicy sausage. A real winner!
This a a terrific variation of a stuffed shells recipe. The silky cream cheese is the perfect off-set for the slightly spicy sausage. A real winner!
8 oz
jumbo pasta shells
24 oz jar(s)
spaghetti sauce
1 lb
hot, mild, or italian sausage
14.5 oz can(s)
petite diced tomatoes
2 Tbsp
italian seasoning
4 oz
cream cheese
2 1/2 c
mozzarella cheese, shredded
1 c
parmesan cheese, shredded
egg, beaten
Directions Step-By-Step
1Preheat oven to 350 degrees. Boil pasta according to package directions. Drain and cool on paper towel.
2Brown sausage in large skillet on medium heat. Drain fat and return skillet to stove. Ground beef may also be used. I prefer hot or Italian sausage.
3Add diced tomatoes, Italian seasoning, and cream cheese to skillet, continue cooking on medium heat until cream cheese is completely melted. (About 15-20 minutes).
4Pour contents of skillet into large mixing bowl. Add beaten egg, 2 cups mozzarella cheese, and parmesan cheese and mix thoroughly. Mixture may seem a little watery, but don't worry, it will thicken during baking.
5Spray a 9 x 13 pan with non-stick cooking spray. Spoon 3-4 tablespoons of spaghetti sauce into bottom of pan and spread around.
6Spoon meat mixture into each shell and place in pan. This recipe should make 16-18 shells. Pour remaining spaghetti sauce over the shells.
7Bake uncovered for 30 minutes. Remove from oven, spread remaining 1/2 cup mozzarella cheese on top of shells, and return to oven for last 5 minutes or until cheese is melted.
8**Note - Optional ingredients that may be added to skillet include spinach, onions, mushrooms, depending on preference.
About this Recipe
Main Ingredient: Pork
Regional Style: Italian
Collections: Member's Choice, Perfect Pastas
Dan Hammond Hambone - Oct 4, 2010
I had these last week and they were the best pasta shells I've ever had...I'm not a big fan of ravioli or stuffed pasta, but this dish with the sausage really tickled my tastebuds...excellent dish. Thanks for sharing it!
Kimberly Kay KimberlyV65 - Nov 30, 2010
Thanks for sharing this recipe! I'll give it a try soon; sounds wonderful!
Brenda Replogle Brenda48 - Nov 30, 2010
This sounds absolutely delicious!! Are you saying you can add the spinach along with the sausage? I am getting hungry just reading the recipe. Thanks for sharing!!!
cookie vigue cookev - Nov 30, 2010
sounds wonderful, but why the cream cheese?
Valerie Reeves Marin8 - Nov 30, 2010
Yes Brenda, the spinach does taste great with the sausage - almost like a pizza! And the cream cheese adds a little "tang" and creaminess to the mixture. I put cream cheese in my lasagna, also. Hope you enjoy this recipe as much as we do!


text:
Português |
English |
Ideal ResinFind out here
Águia Química is the brazilian market leader in alkyd resins and acrylic emulsions, acting in the production of resins for paints, composites, adhesives and abrasives, and also in the distribution of solvents.
Águia Química is part of Águia Participações Group, a holding company with great prestige in four segments. Learn more about the Águia Participações Group.
In addition to producing resins and emulsions, we also work in the distribution of solvents, additives, fillers and pigments. Learn more about our distribution operation.
See why we are one of the biggest manufacturers of resins of Brazil. Get to know us better by learning more about our highly modern structure.
16th Quality Award
Winner in Acrylic Resins - Paint & Pintura Magazine - 2012
Winner in Alkyd Resins - Paint & Pintura Magazine - 2012
3th Quality Award
Winner in Water-based Resins - Tintas & Vernizes Magazine 2010
All news
Águia Química - Highway PR 151 KM 116 - Jd. Eldorado - CEP 84072-190
Ponta Grossa - Paraná State - Brazil - TEL: +55(42) 3220-2699
Telesales +55 42 3220-2699
Certified Company
Developed By Agência WX
Copyright © 2011


text:
James Guyette was a director of The PrivateBank and Trust Company of Chicago, Illinois and of priceline.com Inc. and Andrew Shilston was a non-executive director of Cairn Energy PLC until his resignation on May 23, 2008. In each case, the director retained the relevant fees from serving on the boards of these companies, as shown in the table below:
External directorship fees
|Payment received
|James Guyette1,2
|Andrew Shilston
1 James Guyette was paid in US dollars translated at $1.854 = £1.
2 In addition to an annual fee, James Guyette received 1,418 Restricted Share Units in PrivateBank. During 2008, 1,000 of his stock options in PrivateBank vested at an exercise price of US$46.51 per share and 1,000 stock options vested at an exercise price of US$33.73 per share. Also during 2008, 500 shares of restricted stock vested at US$107.90 per share, 500 shares of restricted stock vested at US$115.33 per share and 500 shares of restricted vested at US$134.53 in priceline.com. He was also granted 863 shares of restricted stock at US$115.33 per share.


text:
Advanced Search
According to a new report, unit shipments of Chromebooks are likely to double this year, with the bulk of deployments happening in the United States, driven mainly by strong demand in schools, particularly elementary schools.
While many districts see personal mobile devices purely as distractions, many educators are embracing their potential as learning tools.
Samsung has debuted a new Chromebook 2 model that offers speeds of up to 2.58 GHz and sports an 11.6-inch HD display.
In this dialogue, which is the second part of their "Learnings From Singapore" series, Cathie Norris and Elliot Soloway discuss how mobile learning supports inquiry pedagogy, and how test scores are not necessarily a reflection of learning.
A National Science Foundation grant will help students in Nebraska apply engineering skills to wearable technology.
For educators looking to avoid the complications of having students work on consumer social media platforms, Common Sense Media's service Graphite has compiled this list of resources that can facilitate social learning.
Students have better wireless access to the Internet at home than at school, according to a new report.
A new version of Smart's Notebook software will let teachers move about the classroom as they change and manipulate images on whiteboards.
Students have definite opinions about what they want from education and from technology in education. In this week's blog post we review two recent surveys of students and discuss their "requests" to include more mobile technology and more coding instruction in their lessons.
Georgia's Rockdale County Public Schools has entered into a contract for tablet, laptop and desktop repairs in an effort to reduce costs and improve turnaround times.
All Webcasts
Success in a 1-to-1 environment depends on strong leaders who build a culture of innovation and collaboration. Learn the key things that you need to know for a successful 1-to-1 rollout at your school.
Read more...
All Whitepapers
If you have comments or questions about our magazine features or stories, please e-mail the editorial staff at email@example.com. If you have any comments or questions about content found on this Web site, please e-mail David Nagel at firstname.lastname@example.com. If you have any comments or questions about subscriptions, please e-mail firstname.lastname@example.com. Links to additional editorial, sales, and publishing contacts can be found here.
Contact the webmaster: [+] Site Feedback [+]
THE Journal | FETC | FETC Virtual Conference
Campus Technology | CT Summer Conference | CT Forum Conference | CT Leadership Symposium
©1994-2014 1105 Media Inc, Ed-Tech Group. See our Privacy Policy and Terms of Use


text:
There are 14 results - Show results on a map Print this page
Showing 11 - 14 of 14
Positioned close to the railway station, this family-run property has two comfortable bedrooms in the main house and four further bedrooms in the terrace which is just a short way along the street. Ho...More about Pilkington's Guest House
Originally a farmhouse, this hotel, located in the picturesque village of Warmersley on the outskirts of Ramsbottom, is just off the M66, making it ideal for business and leisure guests alike.�Bedroom...More about Red Hall Hotel
Standing in nine acres of grounds and mature gardens, this Victorian house provides comfort in elegant surroundings. The well-equipped bedrooms provide a host of extras for both the business and leisu...More about Mercure Manchester Norton Grange Hotel & Spa
This welcoming house is convenient for the M65, and provides comfortable, well-equipped bedrooms, as well as an inviting lounge with well-stocked bar. Freshly cooked dinners (by arrangement) and heart...More about The Maple Lodge


text:
Ma'agal: The Nehirim Women's Circle — 2013
Ma'agal: The Nehirim Women's Circle is a support group for Jewish LBTQ women facing questions of sexuality, gender, and religion. Each meeting is facilitated by Chani Getter, and includes sharing and discussion. Confidentiality, support, and compassionate listening are central values.
Ma'agal has been running for four years, and our meetings have been a full and heartfelt success.
Cost: Free
Where?: The JCC in Manhattan, 334 Amsterdam Avenue at 76th Street
All programs meet in the Older Adults Center on L1.
When?: Ma'agal meets the first Tuesday of each month at 7:30 pm. When a holiday conflicts, the Circle meets the following Tuesday. 2013 dates are as follows:
|January 8, 2013
|February 5, 2013
|March 5, 2013
|April 9, 2013
|May 7, 2013
|June 4, 2013
|July 2, 2013
|August 6, 2013
|September 3, 2013
|October 1, 2013
|November 5, 2013
|December 3, 2013
Questions: Email Nehirim
Chani Getter
Chani Getter, Nehirim's Director of Women's Programming, is a Motivational Speaker, Certified Holistic Life Coach, and Ritual Creator. She leads informational and support groups in parenting, single-motherhood, domestic violence, cross cultural integration, issues of sexuality, and identity. She coaches individuals and offers workshops in the areas of life-balance, self-acceptance, transition, spirituality, and living your dreams. In addition to creating spiriutal and creative ceremonies, Chani follows an eclectic spiritual path that allows her to connect to the source of life within.


text:
Definitions for refractionrɪˈfræk ʃən
This page provides all possible meanings and translations of the word refraction
Random House Webster's College Dictionary
re•frac•tionrɪˈfræk ʃən(n.)
the change of direction of a ray of light, sound, heat, or the like, in passing obliquely from one medium into another in which its wave velocity is different.
Category: Optics, Physics
the ability of the eye to refract light that enters it so as to form an image on the retina. the determining of the refractive condition of the eye.
Category: Ophthalmology
the amount, in angular measure, by which the altitude of a celestial body is increased by the refraction of its light in the earth's atmosphere.
Category: Astronomy
Origin of refraction:
1570–80; < LL refrāctiō, calque of Gk anáklasis. See refract , -tion
Princeton's WordNet
the change in direction of a propagating wave (light or sound) when passing from one medium to another
deflection, deflexion, refraction(noun)
the amount by which a propagating wave is bent
The turning or bending of any wave, such as a light or sound wave, when it passes from one medium into another of different optical density.
The degree to which a metal or compound can withstand heat
Webster Dictionary
the act of refracting, or the state of being refracted
the change in the direction of ray of light, heat, or the like, when it enters obliquely a medium of a different density from that through which it has previously moved
the change in the direction of a ray of light, and, consequently, in the apparent position of a heavenly body from which it emanates, arising from its passage through the earth's atmosphere; -- hence distinguished as atmospheric refraction, or astronomical refraction
the correction which is to be deducted from the apparent altitude of a heavenly body on account of atmospheric refraction, in order to obtain the true altitude
Refraction is the change in direction of a wave due to a change in its optical medium. Refraction is essentially a surface phenomenon. The phenomenon is mainly in governance to the law of conservation of energy and momentum. Due to change of medium, the phase velocity of the wave is changed but its frequency remains constant. This is most commonly observed when a wave passes from one medium to another at any angle other than 90° or 0°. Refraction of light is the most commonly observed phenomenon, but any type of wave can refract when it interacts with a medium, for example when sound waves pass from one medium into another or when water waves move into water of a different depth. Refraction is described by Snell's law, which states that for a given pair of media and a wave with a single frequency, the ratio of the sines of the angle of incidence θ1 and angle of refraction θ2 is equivalent to the ratio of phase velocities in the two media, or equivalently, to the opposite ratio of the indices of refraction: In general, the incident wave is partially refracted and partially reflected; the details of this behavior are described by the Fresnel equations.
The Nuttall Encyclopedia
. Light travels in straight lines; but when a ray travelling through one medium passes obliquely into another of either greater or less density it is bent at the point of incidence. This bending or breaking is called refraction. The apparent bend in a stick set sloping in a sheet of water is due to this phenomenon, as are also many mirages and other optical illusions.
Dictionary of Military and Associated Terms
The process by which the direction of a wave is changed when moving into shallow water at an angle to the bathymetric contours. The crest of the wave advancing in shallower water moves more slowly than the crest still advancing in deeper water, causing the wave crest to bend toward alignment with the underwater contours.
Anagrams of refraction
for certain
Find a translation for the refraction definition in other languages:
Select another language:
Discuss these refraction definitions with the community:
Use the citation below to add this definition to your bibliography:
"refraction." Definitions.net. STANDS4 LLC, 2014. Web. 19 Dec. 2014. <http://www.definitions.net/definition/refraction>.


text:
Everyone had been inflicted by one: a client from hell. You know the ones, they call you Friday afternoon and give massive brief changes for a project due Monday morning, or they give a vague brief then call you stupid when you ask for clarification.
Here's a site where you can, anonymously, tell the world about these menaces – Clients from Hell. It's a must read for all clients to ensure you don't become hellish.
Thanks to Brand DNA for finding the site.


text:
Psy performs at South Korean inauguration
By all accounts, the inauguration of South Korean President Park Geun-hye on Monday was a stately affair -- that is, until the rapper Psy took the stage. "I know this is a very formal event, but if you could please stand up and join me for the horse dance, it would be great," the South Korean artist told the crowd (and all we got was a lip-sync controversy?). The Guardian is characterizing the performance as a "family-friendly version" of Gangnam Style. Here's the video:
During the South Korean presidential election, Psy didn't publicly support any candidate and refused to allow the contenders to adopt Gangnam Style as their campaign anthem. But that didn't stop Park from galloping along to the hit song. As the Hollywood Reporter noted at the time of her election, the South Korean leader had "been spotted more than once doing the famous 'horse dance.'"
JUNG YEON-JE/AFP/Getty Images


text:
By Joe Haag, Mark Miller, Terence Singh, and Marie Stubbe
This month marks the end of another great year at UW-Eau Claire for the American Marketing Association—and the organization is already gearing up for next season! This year started off with the distribution of 7000 free Blu & Gold Books at UW-Eau Claire, which many students use on a daily basis for class schedule planning. The year wrapped up as it has for the past 29 years with the AMA Fun Run, which attracts students, faculty, staff, and community members from the Chippewa Valley to raise money for the Indianhead Area Special Olympics. Please take time to see a related article about this year's AMA Fun Run.
Over the past two years the Eau Claire chapter, with the help of local sponsors, has donated $6000 to Indianhead Area Special Olympics. This immense success has led to the organization taking on new challenges, such as the AMA Saves Lives campaign. The AMA Saves Lives campaign aims to create awareness about the importance of organ donation and increase the number of organ donors within communities across the country.
"Our AMA chapter alone has 152 people registered because of the AMA Saves Lives nationwide campaign. And since one donor can save 8 lives...that is 1,216 lives that we will save," said Kelli Renstrom, senior marketing major and president of the American Marketing Association.
AMA is open to students from all majors attending the university. Members enjoy the benefits of being able to network with other students as well as with local and national organizations. Membership within the organization continues to rise as a result of the dedicated board members providing guest speakers, distributing resumes, offering networking opportunities, and holding resume building workshops.
By joining AMA you will have the opportunity to become involved professionally within the community by participating in projects that will assist local businesses' marketing strategies. In doing so, students gain experiences needed upon graduation and for future careers.
AMA provides UW-Eau Claire students with unique opportunities that can't be acquired anywhere else. AMA is a great way to build a professional profile, and have fun along the way!
From left to right: Joe Haag is a senior information systems major from Ft. Worth, TX; Mark Miller is a senior management major from Osceola, WI; Terence Singh is a senior business administration major from Kuala Lumpur, Malaysia; and Marie Stubbe is a senior management major from Wausau, WI. They wrote this article for their BCOM Advanced Writing class.
» Jazz up Your Resume with an Internship
» College Life as a Nontraditional College of Business Student
» Run for a good cause with AMA
» ACHCA Begins Fall Promotional Activities
» American Marketing Association: Another Great Year
» Gender Gap Narrowing? Not As Expected
UW-Eau Claire College of Business
Schneider Hall 119 | Eau Claire, WI 54702-4004 | 715.836.6019 | FAX: 715.836.4014 | firstname.lastname@example.com
Information on these Web pages is subject to change without notice.
Content or Accessibility Questions: firstname.lastname@example.com | An EEO/AA Institution
Copyright © 1995-2011 UW-Eau Claire and the Board of Regents of the University of Wisconsin System


text:
Book your room at Apartments Nives
We are unable to search for rooms at this time. Please try again in a few minutes.
Aparthotel in Dubrovnik (Old Town) near Onofrio's Fountain
Located in the heart of Dubrovnik, this aparthotel is steps from House of Marin Drzic, Onofrio's Fountain, and Church of St. Blaise. Also nearby are Orlando's Column and Franciscan Monastery.
Property Features
Apartments Nives provides complimentary wireless Internet access and a 24-hour front desk.
Room Amenities
Guestrooms have complimentary wireless Internet access, separate bedrooms, and refrigerators; rooms also include air conditioning and hair dryers.Information missing or incorrect? Tell us!
At your hotel
At your hotel
Public areas are equipped with complimentary high-speed wireless Internet access. For a surcharge, a roundtrip airport shuttle (available on request) is offered to guests.
- 24-hour front desk
- Airport transportation (surcharge)
- Total number of rooms - 10
- Number of floors - 3
- Airport transportation
- Free Wi-Fi
- Number of buildings/towers - 2
Stay connected
Available in all rooms: Free Wi-Fi
Available in some public areas: Free Wi-Fi
In your room
- Air conditioning
- Refrigerator
- Hair dryer
- Shower only
- Television
- Rollaway/extra beds available
- Free Wi-Fi
- Cribs/infant beds (complimentary)
- Separate bedroom
The fine print for Apartments Nives
When you arrive
Check-in time starts at 2:00 PM
Check-in time ends at 11:30 PM
Special check-in instructions:
Check-in for this property is at a different location, Frana Supila Street 6. Guests must contact this property in advance to arrange check-in. Please contact the office using the information on the reservation confirmation received after booking.
When you leave
Check-out time is 11:00 AM
How you can pay
You need to know
Extra-person charges may apply and vary depending on hotel policy.
Special policies:
Government-issued photo identification and a cash deposit are required at check-in for incidental charges.
Special requests are subject to availability upon check-in and may incur additional charges. Special requests cannot be guaranteed.
Cash Deposit Required
No pets or service animals allowed
- A tax is imposed by the city: HRK 7 per person, per night. This tax does not apply to children under 11 years of age.
- Airport shuttle fee: HRK 220,00 per vehicle (one way)
We should mention
No pets and no service animals are allowed at this property.


text:
A little participation at ICPR 2008
The International Conference on Pattern Recognition finished last Thursday in Tampa, Florida. 1631 papers by 3556 authors from 47 countries were submitted of which 1006 were accepted and grouped into 74 regular and 16 poster sessions. In one of the latter, we found a work on synthetic data set generation based on a class separability measure, a little participation of the GRSI leaded by Núria Macià , Ester Bernadó-Mansilla, and Albert Orriols-Puig.
The poster session was great, many people from different places (Cuba, Italy, France, Germany, Russia, Spain, and United Kingdom) were interested in the work and provided us with helpful suggestions to improve and enlarge our framework. So, many thanks to all of them.