text:
Table of Contents
- What Is Information Security?
- Common Body of Knowledge (CBK) Definitions
- A Functional Definition of Security
- Security Web Site Favorites
- The Complexity of Hacking
- The Ten Commandments of Information Security
- Evangelizing IT Security: Why is There a Need?
- Three Reasons Why Users Won't Buy Into Security
- What Should Security Look Like?
- Eight Controversial Myths of Personal Computer Security
- Summary
- Web Application Security
- Operating System Security
- Network Security
- Hardening Your System
- Wireless Security
- Mobile Security
- Data Forensics
- Legal and Ethical Issues of Security
- Home User Security
- Overview
Additional Resources
- Job Security for the IT Security Industry
- A Biased Book Review: Chained Exploits: Advanced Hacking Attacks from Start to Finish
- Security of Mechanical Locks
- Information Security in Academics
- Holiday Security: Hackers Don't Take Holidays
- Gary McGraw on Building Secure Software
- Gary McGraw on Exploiting Online Games
- A Student-Hacker Showdown at the Collegiate Cyber Defense Competition
- The Collegiate Cyber Defense Competition Year 3: Revenge of the Red Cell
- Questions from RSA 2007
- How to Steal 80,000 Identities in One Day
Common Body of Knowledge (CBK) Definitions
Last updated May 23, 2003.
When security is viewed from an operational standpoint, it becomes obvious that there are several domains or operational categories into which security practices fall, known as the Common Body of Knowledge (CBK). Security can therefore be defined as the domains or elements that make up the CBK. In many ways, these domains could reflect the organizational departments that a large company would use to manage security-related issues. The CBK is currently the most popular method of defining security, as is reflected in many of the top security-related certifications. The Certified Information Systems Security Professional (CISSP) certification of the International Information Systems Security Certification Consortium, Inc. (known as (ISC)2) requires its candidates to understand security in the following domains:
Access Control Systems and Methodology
Telecommunications and Network Security
Security Management Practices
Applications and Systems Development Security
Security Architecture and Models
Operations Security
Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)
Law, Investigations, and Ethics
Physical Security
Access Control Systems and Methodology
"Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system." Common Body of Knowledge study guide
Access control is the part of a system used to determine what a user can access. The related concept of accountability ensures that a user's actions can be monitored. These two areas together form a system that not only keeps the authenticated user connected, with controls over what resources he or she can use, but also keeps the user accountable for his or her actions.
There are two main types of access-control methods used to define what resources a user can access:
Discretionary access control (DAC) is a subjective method, based on a decision made by an individual user. For example, when a user creates a resource such as a file, he or she can define an access control list (ACL) that regulates who can have access to the resource, and how much access they can have (read, write, delete).
Mandatory access control (MAC), on the other hand, is a standardized method of categorizing resources and users based on a predetermined set of criteria overseen by an authority figure, such as a system administrator. For example, military and government organizations have long used the levels classified, confidential, secret, etc.
While these two access-control categories provide a good starting point for defining access controls, they don't represent a comprehensive system. As a result, several other methods of access control have been built using MAC and DAC as a foundation. The following list provides some examples:
Lattice-based. Defines relationships within a MAC system by which control flows from one grouping to another based on rules.
Rule-based. Another MAC-based system using a strict set of rules similar to a "need to know" basis. However, this type of access control requires a lot of management and administrator work.
Role-based. This DAC system is based on the user's job. Using a predefined set of permissions based on job title (marketing, advertising, etc.), a user is granted access to resources without the need to individually assign rights to every specific user.
Access control list (ACL). This rule-based system defines access based on a target, such as an IP address. It's often used in firewalls and routers.
Access-control systems include two further concepts that work together: identification and authentication. In other words, it's not just who you say you are, but whether you can supply the credentials to support your identification. This is most commonly done through the use of some kind of passwordwhether that's the standard character-based password, or some form of biometrics or smart card.
InformIT Articles and Sample Chapters
"'Open Sesame' or Not? Use the Right Access Controls" is an excerpt from The CERT® Guide to System and Network Security Practices (Addison-Wesley, 2001, ISBN 020173723X), by CERT's own Julia H Allen. The book provides a comprehensive look at proper security practices. The article lists the steps to determine the right access controls.
Books and e-Books
In Writing Information Security Policies (New Riders, 2001, ISBN 157870264X), Scott Barman describes the proper procedures and methods for writing comprehensive security policies, one part of which is the definition of all access controls and the duties and responsibilities required to maintain the controls. (Preview this book on Safari)
Telecommunications and Network Security
"[The] Telecommunications and Network Security domain encompasses the structures, transmission methods, transport formats, and security measures used to provide integrity, availability, authentication, and confidentiality for transmissions over private and public communications networks and media." Common Body of Knowledge study guide
This domain is one of the largest and most technical within the CBK. It includes the Open Systems Interconnection (OSI) model that defines how networked hardware and software communicate. The OSI model's approach splits communication into seven distinct layers, each with a defined purpose, and each designed to interface with its neighboring layer(s), as shown in the following figure. For more information about the OSI model, and TCP/IP in general, see Sams Teach Yourself TCP/IP in 24 Hours (Sams, 2001, ISBN 0672320851), by Joe Casad.
Figure OSI Reference Model layers.
In addition to networking models, the Telecommunications and Network Security domain deals with the actual hardware used to connect information systems to each otherwhether that's coax cable used for 10Base-2 or 10Base-5 wiring; the more commonly known categorized cabling schemes (Cat3, Cat5, Cat6, etc.) used for most Ethernet LANs; fiber lines that use light pulses; or a wireless network. Knowing each of these types of connectors and understanding where and how they can be used is important.
Once you know the foundation of networking, you can start looking at the many types of network topologies, including the ring, tree, mesh, star, and linear. While some of these types have been phased out in recent years (ring networks, for example), new technologies are redefining existing types and creating new networking concepts. For example, with the recent development of the WLAN (wireless local area network), networking often becomes a dynamic situation as users move from one type of network to another seamlessly and without a break in communications.
The Telecommunications and Network Security domain is best known by the actual devices and technologies used to support our increasingly networked worldthe hubs, routers, switches, firewalls, and more that keep the data flowing. Degrees, certifications, and whole careers are built on understanding how these devices work together to pass a packet from one information system to another.
As a result, this domain also deals with the many safeguards and communications protocols that an administrator must employ to keep the data safe, secure, and error-free while it's in transport. This runs the gamut from the well-known Transmission Control Protocol/Internet Protocol (TCP/IP) to the encrypted IP Security Protocol (IPSec) used to secure many remote-access connections.
InformIT Articles and Sample Chapters
"Going on the Defensive: Intrusion-Detection Systems," by Seth Fogie and Cyrus Peikari, teaches you how to tighten your defenses against intrusion-detection attacks by learning about the inherent weaknesses in intrusion-detection systems. This article provide a hands-on look at IDS, and what makes such systems so important.
Books and e-Books
Sams Teach Yourself TCP/IP in 24 Hours (Sams, 2001, ISBN 0672320851), by Joe Casad, is an excellent starting place for any professional who wants to understand networks and network security, due to the integral part that TCP/IP plays in any network. The 24 Hours series is easy for the beginner to understand and can be useful as a reference guide for the experienced. Since this book is freely available at InformIT, there's no excuse not to read it!
Maximum Security, Third Edition (Sams, 2001, ISBN 0672318717), by Anonymous, is one of the icons of information security books. Within its covers, you'll find comprehensive description of network security issues from both an attacker's and a defender's point of view, plus much more. Administrators, security professionals, and even those curious about security will find a wealth of valuable demonstrations of how hackers attack, and how administrators protect information systems. (Preview this book on Safari)
Counter Hack: A Step-by-Step Guide to Computer Attacks and Effective Defenses (Prentice Hall PTR, 2001, ISBN 0130332739), by Ed Skoudis, provides an excellent general overview of network security for the beginner-to-intermediate administrator. Ed Skoudis is a recognized leader in information security and has even spoken before the U.S. Senate to educate U.S. leaders on security issues.
Hackers Beware: The Ultimate Guide to Network Security (New Riders, 2001, ISBN 0735710090), by Eric Cole, provides a wealth of tips and advice on how a network falls prey to an attack. This book not only shows you how the attacks are perpetrated, but describes how to protect your system against such attacks. (Preview this book on Safari)
Maximum Wireless Security (Sams, 2002, ISBN 0672324881), by Cyrus Peikari and Seth Fogie, delves into the security issues surrounding the setup and operation of a wireless network. This book provides hands-on illustrations of the tools and techniques used by hackers to exploit the latest in networking technology.
Security Management Practices
"Security management entails the identification of an organization's information assets and the development, documentation, and implementation of policies, standards, procedures, and guidelines that ensure confidentiality, integrity, and availability. Management tools such as data classification, risk assessment, and risk analysis are used to identify the threats, classify assets, and rate their vulnerabilities so that effective security controls can be implemented." Common Body of Knowledge study guide
This domain is the part of the CBK that defines information security policies and practices. Included in it are all the tools and concepts that a user needs to know and understand to provide a reason for security in business terms. In other words, it describes how you can know whether a firewall or intrusion-detection system is requiredor more importantly, how you can show it has real value.
Confidentiality, Integrity, Availability (CIA)
One key part of this domain that bleeds to all the others is the concept of CIAthe acronym for Confidentiality, Integrity, and Availability. These three concepts are at the core of almost every security programif not by name, at least in practice. They're most commonly described as a triangular view of security, with each side directly related to the other two (see the following figure).
Figure The CIA relationship.
Confidentiality is the measure of the secrecy of information. In other words, a company determines how and where data can be used, and then assigns a confidentiality value to it. The level of availability is the ability of users to access information. Typically this is done through the use of access-control systems as well as redundant links and servers, and considers natural threats such as fire or flood in addition to the infamous hacker. Finally, integrity ensures that the information is accurate and reliable. Whether in transmission or in storage, the data must be verified as complete and uncorrupted. Without the key aspect of integrity, it would be difficult to support any security system because there is no assurance that the data is real, and thus of value.
Much of the Security Management Practices domain defines the methods and practices used by management to determine the value and efficiency of a security system. Starting with planning, a security system must be well thought out and have widespread support. This process often starts with the creation of policies used to define the standards, guidelines, and procedures used by the company. In addition, the management of an information system should include the preparation of an initial risk analysis to determine the critical systems, the risks to those systems, and the cost associated with repairing or replacing the systems. Finally, management needs to ensure that the users are educated about the importance of security, to facilitate a security-conscious workplace.
It's crucial to include with all of this the underlying assumption that managers understand their responsibilities in the security and operation of an information systemfrom active involvement in policy creation to handling an incident or a disaster. An information system manager must have a "big picture" view with "small picture" comprehension. Whether hiring/firing, technical reports, ROI assessments, project-management skills, or another of the many jobs under the security-management umbrella, this domain provides solid insights for the type of person who makes a good manager.
InformIT Articles and Sample Chapters
CISSP Training Guide (Que, 2002, ISBN 078972801X), by Roberta Bragg, is meant to do one thing: prepare you for the CISSP test. Included in the book is a good discussion on the 10 domains of the CBK and an extensive set of practice questions. Highly recommended.
Online References
The CISSP Prep Guide, Gold Edition (Wiley, 2002), by Ronald L. Krutz and Russell Dean Vines, provides a close look at the 10 security domains defined by the CBK, with an emphasis on the CISSP test. The book also includes software and hundreds of test questions to help you practice.
CISSP Certification All In One (McGraw, 2001), by Shon Harris, offers a fairly comprehensive discussion and treatment of the 10 domains of the CBK.
Applications and Systems Development Security
"Applications and systems development security refers to the controls that are included within systems and applications software and the steps used in their development. Applications refer to agents, applets, software, databases, data warehouses, and knowledge-based systems. These applications may be used in distributed or centralized environments." Common Body of Knowledge study guide
Application development is currently one of the hottest subjects within the security sector. Buffer overflow attacks, cross-site scripting (XSS) attacks, SQL injection, and other vulnerabilities have dominated the bug tracking and vulnerability lists lately. As a result, significant pressure has recently been placed on software vendorsredefining how software development is performed, including the creation of several organizations (such as the Open Web Application Security Project, or OWASP) that deal with nothing but software security testing.
This pressure has been ongoing for a very long time. Carnegie Mellon University's Software Engineering Institute (SEI) tried to establish development maturity and capability models back in the 1980sand tried to get people to think about secure codingbut they were pretty much ignored outside of academia and a handful of hardcore software development shops.
Over the years, several types of information systems have evolved, including the centralized, distributed, data warehouse, knowledge base, and web-based systems, each of which has its own associated vulnerabilities and methods of attack. This domain covers the security components that are required when creating software, and the practices required to keep these systems secure.
There are several main components to developing secure software. They include the use of software development models that define the lifecycle by which software is planned, created, tested, corrected, and maintained. Several popular models are in use, from the waterfall to the spiral, each providing a different view of how to develop software. Regardless of the method, it should define some form of security training and testing. This includes the knowledge required to ensure that processes and hardware are isolated, memory is protected, account controls and accountability are in place, and more. In short, a developer must understand how to produce secure, stable, and efficient software that's not vulnerable to the many known methods of attack.
Additionally, the process of secure programming is very difficult due to the many third-party components used in production, very tight budgets that allocate minimal resources to training, and the extra time required to include secure coding practices. As a result, many security issues are discovered only in testing, when new code is merged with previously created code, or by the public after the software has been formally released. For example, more than 50% of the security advisories deal with some form of buffer overflow, which is a simple memory-management oversight. If developers were encouraged to write code in which all the input and output values were properly validated (including data sent to and received from connected components and programs) and memory sizes were carefully tested, buffer overflow attacks would become a thing of the past. However, on behalf of the programmers, completely securing code is a complex task due to the many interdependencies and possible inputs a user could enter, not to mention that many programs are so vast that it's difficult to know when enough testing has been done. In addition, many companies fail to implement security practices during the initial design process, if it's even considered at all. With the enormous pressure to be first to market, security gets placed on the back burner, and software is buggy at best and downright insecure at worst. (For example, Bugtraq is constantly full of buggy PHP programs written by small shops and hobbyists.) However, software companies and programmers are starting to feel a new pressure as consumers demand accountability for the products they purchase.
InformIT Articles and Sample Chapters
"SQL Server Attacks: Hacking, Cracking, and Protection Techniques," by Seth Fogie and Cyrus Peikari, takes a close look at the many risks associated with operating a database server, focusing on web applications. See firsthand how programming errors and misconfiguration can result in lost data or the complete compromise of a system.
Books and e-Books
Hack I.T.: Security Through Penetration Testing (Addison-Wesley, 2002, ISBN 0201719568), by T. J. Klevinsky, Scott Laliberte, and Ajay Gupta, is an excellent book covering many of the aspects of penetration testing and security testing of information systems. This book offers not only a glimpse into how hackers abuse applications, but how you can protect and defend yourself from attack. (Preview this book on Safari)
Online References
"Advanced SQL Injection in SQL Server Applications," by Chris Anley, is an NGSSoftware Insight Security Research (NISR) publication. This paper is a must-read for any developer using a SQL server. While it assumes prior knowledge of SQL commands, it sets the standard for understanding SQL injection attacks. NGSSoftware is one of the top security companies dealing with SQL-related attacks and has discovered numerous SQL vulnerabilities.
"Unauthenticated Remote Compromise in MS SQL Server 2000," by David Litchfield, discusses the details of the SQL Slammer worm that made headlines early in 2003 with its infection of 200,000 computers in a few hours.
"Smashing the Stack for Fun and Profit" is credited with bringing buffer-overflow attacks into the limelight. In this technical and detailed article, Phrack again provides an enlightening view into the world of the underground hacker as the concept of the buffer overflow is explained and illustrated in unparalleled detail.
"The Cryptography domain addresses the principles, means, and methods of disguising information to ensure its integrity, confidentiality, and authenticity." Common Body of Knowledge study guide
Cryptography is one of the core domains that's directly related to the CBK. Using one of several available methods, information can be encrypted and validated to ensure that it remains secure and complete, and that only authorized persons can access the encrypted data. In addition to these two functions (encryption and data validation), cryptography also helps provide non-repudiation (irrefutable proof that a message was created by a given individual) when used with an asymmetric key that can only belong to one person, which is similar to a digital signature. This adds security by ensuring that a message is not forged.
There are two main types of encryption:
Symmetric encryption uses a shared key to encrypt the data. This is the oldest and simplest form of encryption. (Manufacturers of kids' cereals use this method for their decoder rings.) While symmetric encryption is easy to use, many implementations are easy to crack. In addition, because the key is shared with everyone who needs access to the data, there's no method of ensuring non-repudiation.
Asymmetric encryption requires the use of two keys: a public key and a corresponding private key. When a message needs to be encrypted, the public key of the recipient is used to encrypt the data. Once this occurs, the only key that will decipher the message is the private key, which only the recipient holds. This method, though a bit more complicated, is much more secure and also maintains non-repudiation because only one person has the private key.
Regardless of the encryption method you choose, you should understand several encryption properties before attempting to use encryption:
Key length is one of the core aspects that define the strength of the encryption.
Redundancy checks ensure data integrity.
Hash functions take a large amount of data and create a small fingerprint based on that data.
Digital signatures are used for authenticating the source of a message and for non-repudiation.
Encryption is one of the core parts of any secure information system. However, encryption is not technically 100% secure; in other words, all encryption is breakable. While breaking it might take years, if not centuries (with current technologies, until after the universe is expected to collapse), encryption techniques can be subverted using many methods of attack. Attacks using brute force guessing, known and chosen plaintext, and more can be used to deduce the key of the encryption scheme. Ironically, the ease with which encryption is used appears to be inversely proportional to how breakable it is. One-time pads (encryption algorithms that use enormous keys only once) are theoretically unbreakable but are such a pain to use that they have been compromised in practice by users who have "cut corners" with them.
In fact, one recent well-publicized attack against the WEP protection used in wireless networks allowed an attacker to capture the pre-shared password right out of the air.
In addition to attacking the encryption scheme, it's also possible to attack the implementation structure of an encryption scheme. For example, if an attacker sets up an SSL server between the target and an online company, he or she could trick the target into thinking that a secure connection was established to the online company, when in reality the connection was established to the attacker's computer. (This is known as a "man in the middle" attack.) This would allow the attacker to have access to all the data in transmission, with the target and the online company none the wiser.
Cryptography is an important asset to any secure system; however, as we've indicated, the security provided by cryptography relies on several factors. As a result, it's often implemented incorrectly. In addition, many people fail to realize that once a piece of data is encrypted, the only way it can be accessed is with the correct password, decryption device, or decryption algorithm. If the decryption method is lost, damaged, or forgotten, the data will remain safely locked away until computing has advanced to the point where the encryption can be cracked.
InformIT Articles and Sample Chapters
"Cracking WEP," by Seth Fogie, describes an excellent example of cryptography gone wrong. While it's technical, this article breaks the encryption process down so the reader can understand the weaknesses within the WEP protection scheme.
Books and e-Books
Java Cryptography (O'Reilly, 1998), by Jonathan Knudsen, describes how Cryptography is implemented in technology. While this book discusses Cryptography in reference to Java, the principles it discusses are standard for information system security. (Preview this book on Safari)
Making, Breaking Codes: Introduction to Cryptology (Prentice Hall, 2000, ISBN 0130303690), by Paul Garrett, is one of the top-selling books in the field. While it assumes some math experience, this book attempts to illustrate cryptology to any reader interested in the subject.
Security Architecture and Models
"The Security Architecture and Models domain contains the concepts, principles, structures, and standards used to design, implement, monitor, and secure operating systems, equipment, networks, applications, and those controls used to enforce various levels of confidentiality, integrity, and availability." Common Body of Knowledge study guide
What is a security architecture? Is it
products that keep out attackers?
practices and policies that control a company's employees?
a concept used to create confidence in a service or product?
The real answer is all of the above, which is why an entire domain of the CBK is devoted to this subject.
Several architectures are used to define how information is secured:
The Bell-laPadula model basically defines security through confidentiality. Designed using the no write down, no read up model, security is maintained if a classified resource is accessed only by subjects with a clearance at that level or higher. This method works, but it relies on the assurance that access to the object is closely controlled.
The Biba model focuses on integrity more than confidentiality. This model is built around two rulesno write up and no read downwhich refer to the trust relationships that exist between subjects and objects. In short, no subject can depend on a less-trusted object, which restricts an unauthorized subject from changing or even accessing an object.
The Clark-Wilson model emphasizes data integrity by restricting unauthorized access or improper modifications by authorized users, and by maintaining internal and external consistency. This model is most often used to ensure that data modifications are made with their integrity and consistency in mind. For example, if a computer crashes in the middle of a data change, the whole system should have the ability to role back to a pre-transition state, thus ensuring that nothing has changed.
The most common model is based on the access control list (ACL), which is prevalent in most enterprise operating systems. This model uses a preexisting list of approved subjects, associated with objects. If a user wants access to a folder or file, the user's identification is checked against the ACL for that resource, and access is granted as appropriate. While this works well, it can become complicated when making large changes or moving data from one system to another.
In addition to models, this domain also defines components of secure system architectures, including reference monitors, covert data channels, open versus closed systems, and various security principles and modes. Using combinations of these components, principles, and modes, a solid architecture can be designed and implemented that ensures the security of a company's data.
When a security system is designed, it should be evaluated using some form of security standard. The most common and well-known standards are described in the following list:
Trusted Computer System Evaluation Criteria (TCSEC). TCSEC is more commonly known as the orange book, which is part of the famous Rainbow series. It's a U.S. government-founded security standard that critiques a system by its ability to separate users and data, the granularity of access control, and the trust or overall assurance of the system. Using these concepts, it then assigns a grade to the system.
Information Technology Security Evaluation Criteria (ITSEC). This European standard focuses on loss of integrity, confidentiality, and availability. It's similar to TCSEC in many ways, with slight variations on how systems are evaluated and what's included in the evaluation.
Common Criteria. This system evaluates products by version/environment and is not guaranteed against vulnerabilities. That said, this standard is replacing ITSEC and TCSEC as an internationally agreed-upon method of evaluation. It's divided into three main parts: Introduction and General Model, Security Functional Requirements, and Security Assurance. These all work together to critique a system and give it a grade or certification based on how it meets predefined requirements.
One final standard that's growing in popularity is IP Security Protocol (IPSec), which is a communications standard found in firewalls, VPNs, and other communication devices/software. It controls what data can flow and how that data is transmitted, using a two-phase connection initialization process.
Security models and architecture should be at the foundation of how an information system is designed. Through the use of these concepts, a company can build a strong and reliable system that they can be confident using. However, it should be noted that no information system is 100% secure.
InformIT Articles and Sample Chapters
"IPSec Overview Part One - General IPSec Standards," by Andrew Mason, is one of several articles provided to InformIT by Cisco Press, which is one of the leaders of the technology industry. While this article deals mainly with Cisco hardware, the information presented is valuable to any professional who wants to understand what IPSec is used for and how it works.
Books and e-Books
Designing Network Security (Cisco Press, 1999, ISBN 1578700434), by Merike Kaeo, offers a practical approach to designing and implementing a secure network. From Cisco routers to a secure policy, setting up a secure architecture is a complex subject; this book helps to fill the gaps and provides good ideas on meeting this goal. (Preview this book on Safari)
Online References
Security Architecture for the Internet Protocol (RFC 2401) is the standard defining the IPSec protocol, security services offered by this protocol, and how these protocols are employed.
Operations Security
"Operations Security is used to identify the controls over hardware, media, and the operators with access privileges to any of these resources. Audit and monitoring is the mechanisms, tools, and facilities that permit the identification of security events and subsequent actions to identify the key elements and report the pertinent information to the appropriate individual, group, or process." Common Body of Knowledge study guide
Operations security (OPSEC) is the practice of putting yourself in your opponent's shoes, and then building a defensive system based on what you discover. The first step is to determine what resources you want to protect. This includes all hardware devices (routers, switches, printers, etc.), software applications, and, most importantly, the users. The second step is to identify the privileges that need to be restricted, and the third step is to identify the available controls that can prevent misuse and abuse of the allotted privileges.
The operations security process takes into consideration the following five key principles:
- Identifying critical information
- Analyzing threats
- Assessing vulnerabilities
- Assessing risks
- Applying countermeasures
To apply these principles, operations security uses indicators collected via log files, auditing, and other forms of monitoring and observation. (In fact, these same indicators are often used by attackers to gain an insight into a potential target.)
While logs are an excellent source of information, another popular method of information-gathering is through the use of intrusion-detection programs. These are devices that sit on a network and monitor all the traffic, looking for anomalies. Using sniffer technology, an administrator can detect potentially threatening activities and take action.
A sniffer is a program that captures network data. It can be used by network or system administrators to help troubleshoot problems. Used by an attacker, a sniffer can collect sensitive information (such as passwords) that can be used to gain unauthorized access.
Another tool is penetration testing. This involves playing attacker and attempting to find a way into your own system. Once a penetration test is complete, the information collected is assessed for potential risks, and countermeasures are put in place. The whole process then starts over again, with new policies and more testing.
In addition to the more hands-on and hackerish processes, operations security also includes proper administrative and management processes that define how employees are hired/fired, how a system is safeguarded against internal attack, and how a successful attack is handled. This includes protecting sensitive media, and ensuring that simple measures such as antivirus software are installed on all the key systems. It also includes the procedures used to update system parameters and configurations, and even covers disaster recovery plans. In short, this part of operations security is responsible for creating a comprehensive system to handle both day-to-day and emergency operations as required in the information security world.
While much of OPSEC consists of the fun and exciting cyber war games often associated with information security, it's actually a complete package that covers every operational process, from the first employee hire to a total natural disaster.
InformIT Articles and Sample Chapters
"Implementing Security, Part II: Hardening Your UNIX/Linux Servers," by Joseph Dries, describes several methods for securing your *nix system and the applications that run on it. In particular, this article looks at Internet services, sendmail, tcp_wrappers, DNS services, and proper logging techniques.
In "Intrusion Detection Systems," an article provided by Cisco Press, Earl Carter discusses intrusion-detection systems and their role in the daily operations of a business. The author covers the triggering mechanisms, monitoring methods, and types of intrusion-detection systems available to information system professionals.
Books and e-Books
Hack I.T.: Security Through Penetration Testing (Addison-Wesley, 2002, ISBN 0201719568), by T. J. Klevinsky, Scott Laliberte, and Ajay Gupta, is an excellent book covering many of the aspects of penetration testing and security testing of information systems. This book offers not only a glimpse into how hackers abuse applications, but how you can protect and defend yourself from attack. (Preview this book on Safari)
Halting the Hacker: A Practical Guide to Computer Security (Prentice Hall, 2002, ISBN 0130464163), by Donald L. Pipkin, combines unique insight into the mind of the hacker with practical, step-by-step countermeasures for protecting any HP-UX, Linux, or UNIX system. With dozens of real-world examples, you can learn how to protect yourself against many of the attacks of todayand tomorrow. (Preview this book on Safari)
Maximum Windows 2000 Security (Sams, 2001, ISBN 0672319659), by Anonymous, is designed for system administrators who need an in-depth look at the tools and techniques used by hackers to gain unauthorized access to information systems. This book also provides information on finding holes and vulnerabilities, and discusses how to fix them. (Preview this book on Safari)
Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)
"The Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) domain addresses the preservation of the business in the face of major disruptions to normal business operations. BCP and DRP involve the preparation, testing, and updating of specific actions to protect critical business processes from the effect of major system and network failures." Common Body of Knowledge study guide
When a natural disaster strikes a home, recovery is a lifelong process. Photo albums, important documentation, heirlooms, and more can be destroyed. It can take years before the loss is even fully realized. While this is a horrible thing, imagine the loss that can occur when a business is hit with the same type of disaster. The entire company's resources could be gone in the blink of an eye. How a company prepares for this type of calamity helps determine whether it survives.
The first step in recovering from such a calamity is having a disaster recovery plan. This plan takes a look at what's required to keep the business functioning (backups, contact numbers, etc.), and then takes steps to ensure that these items are prepared ahead of time in case a disaster occurs. The disaster recovery plan also includes the procedures required to get necessary data back online and available to those who need it. While this could include switching all data processing to a remote backup site, for example, or just defining what procedures need to occur to alert clients to changes in scheduled meetings, the disaster recovery plan is the short-term plan.
The business continuity plan, on the other hand, is the long-term plan that takes a look at recovery from beginning to end. Typically, the business continuity plan incorporates the disaster recovery plan, but then takes over once immediate threats are dealt with. This plan includes keeping recovery plans up to date, monitoring critical assets, procedures for processing insurance claims, and more.
A key part of the business continuity plan is the business impact assessment (BIA). The BIA identifies time-critical components of the business, key resources used by the business, maximum downtime (MDT) that any business component can withstand, and all associated reports created as a result of the BIA.
While having a plan is a very important step, many companies stop after that point. Unfortunately, when disaster strikes, these companies find out that their plan is missing parts, and doesn't work as expected. To eliminate some of the surprises, the disaster recovery plan and business continuity plan should be tested to ensure that they work. This includes everything from restoring the entire information system to testing emergency evacuation procedures.
Obviously, a disaster that can destroy a whole business is not a likely event. However, as of 9/11, many more companies are realizing that their business is one step away from a calamity. Having a disaster recovery plan and a business continuity plan in place won't prevent a disaster from occurring; however, it can reduce the damage in the long run.
InformIT Articles and Sample Chapters
This sample chapter from Disaster Recovery Planning: Preparing For The Unthinkable (Prentice Hall PTR, 2002, ISBN 0130462829), by Jon Toigo, gives the reader a look into the methods and procedures required to design and implement a comprehensive disaster recovery plan. This chapter alone is enough to serve as an eye opener for many IT managers and professionals who could face a total loss if disaster strikes.
"Secure Backup: Protecting Your Data" is a sample chapter from White-Hat Security Arsenal: Tackling the Threats (Addison-Wesley, 2001, ISBN 0201711141), by Aviel D. Rubin. In this chapter, the author discusses the issues surrounding a backup with respect to security and privacy. He looks at physical security issues, methods of secure backups, storage procedures, and even deletion issues to ensure that your backups are secure.
Books and e-Books
While primarily for Sun administrators, Backup and Restore Practices for Sun Enterprise Servers (Prentice Hall PTR, 2000, ISBN 013089401X), by Stan Stringfellow and Miroslav Klivansky, provides valuable information for any information system professional. Over half the book is devoted to practices and planning techniques that can be used with Sun, Microsoft, or even Macintosh operating systems. The book addresses issues such as scalability and performance of the backup/restore architecture, criteria for selecting tools and technologies, and tradeoffs that must be considered. It provides technical guidelines for planning the architecture to meet service levels, as well as general advice and guidance. (Preview this book on Safari)
Law, Investigations, and Ethics
"The Law, Investigations, and Ethics domain addresses computer crime laws and regulations, the investigative measures and techniques [that] can be used to determine if a crime has been committed, methods to gather evidence if it has, as well as the ethical issues and code of conduct for the security professional." Common Body of Knowledge study guide
Computers have had an undeniable positive impact on this world. However, the benefits of information systems come with a price: computer crime. Using computers, criminals can access private information, destroy data, steal intellectual property, and more. When these situations occur, it's up to the owner of the system to properly report the crime and ensure that no evidence is destroyed or lost. Unfortunately, the law is often considered a complex body of obscure rules that only lawyers can understand. In addition, the stigma of legal authorities and their overall unpopularity may make users uncomfortable with the prospect of reporting a criminal incident. Others are concerned with the unwanted publicity that might be associated with a public computer crime case. Regardless of what fears or issues a user has, however, every information-systems professional should be familiar with certain techniques and practices to ensure that evidence is not damaged or lost in the case of an intrusion.
Before any crime is investigated, it's important to understand the applicable law(s). This includes knowing the type of crime involved, and under whose jurisdiction the crime falls. For example, a simple web-page defacement many be both a federal and state crime if the attacker lives across a state line from the victim. In addition, the laws vary depending on who is pressing charges. If the government is seeking retribution, criminal law prevails. On the other hand, if a company is suing for damages as a result of a malicious act by an employee, that falls under civil law. Each of these areas has its own regulations and guidelines.
Once the crime has been identified, the victim should not simply take action and try to catch the attacker. By doing so, the victim could corrupt or destroy key evidence that could have been used to prove guilt. Instead, a plan should be formulated to specify who needs to be called and what actions should be taken (such as how critical data should be preserved).
Part of the key to collecting evidence is found in forensics, which is the technical and scientific collection and analysis of evidence. For example, one of the first steps in the investigation of a computer crime is to make a duplicate of all data on a victim's or suspect's hard drive. This way, authorities maintain an untouched copy of evidence while they systematically look at the data on the hard drive. If they damage the data, they still have the original information.
The best thing to do when you become the victim of an attack is to call the local authorities. While the concept of computer crime is still new, many police forces have a trained staff member, or at least can put you in contact with someone who can provide you with proper advice.
InformIT Articles and Sample Chapters
In "What to Do After the Break-in: Preparing an Incident Report for Law Enforcement," Kyle Cassidy walks you through the steps to take to ensure your best chance of a successful case. In short, this article discusses what to do when an intrusion is detected, how to contact authorities, and how to stay involved with local law-enforcement groups.
"The Art and Practice of Testifying as an Expert Technical Witness" is a sample chapter from A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony As An Expert Technical Witness (Addison-Wesley, 2002, ISBN 0201752794), by Fred Chris Smith and Rebecca Gurley Bace. In this chapter, the author provides a look at the importance of serving as a witness. Using Bill Gates' testimony as an example, this chapter illustrates what to do and what not to do when in court.
Books and e-Books
Protect Your Digital Privacy! Survival Skills for the Information Age (Que, 2001, ISBN 0789726041), by Glee Harrah Cady and Pat McGregor, provides a clear discussion of legal issues surrounding the use of digital devices. Focused on the user's legal rights, this book includes a complete section on laws as they apply to privacy and what that means in today's world. (Preview this book on Safari)
Incident Response: A Strategic Guide to Handling System and Network Security Breaches (New Riders, 2001, ISBN 1578702569), by Eugene E. Schultz and Russell Shumway, provides a look at what to do when information system security is breached. From the legal responsibilities of the business to the forensics involved in collecting evidence, this book gives you the information you need to build an effective incident-response strategy. (Preview this book on Safari)
Physical Security
"The Physical Security domain addresses threats, vulnerabilities, and countermeasures that can be utilized to physically protect an enterprise's resources and sensitive information. These resources include people; the facility in which they work; and the data, equipment, support systems, media, and supplies they utilize." Common Body of Knowledge study guide
Too often, information systems are protected only from remote attackers. In other words, a company feels safe if it installs a firewall and intrusion-detection system, and monitors the log files of local network users. What administrators often forget is that an information system is a physical device that can be accessed directlywithout a computer or network connection. This is where physical security policies come into play.
In many ways, physical security is very similar to information security. You have to assess the items that need protection, determine how they can be accessed, create protections and controls for these access methods, and then enforce and audit users as they operate the devices.
There are five main assets that need protection:
Supporting infrastructure (power, water, etc.)
Physical hardware
Supplies and consumables
Each of these items has its own set of threatssome global (such as fire) and some related directly to the asset (such as theft). Using these threats as a guideline, a physical site should be selected and built according to a proper design.
There are many parts to a secure site. These include the actual location that should be free of natural threats such as floods, fire, hurricanes, and so on (to the extent possible for a given geographic location). In addition, it's best to choose a location that is set apart from a violent community, where theft or rioting could impact security. Building type, age, location, size, material, and door/window count are also important. Each offers its own risk to the security equation, and must be addressed to ensure maximum threat reduction (for example, more doors equal more locks that have to be checked). The supporting infrastructure must be augmented with uninterruptible power supplies, fire extinguishers, air conditioning, and more as required to minimize assessed risks.
Once the basic structure is selected, the proper controls need to be installed. These include identification screening using swipe cards, pin numbers, biometrics, or a human guard (to name a few options). In addition, proper controls must be placed on all components that leave a site. More than one business has fallen prey to attack as a result of what an attacker found in a trash can. Finally, a site should have some form of physical intrusion-detection to keep dishonest people from having direct access to the information-system hardware or supporting equipment. Unfortunately, even with all the proper precautions and controls in place, a site's physical security can never be 100% guaranteedthink about natural disaster or a corrupt system administrator.
A major consideration in deploying physical security mechanisms is user acceptance of those measures. If the people won't go along with it, it's not going to work.
InformIT Articles and Sample Chapters
In "Security Issues and Solutions Part 4: Physical Security and Auditing," Mark Walla and Robert Williams provide a good overview of the many aspects of physical security. From backup security to prevention of physical access to core systems, this article chapter provides many informative tips.
The sample chapter "Physical Security" from Sams Teach Yourself Linux Security Basics in 24 Hours (Sams, 2001, ISBN 0672320916), by Aron Hsiao, discusses the realm of security that lies outsides the direct control of the information system. It provides a look at why physical security is important, the importance of location, auditing, and more.
Books and e-Books
Designing Network Security (Cisco Press, 1999, ISBN 1578700434), by Merike Kaeo, offers a practical approach to the implementation of secure network design. While not dedicated to the sole subject of physical security, this book does include a section that discusses physical security issues and how to implement them. (Preview this book on Safari)
Summary of CBK Definitions
This short overview of information security as defined by the CBK is only the beginning of the subject. Many books are available that go much deeper into the domain method of defining security, but even these barely scratch the surface. You can find book upon book relating to other aspects of securitywireless networking (part of the telecommunication domain), proper program procedures (part of the application domain), and so on.
Many certifications also test the professional's level of knowledge. The most popular security certification, the CISSP, focuses on the CBK and tests the professional's level of understanding of information security. Another popular certification is the Global Information Assurance Certification (GIAC), which is backed by SANS and is recognized as one of the more prestigious training organizations in the infosec community.
However, there are other methods of defining security, which brings us to the next section of this overview.


text:
Australian Power of Attorney Kit
This pack includes:
- 1 x Power of Attorney Kit
- Includes all forms for yourself.
- Bonus forms also included for a partner.
- (bonus forms can be used by anyone if you do not have a partner)
- Click image below for more information
Showing 1 to 1 of 1 (1 Pages)

subset: commoncrawl


text:
When trying to get friends to like Bowie, Earthling always seems an obvious choice for its contemporary sound and wow factor. As untrue as it is, I really think that the general public feeling of Bowie is an ageing pop star from the 70s and 80s. I don't really think people acknowledge his post NLMD stuff much at all. In attempt to destroy this image I either pop on the BOB DVD, Disk 2, and play some 90s promos to them, or bang in the Outside or Earthling album, to see their reactions. I tried it on a friend recently, who is into hip hop, I put on Earthling, and to my surprise he asked "is this Moby?". How far off the mark can you get, but the point is, he was shocked when I said it was David Bowie. If you think about it, lets say you were a casual fan and lost touch with him since the Tonight era or whatever, then you hear Earthling. It would be pretty shocking.So to give this thread a purpose, how about posting any remarks off friends or relatives about Earthling, particularly to people who are into pop music of today and are fairly unfamiliar with contemporary Bowie.So far I have had:- "Wow. THAT is David Bowie?", "i thought he was well older than that, how old is he? 30 something?", "is this Moby?" and "wow, this is amazing! Imagine how well this would go down at a party" (when playing Little Wonder).Another positive thing I reckon, is I brought Earthling into the sixth-form common room around summer 2004, and most people were really buzzing off it and getting into it. They also thought it wasnew, which kind of puts a sock in the mouths of people who think the album isn't ageing very well, since the people who said these positive remarks about the album, are around 17/18 and are the same people who are constantly in touch with chart music and buying all the tripe that infests the charts these days.__________________________________________ www.mikepowell.cjb.netGet out of my mind! All of you!!
In reply to:I don't really think people acknowledge his post NLMD stuff much at all.
I don't really think people acknowledge his post NLMD stuff much at all.
Tell us something we don't know.But I had a similar experience with Earthling - played it to a colleague who's much into dance music and he really loved the production and was surprised that this album came from the same guy, who sings (sigh) China Girl.Earthling is timeless.Coin-Operated Boy
I remember a bit after it came out and I was a tween, I met this guitar player (my age) and we were chatting about music and he mentioned that there was a new Bowie album he had that was "Techno, and actually really good". Bowie is actually really well respected among most of the people I know, even if not many people really know who he is, which I suppose is a good sign.
It's not one of my favorites, but it is pretty helpful to get people into Bowie. Though I don't like it much for the most part, I admit it sounds very fresh.Bring back Bowie's moustache!
My best mate is mainly into metal, but also some drum and bass and dance. His favourite band is Nine Inch Nails. He told me he was surprised to learn of the overlap between the two for which I filled him in on the details. He also said he didn't really like Bowie's early stuff but recalls hearing 'Little Wonder' back in the day and really liked it. I then leant him Earthling, 1.Outside and a single with the video of 'I'm Afraid Of Americans' which he liked a lot. So this is a case of someone who is only really familiar and likes the contemporary Bowie.On another occasion I was watching Top Of The Pops to catch Bowie's 'Slow Burn' performance. My female flat mate commented that he was about 30 years older than the also-appearing Ronan Keating, but looked far better!Conversely I was watching BOB DVD when my other female flat mate (a real girly-girl into crappy pop) began to 'dig' the Never Let Me Down songs. Oh the humanity!Its about time I had a signature
You are in a real 'man about the house' situation aren't you?I haven't got a signature at the moment.
Most likely because NLMD is crappy pop.__________________________________________ www.mikepowell.cjb.netGet out of my mind! All of you!!
My father,who is a casual bowie fan,own's a few records from the 70's and the 80's, had no idea that bowie has even made music after 'dancing in the street'. I played to him 'slow burn'-and he really loved it. And he loved it even more when i said that Pete Townsend played guitar on it(as he is a ''the who''-fan). The once i plaid 1.outside to my dad, and let's just say, i think it went over his head (although my dad is 11 year's younger then bowie, i have to say that my father is too old for that sort of music)I've often played music from 'earthling' to my friend's also, and ,more often then not they've really loved it (especially the single version of '' i'm afraid of the americans''.)
My husband is not much a of a Bowie fan. Actually, he'd probably call himself a "mild fan" if I weren't such a rabid fan, so he kinda pretends to hate Bowie. He actually likes some of Bowie's 90s stuff more than he does early 70s (he actually dislikes the whole Ziggy era, blasphemy!). As for Earthling, he only likes I'm Afraid of Americans, sadly. While listening to the album one day, his comment was "Bowie is trying too hard to seem relevant." **sigh** zigbot
In reply to: While listening to the album one day, his comment was "Bowie is trying too hard to seem relevant." **sigh**
While listening to the album one day, his comment was "Bowie is trying too hard to seem relevant." **sigh**
I've heard this said quite a few times, and it really annoys me. Bowie has always mixed high and low art, the popular with the underground. THat's why he is so repected and admired. If he does this today however he is seen to be 'trying to hard' or 'trying to get in with the 'kids''.This is why the Earthling album was slated so much when it was released...Bowie Does Drum & Bass etc..... Earthling is not a D&B record. It merely utilises aspects of D&B as a songwriting tool - much in the same why YA uses soul music, Low uses electronic, Kraftwerk inspired soundscapes and Lets Dance uses 80's dance/soul.iccyThe Bowie Contingent 16th June 2005 @ The Grapes, Sheffield, UK10th/11th June 2005 @ TW Meetup, London UK


text:
Faith Calendar: April 25, 2013
caines | 4/25/2013, 5:30 a.m.
New Jerusalem Primitive Baptist Church will hold a prophetic summit on April 24-26 starting at 7p.m. Call 561-667-5602. World Deliverance Church will host its annual women's conference on April 25-27 at 8p.m. Call 786-409-6915. New Corinth Missionary Baptist Church started their celebration of their 41st pastoral anniversary on April 14. There will be services held at 7:30p.m. It will end on April 28 at 3p.m. Allen Chapel A.M.E. Church will celebrate its Annual Unity Day on April 28 at 10a.m. The messenger will be Rev. Wendell Paris. Call 305-754-9055. St. Matthews Community Church will hold a Community Re-entry Fair on April 29 at 9a.m.-2p.m. It will be conducted by The Prisoner Re-Entry Support Program. Call 954-296-9696. Friendship Missionary Baptist Church will host its 2nd Annual Prison Ministry Seminar and Volunteer Certification Training on May 3 at 4p.m.-7p.m. and May 4 at 8a.m.-4p.m. Call 305-759-8875. n The Living Word Christian Center International will host a family fun day on May 4 from 2p.m.- 6p.m. at Miami Carol City Park. Call 305-624-0044. The Bethel Church will celebrate its 62nd Anniversary on May 5th at 9a.m. The guest speaker will be Bishop Derek Triplett, pastor of Hope Fellowship Church in Daytona Beach. Sweet Home Missionary Baptist Church will hold a Christian entertainment comedy showcase, featuring Lina Michelle Davis on May 10. Call 786-663-3997. Second Canaan Missionary Baptist Church will host their 19th pastoral anniversary on May 18 at 6p.m. Call 954-296-1867. Second Chance Ministries to host a Bible study meeting. Call 305-747-8495. A Mission With A New Beginning Church Womens Department provides community feeding. Call 786-371-3779. Bethany Seventh Day Adventist Church will host a bereavement sharing group at 3 p.m.-4:30p.m. every 2nd Sunday. Call 305-634-2993.


text:
Are you a big breasted woman who is seeking friendship,dating,love and marriage? Or are you an admirer of big breasted women who is eagering to date busty women and have a serious relationship with them?
Datingbigboobgirls.com is the right online dating site for big boob girls and busty admirers. We have the largest big breast singles & busty admires available and they are waiting for you. Here, you will find your big breasted soul mate in the shortest time.
Take a few minutes to create your unique profile to connect with large breasted women, busty women or large breasted admirers.


text:
You are a fan of picture buat ? Come to discover the best forums picture buat on the internet and share your experience with a community fan of picture buat . You can also build a forum picture buat and create your online discussion.
Height Weight net worth is a blog which allow you to know the height and Weight , body size and Measurement , net worth of all famous : Singer , Tv actors and Actress , Movie Actor and Actress , Playe
height, weight, worth, 2016, body, size, measurement, famous, singer, actors, actress, movie, actor, player, #picture, celebrities, music, film, celebrity
We specialize in creating unique, and elegant looking layouts. We also crate DP's We offer customs, premades, and many more! It's all about YOU!
imvu, speed, edit, free, layout, layouts, make, classes, avatar, profile, #picture, home


text:
Rowing To Host Junior Day
Feb. 4, 2014
The San Diego State rowing team is set to host Junior Day for those interested in the program. The day is set for Saturday, Feb. 8 from 3:30-6:30 p.m. The event will mark an opportunity for rowers that will graduate in 2015 to meet the coaches, athletic department support staff and explore the SDSU campus.
The 2014 season marks the first spring season for head coach Bill Zack and assistants Daniel Duxbury and Heather Crichton. The trio will usher in a new era for Aztec rowing as the program will be a first-year member of Conference USA.
Rowers and their parents interested in the Aztec program should contact coach Duxbury (firstname.lastname@example.com) and see the Junior Day flier for more information.
The first official race of this year's slate is set for March 8 against UCLA at 9 a.m. in Marina Del Rey, Calif.


text:
PORTSMOUTH — A 30-year-old Hampton man was arrested earlier this week after police say he passed out in a downtown flower bed and then began to fight with responding officers who attempted to wake him up.
Eric Baczewski of 10 Evergreen Road was "highly intoxicated" when police responded to the area of Chestnut Street around 3:30 p.m. Monday, according to Lt. Mark Newport.
Baczewski threatened to kill responding officers, Newport said. Baczewski was found passed out in a flower bed across the street from The Music Hall, said Newport.
"It took them a while to wake him up," he said. "Once they did, he started yelling and screaming and became belligerent."
Baczewski was charged with disorderly conduct, resisting arrest and criminal threatening, and was taken to the Rockingham County House of Corrections.
Location, ST | website.com


text:
FALL RIVER — Apollo Safety Inc. a veteran-owned, Fall River-based company specializing in safety products and services, recently announced the formation of a special health care division to serve hospitals, doctor's offices and other medical facilities.
The new division will feature extensive offerings for health care facilities as it pertains to gas detection equipment, maintenance and monitoring.
"A gas leak is bad any time, anywhere. At a health care facility like a doctor's office or a hospital, it's even worse because it impacts people already in a weakened condition ..." said John C. Carvalho III, president of Apollo Safety, Inc.. "With our new health care division, we can tailor the detection and monitoring system to the facility to best meet their needs and help prevent tragedies."
Location, ST | website.com


text:
Webinar on Financial Management
This topic contains 0 replies, has 1 voice, and was last updated by rebecca 3 years, 9 months ago.
November 29, 2012 at 8:14 pm #1219
rebeccaKeymasterUpcoming Webinar Series on
Financial Managementfor Sexual Assault Programs, Rape Crisis Centers,and Dual SA and DV ProgramsDear CCASA Members & Partners,We wanted to share the following free webinars from the Resource Sharing Project with you, since their topics are of vital importance to the everyday life and sustainability of your organization.Thanks for all you do!~CCASA StaffTHIS Monday, Dec. 3rd!
"Policies and Procedures for Local Programs"
"Policies & Procedures for Local Programs"
Monday December 3, 2012 at 3:00 Eastern (2:00 Central, 1:00 Mountain, 12:00 Pacific)
Written accounting policies and procedures are required for government contracts and a best practice for nonprofit management – but how do you develop them? Which ones are applicable to an organization your size? This webinar will answer the key questions when it comes to policies and procedures and help you establish and revise procedures that are meaningful to your organization.
Register for Policies & Procedures for Local Programs!
Additional Webinars:
"Ensuring Accuracy in Your Finances: Internal Controls for Local Programs"
Wednesday January 16, 2013 at 3:00 Eastern (2:00 Central, 1:00 Mountain, 12:00 Pacific)
Beyond having the right people in place, how does your organization develop a comprehensive internal control system that protects your assets and creates efficiencies? Even more – how do you segregate duties when there are not that many people? This interactive webinar covers these key questions and assists you in developing internal control procedures that are right for your organization. We'll also provide a convenient checklist to consider when creating your internal controls.
Register for Ensuring Accuracy in Your Finances: Internal Controls for Local Programs!
Demystifying Cost Allocation for Local Programs
Wednesday February 13, 2013 at 3:00 Eastern (2:00 Central, 1:00 Mountain, 12:00 Pacific)
Even for the most experienced financial professional, cost allocation tends to be a challenging subject. How does each activity share the burden of common costs such as rent, liability insurance and office supplies? How do we split these costs between funders? This webinar is customized based on your questions shedding light on tricky cost allocation problems.
Register for Demystifying Cost Allocation for Local Programs!
Save the Date
additional webinarsJanuary 16th & February 13th!
~ register now! ~Colorado Coalition Against Sexual Assault | 303.839.9999 | | http://www.ccasa.org
1120 Lincoln St.
Suite 700
Denver, CO 80203
You must be logged in to reply to this topic.


text:
Alyssa Rachelle Mennillo and Alfred Bailey Stump III were married June 8 at West Virginia University Jackson's Mill Chapel in Weston, W.Va. Pastor Dan Meadows officiated the ceremony.
The bride is the daughter of Jeffrey and Jill Mennillo of Parkersburg. She is the granddaughter of Jon and Carolyn Saffell of Glen Dale, W.Va. and Butch and Julie Mennillo of Wheeling, W.Va. and the great-granddaughter of Marco (Virginia) Mennillo of Wheeling. She is a 2006 graduate of Parkersburg High School and a 2010 graduate of the West Virginia University Honors College, where she earned a degree in Finance and a minor in Spanish. She is employed at Mylan Pharmaceuticals, Inc. in Morgantown as a Senior Customer Relations Associate.
The bridegroom is the son of Greg and Cathy Stump of Parkersburg. He is the grandson of Al and Judy Stump of Parkersburg and Joanne Abel of Parkersburg. He is a 2006 graduate of Parkersburg South High School and a 2010 graduate of West Virginia University, where he earned a Bachelor of Science degree in Chemistry. He is a student at the West Virginia University School of Medicine.
Ashley Mennillo, sister of the bride, served as maid of honor. Bridesmaids were Brittany Stump, sister of the bridegroom, Rebecca (Gant) Lowery, and Katie Seachrist.
Ava Peroni and Maria Peroni, cousins of the bride, served as junior bridesmaids.
Groomsmen were Dax Mennillo, brother of the bride, Phil Pifer, Jordan Jones and Eric Seachrist.
A rehearsal dinner and reception were held at the Mount Vernon Dining Hall at Jackson's Mill.
After a honeymoon to Myrtle Beach, S.C., the couple resides in Morgantown.


text: I never really thought of John, I'm Only Dancing or Changes as being gay songs. I always thought that John, I'm Only Dancing was David talking to a guy named John about how he's confused as to why only dancing with the girl turns him on so much. Changes seems to be David telling the world about his plans about his rock career. He's looking into the "stream of warm impermanance" and wanting to change his situation. He's warning the older generation about his new brand of rock that will change so many people. He knows that he will have a following of some sort and is kind of predicting that. It's like he's saying "watch out, here I come and you can't stop me and the sexual and musical revolution that I will help in starting."


text:
Always Free Delivery & 100% Authenticity Guaranteed
0 items
Refine by:
Dial Color
Brands view all
Case Shape
Price Range
Movement Type
Case Width
Case Material
Band Color
New Items
Watch Information
Lucien Piccard
Style: 12750-SG-22S
Laurez Gold-Tone and Silver-Tone Stainless Steel Silver Dial
List $350.00 (what's this?)
Our Price (N/A) You save (N/A)
Price $69.99 80% off with sale!
FREE SHIPPING - Most Orders Arrive in 2-4 Business Days
30 Day Money-Back Guarantee
100% Authentic
Who We Are & What We SellWarranty: Coverage Chart


text:
Left Masthead
August 30, 2016
Obama's Network TV Blitz
Posted on Oct 30, 2008
What's that? An Obama infomercial? Network TV? Wednesday night? Oh, right—here it is, in case you missed it.
Square, Site wide
New and Improved Comments
If you have trouble leaving a comment, review this help page. Still having problems? Let us know. If you find yourself moderated, take a moment to review our comment policy.
Join the conversation
Load Comments
By BaxterJ, October 30, 2008 at 11:45 am Link to this comment
I don't know if this swayed any undecideds, though. Then again, I don't really understand anyone who is still undecided.
By Kevin, October 30, 2008 at 8:52 am Link to this comment
I don't think Barack Obama "deserves" to be President, but I think we deserve him to be President.
By altara, October 30, 2008 at 5:19 am Link to this comment
related fake news
Some of the News
Chicago. October 29, 2008. This morning, Senator Barack Obama's headquarters confirmed that the campaign had purchased the game 5 time scheduled for broadcasting after Obama's 30 minute infomercial. Campaign spokesman Reginald Smith noted that the unfounded charges by Senator McCain that Obama's broadcast would cause a delay in the start of the game played no part in the decision.
While the content to be aired in the extra time could not be revealed, campaign sources indicated that the Senator may be reading excerpts from the two books he had written.
When questioned by the media, Fox News responded with a press release. The release noted that this was not a whole game, since game 5 had been halted in the 6th inning. Besides, hardly any one was watching this series at all. In a separate release, Fox News announced that the entire conclusion of game 5 would be available on You Tube.


text:
Haripriya to try her luck in Tamil
Haripriya has acted in four Kannada films so far. Manasugala Maatu Madhura and Vasantha Kaala bombed in the box office while the ambitious Mukhyamantri I Love You is canned for unknown reasons. Her latest film E Sambhashane is set for release soon but there are reports that the actress is not on good terms with the producers. Incidentally, Haripriya kept away from the music launch of the film, stating that she was not invited and that she is being ignored by the producer at the promotional events.
On a positive note, Haripriya is one of the heroines in Shivarajkumar's Cheluveye Ninna Nodalu and will soon be flying to the Seven Wonders of the World to shoot for the film.


text:
Fujitsu shows off world's first quad-core, nVidia Tegra 3-powered smartphone at CES 2012.
The device was showcase behind glass, in a transparent box, safe from the prying hands of everyone. The specs accompanying the device are talking about nVidia Tegra 3 quad-core processor clocked at 1.2GHz, a 4.6-inch "HD-quality" LCD screen, 13-megapixel camera, and LTE compatibility.
Source: Droid-life


text:
Most high school seniors don't catch the attention and interest of Boeing. But then, few high school seniors get a planet named after them, either. At the age of 18, David Zarrin can say he's done both.
The Saratoga High School senior competed in the prestigious Intel International Science and Engineering Fair in Phoenix, Ariz., for the third time in his high school career. For his second-place award, Intel gave him money and a planet they named "Minor Planet Zarrin."
"It's really cool," Zarrin said. "Even though you can't see it, it's cool to have your mark somewhere in the world even after you die."
Even a cursory glance at Zarrin's career track thus far leaves little doubt that that isn't the only mark he'll leave behind. Arguably his biggest accomplishment this year was a design for a hybrid jet engine that could potentially improve the safety of commercial flight.
His system, called the Turbopulse, can operate with failed turbines and tolerates flameout due to the ingestion of birds, ice, precipitation and volcanic ash.
Zarrin said he drew some inspiration from the famous crash landing of U.S. Airways Flight 1549 by Chesley "Sully" Sullenberger on the Hudson River in 2009.
"I wanted to solve the problem of a jet plane losing all thrust from a simple ingestion of birds or heavy precipitation," he said. "I started learning about jet engines by going on YouTube and watching animations of how they work. That's how I ran into the design of the pulse jet."
The pulse jet, he learned, was used by the Germans in World War II. To create a safer jet engine, Zarrin said he took a pulse jet and integrated it with a modern jet engine.
"Basically, it's a modern jet engine. However it has the ability to continue to provide thrust for a jet plane even after a compressor failure," he said. "So now when a bird runs into the propellers, the air pressure drops. Upon that, the pulse jets automatically kick in and begin to provide thrust for the plane."
Zarrin spent 150 hours building and designing the project and "a long time thinking of it." He did much of the work in his garage and the most advanced aspects at the TechShop in San Jose before entering it in the Synopsys Fair earlier this year, where he won the grand prize.
Among the three contests, he garnered more than $4,000 in prize money. He also took home $1,250 that he presented to his school and won first place in the applied mechanics and structures category.
Winning Synopsys helped him get into the ISEF for the third year. The first time was in his freshman year, when he won first place, and the second time was last year, where he came in second again.
"It was one of those experiences where you meet a ton of kids and it was a super fun week," Zarrin said.
It was at the ISEF that Zarrin attracted the attention and interest of Boeing. A representative told Zarrin not to be surprised if he hears from the company in the near future. Zarrin said before he sells the idea to them, he wants to develop the design further--that is, if he doesn't decide to work on developing a car engine design that he entered in the contest last year.
If intricate science projects weren't enough, Zarrin has kept busy with other school activities this year. He's an Eagle Scout, two-year captain of the school's cross country team, vice president of the Associated Student Body and a volunteer at Good Samaritan Hospital.
"I'm at the school quite a bit," he said.
He also made time for a Powder Puff rally--where he dressed like a cheerleader--and for Halo, a video game that allows Zarrin to indulge in his competitive side.
Overall, the last semester was relaxed, Zarrin said, and he had time to spend with friends and do all the things most high school students do.
Next up for Zarrin is college. He plans to attend UC-Berkeley, where he will be simultaneously pursuing a degree in mechanical engineering and pre-med studies.
"Mechanical engineering is related to surgery more than most people realize," he said. "Basically, it's putting things together and taking it apart."


text:
Zoo Med Nocturnal Infrared Heat Lamp
|Zoo Med Infrared Heat Lamp is an ideal 24 hour heat source for all types of reptiles, amphibians, birds or small animals. Very little visible light provided so as not to disturb your animal's sleep patterns. Excellent for nocturnal viewing Great for all types of captive animals Very little visible light will not disturb your animal's sleep patterns Zoo Med Infrared Heat Lamp is excellent for nocturnal viewing of all types of captive animals. Spot reflector focuses more heat onto your reptile and minimizes nighttime glare.3-month manufacturer's warranty.FAQ:Q: Does this lamp emit UVA?A: No. This lamp is for heat and nighttime viewing of animals only.Q: Can I use a rheostat/thermostat with the Ceramic Heat Emitter?A: Yes! A Thermostat or rheostat can be used to control the heat output of this heater.
Zoo Med ReptiCare Ceramic Infrared Heat Emitter
|Zoo Med ReptiCare Ceramic Infrared Heat Emitters provide 24 hour heat for all tropical and desert reptiles. Each ceramic heat bulb lasts up to 5 years, which is twice as long as the competition! ReptiCare Heat Emitters emit no light, are water resistant, and perfect for high humidity terrariums. Perfect 24 hour non-light emitting heat source Ideal heat emitter for all tropical and desert reptiles Lasts up to 5 years - 25,000 hour average life These porcelain heating devices screw into a standard porcelain incandescent socket, giving off intense, "muscle-penetrating" infrared heat, while emitting no light. The flat-faced design is more efficient and longer lasting than conical designs which build up excess heat internally, ultimately carbonizing the element.Zoo Med recommends using the ReptiCare Ceramic Infrared Heat Lamp with the Zoo Med Wire Cage Lamp (LF-10), as well as a thermostat or rheostat to control the heat output. This heater has no Teflon coating. UL/cUL classified when used in conjunction with Zoo Med's Wire Cage Clamp Lamp (LF-10).2-year manufacturer's warranty.FAQ:Q: What fixture should I use with this heat emitter?A: We recommend using the Wire Cage Clamp Lamp (LF-10).Q: Can I use a rheostat/thermostat with the Ceramic Heat Emitter?A: Yes! A Thermostat or rheostat can be used to control the heat output of this heater.Q: Is the Ceramic Heat Emitter coated with Teflon?A: No. There is no coating on this heater.
Zoo Med Heat + UVB Combo Pack - Heat Lamp & ReptiSun 5.0 UVB Lamp
|Zoo Med's Heat + UVB combo pack gives you the combination of lighting your reptile needs for overall health and logevity. This combo pack combines the #1 selling basking lamp for all types of reptiles with the popular Reptisun 5.0 self ballasted compact fluorescent UVB lamp for reptiles and amphibians. #1 selling 100 watt Repti Basking Spot Lamp ReptiSun 5.0 UVB Compact Fluorescent Bulb Value added - includes free calcium supplement Repti Basking Spot Lamp - The double reflector focuses 35% more light and heat in the beam than other reflector bulbs. The tighter beam creates a more effective basking site than ordinary reflector bulbs. Increases the overall ambient temperature of your terrarium. The Basking Spot lamp lasts up to 2,000 hours.Reptisun 5.0 UVB Compact Fluorescent Lamp - Helps prevent or reverse Metabolic Bone Disease commonly seen in captive reptiles at 6 to 12 months of age. Provides UVB for Vitamin D production and calcium metabolism. The UVB lamp emits UVA which is seen by reptiles and helps to increase activity levels, reproductive behaviors and appetite. Note: contains mercury. Contact your local waste company for proper disposal instructions.


text:
A construction worker in Chicago named Marc Smith is credited with starting the very first poetry slam back in 1984. Since then, poetry slams have spread all around the world. In Lincoln, young writers are now getting the chance to express themselves like never before.
Deborah McGinn created Lincoln High's first slam poetry team earlier this school year, "I've been at Lincoln High School for 28 years and never ever has writing been this contagious. I had been waiting for a storm like this. Where finally our exercises in English classes will catch fire and the students will suddenly, willingly want to write."
Last summer, McGinn watched a documentary about Chicago high schoolers that was called 'Louder Than a Bomb,' "The film was absolutely mesmerizing because it shows what students are capable of and they're capable of excellence." McGinn's students were mesmerized as well. Itahi Sanchez says, "I saw how amazing they were and I immediately felt competitive!" The Lincoln High Slam Poetry team is preparing for Nebraska's first-ever High Slam Poetry Championships. The competition will involve slam teams from Lincoln North Star, Waverly and Omaha area schools.
The event will take place in mid-April in Omaha.
The coaches for the LHS team are Deborah McGinn, Dominique Garay, Isau Metes and Sam Woog.


text:
The neighbor moved out of the bungalow next door not long after we moved onto Jean Street in Tampa, just before the bubble burst. She showed up on our porch in tears saying her mother was dying out West, and something felt wrong about the house, something she couldn't explain. Not long after the renters moved in, they were signing divorce papers and selling off their furniture. I went over to buy a dresser. This woman, too, was crying. She said I wouldn't believe it, but in the bathroom one day she had seen something dark hovering just behind her husband. That's when things began to change.
When they were gone, the place sat empty, and Florida did what Florida does. Vines ran up the stockade fence and repelled from the oaks. Clumps of bamboo spread and rocketed upward. Algae covered the swimming pool and the water turned black. The deck began to rot and the green window canopies grew mold. The little pink house turned a shade darker.
At first, my wife and I were dismayed. Our early-century Seminole Heights bungalow had been lovingly restored, and we paid through the nose. Now, market kaput, we found ourselves parked indefinitely beside an eyesore. Worse was when the clouds of mosquitoes began to rise from the pool. I threw pesticide dunkers over the fence and rang code enforcement.
But as nature consumed the property, as the canopy grew to block out the sun, we began to think of it differently. We were suddenly falling asleep to a chorus of frogs and cicadas and watching opossums trot down the fence-line. When two slats fell off the fence separating our yards, the space became a portal to a wild and mysterious place, albeit on a city lot. We'd take our daughters next door to catch tadpoles in the pool and play hide-and-seek in the almost overnight jungle. The eyesore became an escape from city life, real Florida right next door. And for a few years it was ours.
A month ago, someone planted a For Sale sign out front, and a group of paint-splattered men showed up in a construction van. The men painted and put on a new roof and built a deck over the pool and turned on the electricity. Flood lights underlit our disappearing refuge.
I'm sure my property is worth more now, and I'm hoping a nice family moves in and makes a home. But I haven't heard the frogs since the chain saws. I go to sleep now with nostalgia, and a better understanding of how pliable existence is here, and how full of life a place void of humans can be.


text:
See 'Vampire Diaries,' 'Beauty and the Beast' tonight on KCWEUPDATED 7:45 AM CST Dec 06, 2012
Stefan and Damon relive the past to understand what's affecting Elena in the present -- TVD is all new at 7! And, Vincent's combat flashbacks holding the key to understanding his blackouts! See a new "Beauty and the Beast" at 8 p.m. on KCWE-TV.
More Video
CommentsThe views expressed are not those of this site, this station or its affiliated companies. By posting your comments you agree to accept our terms of use.blog comments powered by Disqus


text:
News, Events, Entertainment, Lifestyle, Fashion, Beauty, Inspiration and yes... Gossip! *Wink*
Thursday, March 31, 2011
ACPN alleges plot to release Gbemi Saraki's fake nude pictures
The plot which included an anti-female governor procession to the metropolis from the mosque after Jumat on Friday was allegedly being coordinated by the wife of a highly placed top shot of the PDP in the state. - Vanguard
5 comments:
- brown said...
I dont understand if its a FAKE picture then whats all the noise for?
na wa o I cant believe this ,the length some people will go just not to have a female governor
or maybe their beef is because shes Sarakis daughter since theyve turned that state into their family business.
- March 31, 2011 at 10:27 AM
If it is fake then shut up. I am fed up of these spoilt big kids in our mist. Nonsense, who cares?
- March 31, 2011 at 2:21 PM
Lets see the naked pics...if it really looks like her..i bet it will be disgusting...
- March 31, 2011 at 11:17 PM
Abi O! I agree wit anon 11.17am, a clear conscience fears no accusation. make she relax and allow them release d pix if she is so certain say na fake. atleast make nigerians be d judge of weather its fake or not.
- April 1, 2011 at 10:11 AM
wey the picture?
i want to confirm whether it is fake or not.
- April 1, 2011 at 9:58 PM


text:
for iPhone®, iPod Touch®, or iPad®
With mScribble (the Melody Scribbler), you can improvise beautiful melodies over a bass line by scribbling on the screen. You'll never need to know a thing about scales or chords, just express your music with the tip of your finger.
In 2010, Featured twice as New & Noteworthy in the App Store. Also, Staff Favorites and What's Hot!
Here's what people are saying about mScribble:
"A lot of fun.. a great experience" -TUAW.com
"Rating: A… This app is almost perfect" -thegamerwithkids.com
"A fun way to play music…hypnotic" – Wired.com
"mScribble is such a simple concept, yet it's almost mesmerizing in what it does." -Technobrains.com
Apple, the Apple logo, iPod, iPod Touch and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries.
You must be logged in to post a comment.


text:
Revamped version of the hip-hop song you can't get out of your brain. From the makers of PaxilBack.
In case you were wondering why sitcoms that were produced during the 80s and 90s are hot – this is why they're hot.
After a nice hard day of work, nothing feels better than squeezing your way into a hot tub with another person. This is a lie.
Appalachian State made some history this weekend and beat the Michigan Wolverines. They most likely won because of this awesome recruiting video.
Sometimes, while trolling the internet for videos, we here at LG come across a gem like this. Nothing like a good old, middle of the street, thong in the air, cat fight complete with stellar impromptu commentary to welcome you back to the work week! "My hair is still in my hair, and what?"?! Enjoy!
Send this e-card to your friends, family, or even those you hate. A LiquidGeneration E-Card never discriminates!
1) Why the hell would anyone buy a magazine with Zac Efron on the cover? 2) Why would anybody buy GQ if this is the stuff they're gonna put on covers? And 3) You clicked on a picture of Zac Efron and that means you're gay.
This is actually art created from colored pencils, but we wanted to make sure the virgins didn't get excited.
This is not Obama. He's an Indonesian journalist. He cannot provide change. He refuses to Yes your Can.
Dating her would probably cost more than keeping a Hummer fueled for the summer, hummers all cost the same, car or otherwise.
We have no idea why she's famous other than the fact that when you look at her it's like you're seeing an angel. An angel with a hot ass and really nice boobs.
If you're going to scare somebody, you might as well do it while wearing the cheesiest costume imaginable.


text:
PORTAGEVILLE ---- The big boys up front shoved Malden out of the postseason picture and paved the way for what the Portageville football team hopes will be another deep run in the state playoffs.
With the offensive line clearing gaping holes for their wishbone attack, the Bulldogs began defense of their Class 2, District 1 title with a convincing 42-14 victory Friday night over rival Malden.
Portageville's back-by-committee of Aaron Bidewell, Antonio Scott and Kyle Ezell racked up a combined 254 yards on 41 carries and reached the end zone four times.
The Bulldogs, who suffered their first loss of the season last week to Bruceton, Tenn., advanced to the sectional round last season before losing 27-6 to Charleston.
"This game was won by our offensive line," said Bidewell, who had 17 carries for 157 yards and a pair of touchdowns. " We can't do anything without them. They push and drive, and they just decided to take over the game.
"All three of us backs try to carry the ball as hard as we can, but it's on them as far as we go in districts and the playoffs. As far as the offensive line takes us, that's how far we'll go."
The Green Wave (3-5) managed to stay within striking distance in the first half and made things interesting when tailback Jamall Kilgore broke loose for a 61-yard score on the opening play of the second half to cut the Portageville lead to seven.
The Bulldogs answered with a nine play, 68-yard scoring drive -- which included a fourth-and-8 conversion on the Malden 29-yard line -- to make it 28-12.
Known for chewing up large chunks of the clock with its ball control offense, Portageville uncharacteristically punched in two quick scores to blow the game open.
Three plays after the Bulldogs punted for the first time, Tyler Boatwright picked up a Kilgore fumble and rumbled 32 yards for a score.
Two series later, Portageville forced another fumble on its second punt. Ezell scooted in from seven yards out on the next play to give the Bulldogs a 28-point advantage.
Portageville (6-1) lost the time of possession battle by over three minutes and had just one drive that lasted more than four minutes and 10 plays.
That came on the opening possession of the game when the Bulldogs went 73 yards on 10 plays and scored on Bidewell's five-yard plunge 5:15 into the game.
Portageville's five other scores totaled a combined seven minutes, 19 seconds.
"Coach (Jim) McKay said in practice we're going to start opening it up a little bit and not just run the inside veers," Bidewell said, "but try to run the sweeps and that's pretty much what we tried to do."


text:
Dean of the School of International and Public Affairs; Professor of Professional Practice, International Economic Law and International Affairs
© Copyright 2016, The Trustees of Columbia University in the City of New York.
For questions or comments, please contact the web administrators.
435 West 116 Street, New York, NY 10027 — 212-854-2640