text:
2009 Dodge Avenger R/T for Sale Nationwide
New Search
Filter Results
|- Loading...
|- Loading...
Days on Market
|- Loading...
Accidents Reported
Text Search
Add Similar Cars
Choose Other Models to Add
Listings for these models will be added to the listings you are currently viewing.
CarGurus Quick Poll
|by malvasio
"nice sedan for a family, confortable."
i like its style, the ways it drives, and its confort. At the same time, even if its a sedan, you still feel high on the road. You can easily accelerate, its powerful for a 4 cylinders, even though it burns a lot of gas.
Find 2009 Dodge Avenger R/T listings in your area
Used Cars in Alexandria, IN 46001
Price: $7,750
Mileage: 97,000
Location: Alexandria, IN 46001
Used Cars in Cape Girardeau, MO 63703
Price: $9,995
Mileage: 54,900
Location: Cape Girardeau, MO 63703
Used Cars in Hurricane, WV 25526
Price: $8,823
Mileage: 93,906
Location: Hurricane, WV 25526
Used Cars in San Jose, CA 95110
Price: $6,850
Mileage: 129,506
Location: San Jose, CA 95110
Used Cars in Detroit, MI 48228
Price: $3,999
Mileage: 100,182
Location: Detroit, MI 48228
Used Cars in Miramar, FL 33023
Price: $7,990
Mileage: 74,366
Location: Miramar, FL 33023
Used Cars in Jacksonville, FL 32211
Price: $7,999
Mileage: 86,564
Location: Jacksonville, FL 32211
Used Cars in Spring, TX 77379
Price: Negotiable
Mileage: 52,371
Location: Spring, TX 77379
Used Cars in Lafayette, LA 70503
Price: Negotiable
Mileage: 46,167
Location: Lafayette, LA 70503
Used Cars in Fayetteville, NC 28304
Price: Negotiable
Mileage: 150,170
Location: Fayetteville, NC 28304
Used Cars in Nashville, TN 37211
Price: Negotiable
Mileage: 102,495
Location: Nashville, TN 37211
Used Cars in Nashville, TN 37211
Price: Negotiable
Mileage: 114,054
Location: Nashville, TN 37211
Used Cars in Binghamton, NY 13901
Price: Negotiable
Mileage: 68,160
Location: Binghamton, NY 13901
Used Cars in Saint Cloud, MN 56301
Price: $7,999
Mileage: 110,844
Location: Saint Cloud, MN 56301
Used Cars in New Vienna, OH 45159
Price: $6,950
Mileage: 134,329
Location: New Vienna, OH 45159
Filter your search criteria!
A large number of listings matched your criteria. You are seeing the top 2,000 listings.
Used Dodge Avenger By Year
|Starting Price
|Total Available
|2014 Dodge Avenger
|61 Great Deals
|1,373 listings
|2013 Dodge Avenger
|94 Great Deals
|1,579 listings
|2012 Dodge Avenger
|40 Great Deals
|1,118 listings
|2011 Dodge Avenger
|26 Great Deals
|481 listings
|2010 Dodge Avenger
|27 Great Deals
|564 listings
|2009 Dodge Avenger
|1 Great Deal
|191 listings
|2008 Dodge Avenger
|12 Great Deals
|773 listings
Similar Cars
Dodge Charger
705 Great Deals out of 30,288 listings starting at $1,995
Dodge Challenger
503 Great Deals out of 25,645 listings starting at $7,980
Chevrolet Malibu
1,169 Great Deals out of 72,682 listings starting at $695
Broader Searches
All Dodge Avenger Listings
261 Great Deals out of 6,111 listings starting at $2,250
All Dodge Avenger SE Listings
138 Great Deals out of 3,236 listings starting at $2,998
All Dodge Avenger SXT Listings
60 Great Deals out of 1,645 listings starting at $2,250
All Dodge Avenger R/T Listings
22 Great Deals out of 421 listings starting at $3,495
Used Dodge Avenger By City
Dodge Avenger in Boston MA
2 listings starting at $8,995
Dodge Avenger in Cincinnati OH
1 listings starting at $6,950
Dodge Avenger in Detroit MI
2 listings starting at $8,600
Dodge Avenger in Houston TX
1 listing
Dodge Avenger in Indianapolis IN
1 listings starting at $7,750
Dodge Avenger in Miami FL
1 listing
Dodge Avenger in Minneapolis MN
1 listings starting at $7,999
Dodge Avenger in Nashville TN
2 listings
Dodge Avenger in San Francisco CA
1 listings starting at $6,850


text:
Bartley Realty Services
4833 Martinique Way, Naples, FL 34119
(239) 596-8961
Compliment this business
Street address:
4833 Martinique Way
City / suburb:
ZIP code:
(239) 596-8961
Contact name:
David Bartely
Contact title:
GPS Longitude:
GPS Latitude:
Places nearby
0.46 miles away
Real Estate Agents And Managers
0.46 miles away
Eating Places
General information
- Finance, Insurance, And Real Estate Real Estate Real Estate Agents And Managers
Business data
|Standard industrial classification code:
|City / suburb:
|Naples, FL
Not quite what you're looking for? See recommended web results
Is this your business? Claim this profile to get thousands of free views!
QR code with Bartley Realty Services contacts
Install a QR code reading app on your smartphone to scan and convert it to Bartley Realty Services contact information.
There are no reviews on Bartley Realty Services yet.
Be the first to write a review about your experience with the company.
Be the first to write a review about your experience with the company.
More details about Bartley Realty Services
According to our records, this business is located at 4833 Martinique Way in Naples (in Collier County), Florida 34119, the location GPS coordinates are: 26.255626 (latitude), -81.716256 (longitude). Bartley Realty Services is categorized under Real Estate Agents And Managers (SIC code 6531). Known organization principal is David Bartely. You can contact the company by phone at (239) 596-8961.
Not satisfied? Select a reason•Rate this page•Send feedback
Or try our search form or quick navigation by category and location
Recommended categories in Naples, FL
Similar companies
Banco Mercantio
P.O. BOX 229015, Miami-Dade, FL
Real Estate Agents And Managers
Real Estate Agents And Managers
Bay Harbor Realty Inc
12926 SW 133rd Ct, Miami-Dade, FL
Real Estate Agents And Managers
Real Estate Agents And Managers
Betty Hilgendorf Real Estate
738 NW 23rd Ave., Alachua, FL
Real Estate Agents And Managers
Real Estate Agents And Managers
Also viewed
Present Truth Ministries
3332 Del Prado Blvd S, Lee, FL
Religious Organizations
Religious Organizations
7276 103rd St., Duval, FL
Eating Places
Eating Places
11401 Pines Blvd Ste 664, Broward, FL
Family Clothing Stores
Family Clothing Stores
Rio Olympics might be a mess, but Tokyo 2020 has some cool high-tech plans
Driverless taxis for athletes and holograms for info.
Thu, Jul 07 2016
Clinton takes big step toward easing tensions with Sanders
With new college affordability plan, the presumptive Democratic nominee won praise from rival.
Thu, Jul 07 2016
US urges aerial spraying amid jump in Puerto Rico Zika cases
The U.S. territory is debating whether to fumigate with the insecticide Naled.
Wed, Jul 06 2016

subset: commoncrawl


text:
The Microsoft® Web Platform offers the right tools for the right task. Design, build, debug, and deploy websites withasics women's field hockey shoes nz . And then test your sites in Windows® Internet Explorer® 10 using the built-in developer tools.
Remember it is a best practise to add your scripts at the bottom of the body section even though technically, you should add them to the head section.asics women's field hockey shoes nz Marlborough Rioja Barolo Chianti Grape Cabernet Sauvignon Merlot Shiraz Pinot Noir Malbec Grenache Tempranillo Sauvignon Blanc Chardonnay Pinot Grigio Riesling Mixed Cases Type Mixed Red & White Mixed Red Mixed White Mixed Rosé. ??Though the project is facing legal challenges in Second District Court, the loggers are already removing trees along a 20 mile segment in northwestern Pennsylvania.
UsageSafety firstAlways test a hidden area for colour fastness and allow to dry completely before use.asics women's field hockey shoes nz ??Two wings were added in the 1960s and 1970s, and a major renovation and expansion that began in 1999 is scheduled for completion in 2007. She is not letting anyone stop her from making those beautiful parts of her body visible to everyone.asics women's field hockey shoes nz
Opening Times Mon Thur 6:30am 10:00pm Fri 6:30am 9:00pm Sat, Sun and Bank Holidays 9:00am 6:00pm Terms & conditions The membership is for 1 full consecutive year and can only be used by one person, cannot be used in conjunction with any current membership at Nuffield. Our Fees We offer a competitive fee structure and can offer reductions on our standard charges for multiple property portfolios. Read More April 19, 2014 Posted by Jamie 0 7 Reasons Why Holiday Homeowners Have The Edge On Holiday Makers Owning your very own personal holiday home is no different than owning a beautiful house &hellip.asics women's field hockey shoes nz


text:
Changes related to "LVM (Español)"
From ArchWiki
This is a list of changes made recently to pages linked from a specified page (or to members of a specified category). Pages on your watchlist are bold.
26 October 2016
|Ext4 (diff | hist) . . (-95) . . Kyleh (Talk | contribs) (→Using ext4 file-based encryption: removed requirement to recompile the kernel since EXT4_ENCRYPTION is now enabled for the linux ,-zen,-grsec packages.)
|m 08:27
|Software RAID and LVM (diff | hist) . . (+16) . . Wouterv (Talk | contribs) (Corrected broken link to LVM wiki page for mkinitcpio)


text:
Please select category that most closely reflects your concern about the post, so that we can review it and determine if it violates our Terms of Use or isn't appropriate for viewers.
Thank you for helping us by reporting bad content.
This is what I wore out Tuesday. I basically went out with a few friends, hung out, go a few things done (nothing special). It rained that day so it was a bit gloomy, and I do not like dressing up on day like that.
So I just threw on some sweat pants, black camisole, Adidas, and my senior jacket (though I already graduated). And since I wanted to carry my laptop with me I just decided to carry this bag that I got from http://AmericanChic.net a while ago, but the site is no longer up (sorry).
You can probably tell that I`m not wear makeup. I did do my makeup earlier that day, but took it off when I saw that it was raining (I still may post a picture later though). And I had just washed my hair, so therefore I was still letting it dry when I took this picture.
Source link:


text:
Season 1, Episode 7 Chuck Versus the Alma Mater
First Aired: November 5, 2007
Despite being expelled from Stanford, Chuck returns to the school for homecoming to help a professor---who just happens to be a government operative. In the process, Chuck unearths deep secrets about his erstwhile pal Bryce Larkin. Meanwhile, Morgan squares off against Buy More's rookie assistant manager.
Guest Cast
Matthew Bomer Bryce Larkin
Cast & Details See all »
- Premiered: September 24, 2007
- Rating: TV-PG
- Premise: A computer nerd is drawn into shadowy global espionage when subliminal government secrets are downloaded into his brain. (more)
Trending TonightSee all »
The Blacklist10:00 pm | NBCI'll Watch265 Watching
Pure Genius10:00 pm | CBSI'll Watch215 Watching
How to Get Away With Murder10:00 pm | ABCI'll Watch202 Watching
Watch This
American Horror Story: Roanoke's Big Twist Explained
Here's how everything changed in "Chapter 6"
Dr. Chuck Tingle's Complete Guide To Romance
By CreateSpace Independent Publishing PlatformBuy New: $7.99
The Truth About Chuck Norris: 400 Facts About the World's Greatest Human
By AveryBuy New: $11.43
Chuck: Season 1
By Warner Home VideoBuy New: $14.96
Popular Shows
Popular Movies
- 1. War Dogs
- 2. Pete's Dragon
- 3. Sausage Party
- 4. Suicide Squad
- 5. Star Trek Beyond
- 6. Jason Bourne
- 7. Captain America: Civil War
Popular Celebrities
- 1. Rami Malek
- 2. Taylor Schilling
- 3. Constance Zimmer
- 4. Emilia Clarke
- 5. Tom Hiddleston
- 6. Kit Harington
- 7. Gina Rodriguez


text:
Balakrishna Ayyar, J.
1. In 1927, the Management of the 'Hindu' framed various rules defining some of the terms and conditions of service of their employees. One of these Was contained in Rule 45, which ran:
'Every employee shall ordinarily retire fromservice on his completing the age of 58 years orthirty years of unbroken service, whichever isearlier.'
When the Industrial Employment (Standing Orders) Act, 1946, came into force, the management submitted the rules they had drawn up for certification and on 4th May, 1949, the Labour Commissioner, who is the certifying officer under the Act, certified the rules and they became 'standing orders'. In 1957, the Management considered it desirable to make certain minor changes in these standing orders and applied for their modification in certain respects.
The National Press Employees' Union took advantage of this occasion and moved the certifying officer to amend para 45 so as to read as follows:
'Every employee shall retire on attaining the age of 58 which shall be fixed as the age of super annuation.''
If this amendment became effective, the position would be that employees who had put in 30 years of continuous unbroken service, but who had not attained the age of 58 years, could remain in service till they became 58 years old.
The Management objected to the modification, but their objections were overruled and the certifying officer certified the amendment as prayed for by the National Press. Employees' Union, The Management of the 'Hindu' preferred an appeal under Section 6(1) of the Industrial Employment (Standing Orders) Act, to the Labour Court, Madras; but that appeal failed. The Management has, therefore, come to this Court for the issue of an appropriate writ to quash the order of the authorities below, so far as it relates to the amendment of Standing Order 45.
2. The first contention which Mr. Ramamur thi Aiyar, the learned counsel for the petitioner, raised was this. The Schedule to the Industrial Employment (Standing Orders) Act enumerates all the matters in respect of which the statute requires that the provision should be made in Standing Orders. The matter for which provision was made in Standing Order 45, is not such a matter; it is outside the scope of the Schedule. Standing Order 45 provides for the retirement of an employee who has attained the age of 58 years or who has put in an unbroken service of 30 years, Item 8 of the Schedule no doubt reads:
'Termination of employment, and the notice thereof to be given by employer and workmen.' If the words used in this item had only been 'termination of employment' it might have been permissible to say that retirement on attaining a Certain age Or on completing a certain number of years of service is also comprised in it. But then, in the Schedule, the expression 'termination of employment' does not stand alone; it is followed by the words 'and the notice thereof to be given by employer and workmen'.
Words must be always understood in the context in which they arc placed, and regard being had to the context and also to the collocation of the words, the more appropriate way of reading this item is by taking all the words in it together.
If we do that, it will be appreciated that the termination referred to in item 8 is the termination brought about by the issue of a notice by 'once' side or other. Mr. Ramamurthi Aiyar attempted to reinforce this reasoning by referring to the Model Standing Orders framed under the Act.
Paragraph 13 of these model Standing Orders bears the heading 'termination of employment' and it then proceeds to say that for terminating the employment of a permanent workman, one month's notice shall be given in certain cases and two weeks' notice in certain other cases.
Sub-paragraph (2) of para 13 provides that no temporary workman shall be entitled to any notice Or pay in lieu thereof if his services are terminated. The language of this paragraph suggests. Mr. Ramamurthi Aiyar said, that the termination of employment envisaged by item 8 is the termination of employment by the issue of notice. He then went on to explain that the expression 'termination of service' is inappropriate to describe a case where an employee retires on attaining a particular age or after completing the prescribed years of service.
The expression 'termination of employment' would be wholly unsuitable to describe the cases where an employee honourably retires from service in the usual course of events. He then contended that the question what age should be fixed for the compulsory retirement of an employee is a large question, and a very different one -- about which there is endless dispute. It is also a question in which the interests of different categories Of employees inter se are in conflict.
Employees who are getting on in years naturally want the age of retirement to be raised; but persons at the bottom would naturally like it to be reduced since the natural consequence thereof would be to accelerate their promotion. It is not likely that the Legislature intended to leave a matter raising issues of this kind to be decided by the certifying officer. Be it remembered that the appeal from him lies only to the Labour Court. Besides, Standing Orders are liable to revision very six months, and it is not to be supposed that the Legislature intended that a question of this kind should be reopened and re-agitated every six months.
3. There is, of course, some force in all this. Nevertheless, I am not sure that it will be the proper way of reading the entry in question. Mr. Ramamurthi Aiyar wants the words 'notice thereof to be given by employer and workmen' to be read as qualifying, limiting and colouring the scope of the expression 'termination of employment', which immediately precedes these words. If that were so, the entry would apply only to either such forms of termination of service as are brought about by the issue of a notice by one side or the Other or only to the notices themselves. To produce such a detail, a very different set of words would have been more appropriate.
4. I am inclined to read the words disjunctively and as comprising two distinct, but connected matters. Termination of employment would be the principal or primary subject. Notices in relation thereto would form an ancillary or subsidiary subject. To read the entry as Mr. Ramamurthi Aiyar invited me to do would leave a sizeable gap in the area which the Schedule is apparently intended to cover.
5. Termination of employment may be brought about in various ways. In the case of a concern which belongs to a single individual, he may the and there may be no one able to carry on the undertaking, or, there may be too many who want to do so, and by their quarrels and fights, they may stop the entire work of the concern. Or, again, the employer may have reached the bankruptcy court. On the other side, an employee may have contracted some physical or mental infirmity which makes it impossible for him to remain further in employment. Or, again, he may be convicted of rioting or of some other offence and locked up in jail.
Yet again, he may absent himself from work without leave or overstay leave for several days. The conditions of service drawn up by a concern of some size and standing generally contain a clause to the effect that an employee who is absent without leave or who overstays his leave for certain number of days shall be deemed to have voluntarily left the service of the concern. There will be no provision in such cases for the issue of notice by the Management terminating the services of the employee; the termination of service becomes automatic.
If the view for which Mr. Ramamurthi Aiyar, contended were right, these and several other situations would be left unprovided for by the Schedule. I recognise that it is open to the parties concerned to include in the Standing Orders matters which are outside the Schedule. But then, the purpose of the Schedule is to insist that provision shall be made for certain matters and some of the questions of the kind I have mentioned are questions for which one would expect the Legislature to insist on provision being made.
6. The argument that It is inappropriate to say of persons who have retired in the usual course by completing the prescribe years of service or the prescribed age, that there has been 'termination' of their employment would have had more force if the words used in the Schedule had been 'termination of service'. The suggestion of Mr. Ramamurthi Aiyar was that there is a vague undefined taint attaching to the expression 'termination' of employment or service. No doubt, in itself, the word, 'termination' may be said to be a neutral word. Still, some odium has come to surround the word. Now, it will be noticed that the words used in the item are 'termination of employment' and not termination of service and, in respect of the word 'employment' this argument of Mr. Ramamurthi Aiyar would not be as strong as if the words used had been 'termination of service'.
7. On the argument of Mr. Ramamurthi Aiyar based on the model Standing Orders, I would make two observations. One is that the model Standing Orders have been drawn up by the Central Government and not by the Legislature, and that at the most, they only show how law officers of the Government understood the words. Besides, there is para 16 in the very same model Standing Orders, which runs:
'Every permanent workman shall be entitled to a service certificate at the time of his dismissal, discharge or retirement from service.'
Retirement from service by superannuation on attaining prescribed age or on completing the prescribed period of service would thus seem to be contemplated even by the model Standing Orders as a form of termination of service. I may explain how that, in para 16 of the model Standing Orders, the expression used is 'termination of service' and, in para 13 'termination of employment'. As regards the argument of Mr. Uamamurthi Aiyar that the Legislature would not have intended to confer such large powers on the certifying officer and the appellate authority, this is a matter completely in the wisdom of the Legislature. The frequency with which laws relating to labour are passed and the frequency with which they, are amended is apt to leave the impression that sometimes a piece of legislation reaches the statute book before all its aspects and implications are fully envisaged and appreciated. Even in the statute which I am now dealing with, Section 12 provided:
'It shall not be the function of the certifying officer or the appellate authority to adjudicate upon the fairness or reasonableness of the provisions of any Standing Orders.'
But in 1956, the Legislature reversed itself in this respect and said that:
'it shall be the function of the certifying officer or the appellate authority to adjudicate upon the fairness or reasonableness of the provisions of the Standing Orders.'
One comment which Mr. Dolia made is relevant here. He pointed out that the Schedule to the Act enumerates only those matters in respect of which it is obligatory to make provision in the Standing Orders and that there is no bar to the Standing Orders making provision for other matters. Once such provision is made, they are liable to be modified on the motion of either the employer or the workmen under Section 10(2) of the Act. In the present case, the provision relating to retirement on attaining the age of 55 years or on completing an unbroken service of 30 years was inserted by the Management and this was approved in the first instance by the certifying officer in 1949. That being so, it is open to the workmen concerned to move that the provisions in this regard should be amended. I consider that this reasoning is sound, and I accept it.
8. Mr. Ramamurthi Aiyar next contended that, Standing Orders could not be given retrospective effect and that the effect of the amendment now made is to do so. But, if we examine the subjects enumerated in the Schedule, it will be seen that some of them are such that, of necessity, they must apply to workmen or employees already in service. For instance, item 6 of the Schedule reads: 'Requirement to enter premises by certain gates, and inability to search'. I do not think that when an amendment is made of an Order covered by this claim, any employee can reasonably insist that he has a right to enter by the gate which he had been previously using.
Apart, item 5 reads: 'Conditions of procedure in applying for, and the authority which may grant, leave and holidays'. One set of rules may have provided that the authority competent to grant casual leave would be the manager of the institution. The Standing Orders may be amended so as to confer the power to grant casual leave on, say, the assistant manager. Can an old employee reasonably insist that his application for casual leave should still be dealt with by the manager and that the assistant manager should have nothing to do with it?
9. This is not all Under Section 10 of the Act, Standing Orders are liable to be revised every six months at the instance of the employer or the workmen. The labour force, in no properly conducted concern, is likely to be changed in its entirety in six months. This circumstance by itself makes it plain that it could not have been intended that the Standing Orders should apply only to future employees and not to previous employees. Besides, the rights given to workmen to move for an amendment of the Standing Orders would seem to imply that it is intended also for the benefit of workmen actually in service and not merely for those who may succeed them, probably several years later.
10. The last contention of Mr. Ramamurthi Aiyar was based on certain observations which the appellate authority made in the course of its order It said:
'As the gratuity is based upon the years of service, persons who are retained till the end of their 58th year will have to he paid larger sums and this again is mentioned as an additional liability. Though there is some force in this contention the additional liability is not likely to be very much especially for a huge organisation like the 'Hindu' with its vast resources and solid reserves.'
Mr. Ramamurthi Aiyar contended that there was no material whatever, on the basis of which the appellate authority could have stated that the additional liability would not be large or that the resources of the Management were vast and its reserves solid. In considering whether the age of retirement or superannuation should be raised, the ability of the employer to meet the additional commitments that would be involved Is a relevant factor, and the appellate authority was certainly entitled to take it into account. But the point is that, in the present case, there was no material bearing on that matter. Mr. Dolia commented that the financial implications of the proposal were not in controversy before the certifying officer.
In view of that, the appellate court could properly have declined to go into the question. If, however, it was inclined to examine that aspect of the matter, it should have either taken evidence or remanded the matter for disposal after taking evidence. On the ground that the order of the appellate authority is in part based on considerations and assertions which are not supported by any evidence whatever, its order is 'table to be set aside. As I said before, it would be open to him either to refuse to go into the question on the ground that the matter was not taken before the certifying authority or to take evidence itself or remand the case. No infirmity of this nature has been shown to attach to the order of the certifying officer.
11. In the result, the writ petition is allowed, so far as it relates to the order of the appellate authority. There will be no order as to costs.
(These petitions having been posted for being mentioned, the 'Court made the following order in W. P. No. 893 of 1958):
12. Art appeal was preferred to the Labour Court from the decision of the Commissioner for Labour. So till that appeal is disposed of, the Standing Orders as certified by the Commissioner for Labour will not take effect. In view of that no order is necessary on this petition. No costs.


text:
arkadaşlar şunu çevirirmisiniz ipek :when did the World War I break out? asu: it broke out in 1914 and it ended in 1918. what happened , then? ipek :the
Ottoman Empire and the allies of World war I signed the Armistice of Moudros on 30 october 1918, but this armistice led a new war. asu :why did it lead to a new war? ipek :because the allies occupied many places in anatolia arkadaşlar acil1
Gönderen gzmasu


text:
You Pay: $279.95
Questions? Ask our experts:
800.606.6969 Live Chat
The LiteReach Plus with 39 x 39" LitePanel Kit from Photoflex is a suitable solution for diffusing harsh sunlight when shooting on location. It consists of a LightPanel translucent diffuser and a LightReach support pole.
The LiteReach Plus extends from 35.5" to 9.6' and can hold a maximum vertical load of 15.0 lb. When holding the pole and diffuser, the balance ball at the bottom of the pole allows you to comfortably place the weight of the kit against your hip. The LitePanel attaches to the end of the support pole, allowing you to hold the diffuser above the subject, providing a softer light than the direct sunlight. The frame folds down to 39 x 3" and is held together with internal bungee cords, making it easy to break down and set up. The quick-release rail system features a modular mounting plate for a variety of mounting options and fast setup. A polyester carrying bag is included to transport the kit.
Photoflex LitePanel Frames are designed with the demanding professional photographer in mind and are unlike any other panels on the market. This is a 39 x 39" aluminum frame only, which will hold in place an assortment of Photoflex panels, available separately.
This frame is available as a part of different kits.
This Photoflex LP-3939WT White Translucent 39 x 39" (1 x 1 m) Fabric wraps over corners of a LitePanel frame to allow for quick setup. It provides maximum reflection and even, top-to-bottom light coverage.
Entire line of LitePanel fabrics available: White/Soft Gold, Translucent, White/Black, White/Silver, and White/Gold.
This Photoflex LitePanel Accessory Carry Bag is ideal for storing and transporting LitePanel frames, fabrics and accessories. The bag will hold your choice of three 39 x 72" (99 x 183 cm) frames, four 39 x 39" (99 x 99 cm) frames or two 77 x 77" (195 x 195 cm) frames. The side pocket keeps your fabrics separate from the frames. The bag also doubles as a stand bag, holding your choice of LS-B2218, LS-B2214, LS-B2211 or LS-B2200 LiteStands.
The Photoflex LitePanel Mounting Hardware Kit is designed to allow hands-free use of any of the LitePanels polycarbonate or aluminum frames as well as hands-on use via a LiteReach handheld extension arm. The kit included a heavy-duty swivel with an umbrella shaft channel and hardware to hold the frames or extensions.
The Photoflex LiteReach Plus is a heavy duty three-section support that allows you to hold a Photoflex LitePanel, umbrella or softbox up to 9.6' above your subject. Shooting outdoors, especially in mid-day sun is a tough contrast situation for the photographer and a hot, physically uncomfortable one for the subject. With separate purchase of the LitePanel Mounting Hardware Kit (PHLPFHK) you'll be able to hold LitePanel frames with diffusion material up to 39 x 72" over your subject to obtain soft, manageable contrast.
You can get a similar effect using a large white umbrella in place of the LitePanel. You'll need an optional Multiclamp with Shoe Mount (B&H# PHMCUSM)or a Heavy Duty Swivel (B&H# PHSM) mounted to the LiteReach Plus' 5/8" top stud to hold the umbrella. You can also use these products to support a softbox. With a maximum tubing diameter of 1.37", the LiteReach Plus has enough heft to handle a 15 lb vertical load at its full extension
Comfort and ergonomics are key to the LiteReach's design. The large rubberized balance ball allows you to shift the weight of your gear to your hip or to the ground, while two hand grips are located at ideal spots on the shaft to facilitate single-handed or two-handed direction of the LitePanel, umbrella or softbox.
|Frame Size
|39 x 39" (99 x 99 cm), Aluminum
|Packaging Info
|Box Dimensions (LxWxH)
|39.5 x 3.4 x 2.5"
|39 x 39" (1 x 1 m)
|Front Surface
|White Translucent
|Back Surface
|Not Applicable
|Packaging Info
|Box Dimensions (LxWxH)
|12.1 x 7.2 x 1.1"
|600D fabric shell
|Type of Closure
|Carrying/Transport Options
|Double loop handle
Inside: 40.75 x 6.25" (103.50 x 15.87 cm)
Outside: 41 x 6.50" (104.14 x 16.51 cm)
|Not specified by manufacturer
|Packaging Info
|Box Dimensions (LxWxH)
|14.7 x 11.5 x 2.3"
|5/8" (16 mm) Receiver for stand or LiteReach extension
Upper cover: 2.3 x 2.3 x 1.6" (6.0 x 6.0 x 4.0 cm)
Swivel: 2.5" (6.35 cm) grip surface diameter
|Kit Weight
|1.7 lb (0.77 kg)
|Packaging Info
|Box Dimensions (LxWxH)
|7.1 x 6.0 x 3.6"
|Load Capacity
|Maximum vertical load: 15 lb (6.8 kg)
Collapsed length: 35.5" (90.17 cm)
Extended length: 9.6' (291 cm)
Maximum tubing size: 1.37" (35 mm)
Top stud diameter: 5/8" (16 mm)
|4.0 lb (1.8 kg)
|Packaging Info
|Box Dimensions (LxWxH)
|36.0 x 3.8 x 3.8"


text:
Allegheny Islands State Park in Allegheny County, PA
User Submitted Links
Please click to submit a link! (Such as a URL of a trail map, guide to the park, etc.)
Nearby Flickr Photos
Just a moment...
Related Google Search Results
Just a moment...
Nearby Wikipedia Articles
Park Activities (Please vote: Yes this park has this activity, or no it does not.)
Comments About This Park
Luke Austin (10/13/2010): Very cool islands to wade out to. Top island above Lock 3 is to deep to wade to so you would need a boat but the bottom island next to lock 3 is great to wade out to. It's only about 3.5 ft of water wading over from below Lock 3 on Freeport rd in Harmar. The island is great for fishing! I recommend stopping across the street at Lock 3 Bait & Tackle for some cold drinks and bait. (report as inappropriate)
Got a story, recommended activity, tip, or comment about this park? Please share it!


text:
Top 10 new happy songs for 2015-2016, all time best most popular happy songs list.
People who have once enjoyed good music always desire for a thrilling and sensible music. Music relieves the tension and set mood for the pleasure and entertainment. Thus, happy music is highly preferred for people who are experiencing bad time in their life. These songs will definitely pour positive tune in life and will erase sadness from life. Thus, prepare a playlist of the below songs, then this may be the right time to enjoy some sensational time.
List of top 10 new happy songs 2015-2016:
We have prepared a list of some of the top happy songs that are available at the below list. People can enjoy these songs as per their desire and get thrill in life. Thus, select the best song as per desire and see how they entertain and pour romance and thrill in life.
1. "Best Day of My Life," American Authors: – Best Day of My Life is amazing and romantic song that will definitely catch the attention of even a new listener. People who are desperate of the best time, then this will be the best song the will make everyone happy and entertained.
2. "Stronger (What Doesn't Kill You)," Kelly Clarkson: – Another sensational song in the list of top 10 happy songs, this song is known for its lyrics, music, and tunes that will keep its listeners happy and entertained. It is a best track by Kelly Clarkson and shows his music knowledge. Thus, this is a best music of the time where everyone can get the right tune for his mood.
3. "Let It Go," Idina Menzel: – This is another sensational song; it will pour romance and thrill in the life of listeners. Thus, it is a suitable song for parties, celebrations and at the time of loneliness. This is a best happy song by Idina Menzel that has captured the hearts of everyone who once listen this song.
4. "Roar," Katy Perry: – Roar is among the best sensational song of the year that highly fits in the list of top 10 happy songs of the year. This song is a real pleasure and romance that will compel its listeners to enjoy some sensational dance and pleasure in life.
5. "Unwritten," Natasha Bedingfield: – This is another amazing happy song by Natasha Bedingfield, it entertain everyone who is desperate of best songs of the year. Thus, it is among the highly downloaded song and is known for its best music and rhythm.
6. "Happy," Pharrell Williams: – Pharrell Williams has provided another happy song to his fans. This song has eased the life of every one and is now among the list of most popular happy song of the year. This sensational song is known for its best composition, music, and lyrics.
7. "Who Says," Selena Gomez & The Scene: – Who Says is another amazing happy music that is entertaining people who are feeling loneliness and sadness in life. This will be the best music that will definitely will pour romance and pleasure in life. Thus, this song will definitely entertain and please the listeners.
8. "Beautiful," Christina Aguilera: – Christina Aguilera has provided another song that is super hit of the year. This is another amazing happy song; it will set the mood to romance and pleasure of the listeners. Thus, it is the best songs of every household and can be listened frequently in parties.
9. "Run the World (Girls)," Beyonce: – Run the World is the best song of this year that falls in happy song list. It is highly preferred by people who wish to get rid of stress and tensions of daily life. This song is a powernap for all its listeners and they can pour their life with positive energy.
10. "What Makes You Beautiful," One Direction: – What Makes You Beautiful is the last song in the list, as it best fits in the life of listeners and helps them to set their mood away from the worries and tiredness of life. Thus, people can enjoy its lyrics, music, rhythm, and remain happy.
Thus, people who are looking for the best time, this is the right time to get best and top music for time to set the right mood for pleasure time. Above list provides the best details of all the top 10 happy songs of the current year.


text:
An asinine adventure through the world of high fantasy.4.48 / 5.00 2,073 Views
Nothing To Fear
Super villainy at its worst ...4.17 / 5.00 3,322 Views
The Ascent of Alfred
Make Alfred Great Again4.09 / 5.00 8,071 Views
i didnt see anything funny in it, and it automatically loses 5 points for using a computer voice.
Please try harder.
Zim Clock that is a good idea for a Clock.
Despite the low quality of animation - seen in the reviews you said you spent 3 hours on it and I think that is pretty good for 3 hours. The jokes and the overall style was good. I am going back on for the easter eggs.
Zim just can't get along with anyone...
Not Good
Bad Idea,Needs A Little Improvement but good Graphics. mmmmmmmmmmmm5\10 and 3\5, I Feel Generous
omg an alien, omg help...
hahaha, not to bad...
Not bad.
You asked anyone who watches this video to review so that's what I'm doing.
Good video. Not great but good


text:
Arts, Games & Hobbies, Video Games, Technology, Tech NewsFollow
|Games & Hobbies
|Video Games
The Instance: Weekly radio for fans and lovers of World of Warcraft. We don't take sides, we don't whine, we just give you the facts, news and tips that you want and need for your favorite online addiction. Come meet us at the stone for another Instance!
September 30th, 2016
Episode 284 of 288 episodes
So we are a month in, and LOVING every part of Legion. Patrick not happy with PVP or the economy. More people leaving. Someone has to be first in the nightmare and more!
You'll need to sign in to write a comment.
Creators of the upcoming humor and advice book, Laura Lane and Angela Spera candidly breakdown real-life dating disasters with a new "reason why you're single" every week.


text:
Check rates!
WiFi available in all areas, WiFi, Internet services, Free WiFi
Private parking, On-site parking, Parking, Free parking
From 14:00 Until 21:00 hours
From 06:00 Until 12:00 hours
Pets allowed
Like this one, but not quite sure yet?
Hotels Wok Tum
Properties nearby – The Ford SunSet Beach Resort
Nearby Cities – The Ford SunSet Beach Resort
Top Destinations: Thailand
Flexible travel plans?
Didn't find the right property?
All fields marked with an * must be filled in.


text:
Absolutely faultless! Newcastle fans are loving £5m star
The Newcastle United man continues to impress for the Magpies.
Page 42
The Newcastle United man continues to impress for the Magpies.
Should Leeds United try move for the West Ham United forward?
Arsenal failed to win against Middlesbrough in the Premier League on Saturday.
Ibrox side Glasgow Rangers were extremely active in the summer transfer window.
Arsenal and Middlesbrough played out a 0-0 draw at the Emirates on Saturday.
Everton lost against Burnley in the Premier League on Saturday.
Liverpool won against West Bromwich Albion in the Premier League on Saturday.
West Ham United did brilliantly to hold on to Dimitri Payet over the summer but could a change of ownership at his former club see him lured home?
It is debatable whether Rangers actually relish their Sunday afternoon instant shot at redemption.
John Hartson has discussed Brendan Rodgers' choice between Moussa Dembele and Leigh Griffiths.
The West Ham United teenager deserves a place on the bench against Chelsea later this month.
Newcastle's summer signing from Hull was a target for criticism despite his side's win against Barnsley.
Aston Villa could benefit from the Hull City star's impending return.


text:
Energy Tools MOD Minecraft PEFree
Download free mod Tool Energy. It will allow you to feel the full force of the steep, magical weapons! To the power of this weapon will outshine even the coolest diamond sword. Exploding, Fire, Ice, and other bows.Your opponents will run in fear before You. Swords with the forces of the elements will shatter any enemy! Shields will protect You from damage! Experience new sensations from Minecraft with mod Energy Tool absolutely free. For fashion work you need BlockLauncher Features: - full description - easy installation - nice interface - absolutely free Requires a connection to the Internet This is an unofficial application for Minecraft Pocket Edition. This app is not associated in any way with Mojang AB. The Minecraft Name, the Minecraft Brand and the Minecraft Assets are all property of Mojang AB or their respectful owner. All rights reserved. In accordance with http://account.mojang.com/documents/brand_guidelines
Downloads: 5+Report app for spam or abuse!
Entertainment > More Entertainment for Android
Recommended apps
Hotstar live TV movies cricket Free
Watch the latest TV Shows, Movies and LIVE sports on your Android device completely free of charge!
Automatic Call Recorder Free Free
by simplicity of memorize we have this apps also have facilty to save all the incoming/outgoing call
Vuclip Search: Video on Mobile Free
Get the official free Vuclip Video App for unlimited entertainment on the go!
DittoTV Free
Ditto TV is an entertainment revolution that delivers LIVE TV & Video on Demand on your Mobile & PC.
Android TV_Free MobileTV Free
Android TV is A Mobile Television Network that allows you to watch Android TV Channels completely fr


text:
SEVEN months after a post-graduate student of Nasarawa State University, Keffi, Miss Cynthia Osokogu was killed by friends she met on social media, Facebook, an undergraduate of Kogi State University, Lokoja, Kogi State, Oludoyi Bamidele Samuel, has been abducted by a kidnap syndicated, facilitated by a friend he also met on Facebook.
Samuel was, however, lucky, as he is alive to tell the story of how his supposed friend, identified as Michael (surname unknown) by the Delta State Commissioner of Police, Mr. Ikechukwu Aduba, lured him from Enugu to Warri, Delta State.
A kidnap gang facilitated by Michael, currently at large, held him hostage for three days before Police officers from the Special Anti-Robbery Squad, SARS, stormed their hideout at Uzor Street, Agbarho, and seized three of the suspects.
They demanded N5 million ransom from Samuel's mother to effect his release and were relocating him to another location when the police pounced on them. Read the full details in Vanguard
Share this information with your friends
Follow liveschoolnews on facebook and twitter


text:
Modeling Modern Network Attacks and Countermeasures Using Attack Graphs
- Alice Ford
- 1 years ago
- Views:
1 Modeling Modern Network Attacks and Countermeasures Using Attack Graphs Kyle Ingols, Matthew Chu, Richard Lippmann, Seth Webster, Stephen Boyer MIT Lincoln Laboratory 244 Wood Street Lexington, Massachusetts Abstract By accurately measuring risk for enterprise networks, attack graphs allow network defenders to understand the most critical threats and select the most effective countermeasures. This paper describes substantial enhancements to the NetSPA attack graph system required to model additional present-day threats (zero-day exploits and client-side attacks) and countermeasures (intrusion prevention systems, proxy firewalls, personal firewalls, and host-based vulnerability scans). Point-to-point reachability algorithms and structures were extensively redesigned to support reverse reachability computations and personal firewalls. Host-based vulnerability scans are imported and analyzed. Analysis of an operational network with 85 hosts demonstrates that client-side attacks pose a serious threat. Experiments on larger simulated networks demonstrated that NetSPA s previous excellent scaling is maintained. Less than two minutes are required to completely analyze a four-enclave simulated network with more than 40,000 hosts protected by personal firewalls. I. INTRODUCTION Enterprise networks are constantly under attack from a continuous stream of threats. Some are widespread, such as the conficker worm [1]; others are highly targeted, such as the recently analyzed GhostNet activities [2]. Currently, no accurate automated approach exists to predict the risk these and other threats pose to specific networks. This is one of the primary goals of our research. Accurate automated risk assessments would make it possible to compare the risk of multiple threats, select effective countermeasures, predict the threat posed by hypothesized attacks, and determine the effectiveness of planned and past security expenditures. This requires accurate models of adversaries, of networks, of vulnerabilities, and of a network s mission or purpose. Over the past few years we have developed a tool named NetSPA that uses attack graphs to model adversaries and the effect of simple countermeasures [3] [5]. It creates a network model using firewall rules and network vulnerability scans. It then uses the model to compute network reachability and attack graphs representing potential attack paths This work is sponsored by the United States Air Force under Air Force Contract FA C Opinions, interpretations, conclusions and recommendations are those of the authors and are not necessarily endorsed by the United States Government. for adversaries exploiting known vulnerabilities in server software ( server-side vulnerabilities). This discovers all hosts that can be compromised by an attacker starting from one or more initial locations. Asset values assigned to each host measure the utility of hosts to a network s purpose or mission. Degradation in mission capability is then represented by the percentage of the total asset value threatened by the attacker. NetSPA scales roughly as O(n log n) as the number of hosts in a typical network increases. It has been used to analyze actual networks with more than 3,000 hosts and simulated networks with nearly 50,000 hosts. Risk is assessed for different adversaries and countermeasures by measuring the total assets that can be captured by an adversary and also by measuring the attacker effort as suggested in [6]. We currently compute simple measures of attacker effort, such as the number of hops or stepping-stone hosts, the effort required to exploit given vulnerabilities as defined by CVSS [7], and the number of unique exploits required to compromise all exploitable hosts in the network. Past research on using automated attack graphs to model adversaries (e.g., [5], [8]) including our own has used threat and countermeasure models that are now out of date. The most common threat model used in the past is of an attacker compromising hosts via server-side vulnerabilities, and the primary countermeasure explored is patching these vulnerabilities. This paper describes how we extended the NetSPA tool to model additional modern threats and countermeasures. In the remainder of this paper we first describe the most important new attacks and defenses and our modeling approach. We then present the extensive changes in reachability computation required by these models, followed by evaluations on a small real network and large simulated networks. The paper ends with a discussion of related work, limitations, and future work. II. MODELING CLIENT-SIDE ATTACKS Some of the most important modern threats are vulnerabilities in web browsers, clients, document viewers, and multimedia applications running on victim machines,
2 or client-side vulnerabilities (e.g., [9], [10]). There are many potential vectors for exploiting such vulnerabilities. We model client-side attacks in which an attacker adds malicious content to a server that a victim then downloads unknowingly. Additional vectors such as malicious and encrypted tunnels are considered as future work. Client-side vulnerabilities must be found to be modeled. Prior attack graph systems (e.g., [8], [11]) identified only server-side vulnerabilities using network-based scanners such as Nessus [12]. These scanners are unsuitable for detecting most client-side vulnerabilities, even when login credentials are provided, because they do not examine many details of installed client software. Recent advances in the Security Content Automation Protocol (SCAP) program [13] make it possible to obtain details necessary to model clientside vulnerabilities in a consistent manner across different operating systems. In section VI-B we describe how we use an Open Vulnerability Assessment Language (OVAL)-based scanner, running on each host, to detect and collect clientside vulnerabilities. Client-side attacks require a host-to-host reachability computation that can be considered backwards from that required for server-side attacks. For a server-side attack, we must determine if an attacker can reach the victim host s vulnerable server. For a client-side attack, we must instead determine if the malicious server can be reached by a vulnerable client. Section V-D describes NetSPA s reverse-reachability system. III. MODELING ZERO-DAY ATTACKS Another important modern threat is an attacker with knowledge of an unpublished, or zero-day, vulnerability [10]. Although it is impossible to predict the existence of any specific zero-day vulnerability, it is possible to hypothesize a zero-day vulnerability in specific software applications to ensure that the impact of an eventual zero-day can be understood and minimized. We evaluate zero-day risk by hypothesizing a zero-day vulnerability in each application on a network, one at a time, and building an attack graph for each new vulnerability to assess attacker effort. We then order applications by the benefit provided to an attacker, were a zero-day available. This allows defenders to focus on those application instances that provide the most attacker benefit. They can uninstall, move, limit ingress or egress, or monitor these installations more closely with an anomaly-based intrusion detection system (IDS). Proper modeling of zero-day vulnerabilities requires an inventory of server and client software on each computer. Ideally such an inventory would use the new SCAP-based Common Process Enumeration (CPE) standard [13], [14], as it provides a consistent name for all applications. CPE entries typically provide an OVAL plugin designed to detect the software; thus a host-based OVAL scanner could gather application information. Until CPE matures, we model only server-side zero-day vulnerabilities by assuming that each protocol and port represents a different application. For example, NetSPA posits the existence of a piece of software called 25/tcp, running on every device with TCP port 25 open. Although not ideal, our current approach is automatable and provides useful results on large networks without requiring additional host-based scanning. IV. MODELING MODERN COUNTERMEASURES Many countermeasures can be deployed to defend enterprise networks [15]. In this section we describe how some of the most common countermeasures have been included in NetSPA. These include personal firewalls that filter traffic at the host level, intrusion prevention systems (IPSs) that block disallowed types of web content such as ActiveX controls, and proxy firewalls that provide a common protected outgoing client connection to the Internet for many hosts in a network. Personal firewalls, also called endpoint or host-based firewalls, are installed on individual hosts to control incoming and outgoing traffic. In an enterprise, these firewalls are often centrally managed and use identical rulesets. NetSPA s previous reachability system [4] was designed only for inline firewalls typically used at network borders. The prior system s performance rapidly deteriorated with many personal firewalls because each personal firewall was modeled separately as an inline firewall. Section V-F describes our new system, which restores performance by grouping personal firewalls with identical rulesets together. This required developing new software to import rules used by personal firewalls, redesigning our reachability model, and rewriting substantial parts of NetSPA s reachability computation system. Intrusion prevention systems (IPSs) are used to protect vulnerable hosts by blocking incoming malicious content. Two aspects of IPSs need to be modeled: their effect on vulnerabilities, and their impact on reachability. Because small changes in malicious code can often elude IPS signatures, many IPSs block entire classes of potential attack vectors ActiveX controls or Java applets, for example. Modeling this behavior requires a mapping between the blocked attack vector and the vulnerabilities that depend on that vector for exploitation. This mapping is currently created by automated keyword searches on NVD vulnerability descriptions followed by manual confirmation. Creating a mapping in this manner is far from ideal; future SCAP standards such as CPE may provide more automatable means of making this connection. IPS systems can be deployed as inline proxies, much like inline firewalls. They can also be deployed as nontransparent proxies, to which client machines must explicitly connect. The proxy then connects to the desired server. Using a mapping of attack vector to vulnerabilities, NetSPA
3 can model the effect of both types of IPS systems via simple adjustments to its reachability model. These changes are detailed in Section V-E. V. REACHABILITY Attack graph generation tools require, at a minimum, answers to two core questions: where are the vulnerabilities, and what are the restrictions on attackers ability to exploit them? Vulnerability scanners answer the first question. The answer to the second must be inferred from the network s underlying topology and the firewalls and routers that dictate traffic flow. We are thus required to model the network s topology and filtering devices in an efficient manner. NetSPA s network model supposes that an individual host possesses one or more interfaces, each of which may have an IP address. These interfaces have zero or more open ports, accepting connections from other hosts. A port has a port number and protocol. Each host and port may have zero or more vulnerability instances, particular flaws or configuration choices which may be exploitable by an attacker. A straightforward means of representing a network s reachability is an I K matrix, where I represents the number of interfaces and K represents the number of server ports. A given cell in the matrix indicates whether traffic from the source interface to the target port is permitted. Although straightforward, it is often large and redundant. The remainder of this section explores the methods used to make reachability computation tractable in large networks. Our previous work [3], [4] handled filtering and NAT rules as discussed in Sections V-A and V-B, though the ordering of rules was far less flexible than the system now described. Section V-C discusses new rule-based branching, used to handle devices with multiple potential egress paths for traffic. Section V-D and V-E cover additions made to accommodate client-side attacks, non-transparent proxies, and IPS systems. Finally, Section V-F covers NetSPA s aggressive grouping strategies, designed to identify and leverage redundancy in the I K matrix. A. Firewall Model NetSPA models reachability using tuples of the form [source IP -> target IP:portnum/ protocol]. Much like the FIREMAN [16] system, these sets are represented as binary decision diagrams (BDDs). A BDD is an efficient way to represent a Boolean equation like x (z y), such that evaluating the equation on a set of variable assignments can be evaluated in time proportional to the number of Boolean variables, rather than to the length of the Boolean expression. The variables are the bits of the reachability tuple for example, the source IP in an IPv4 network can be represented as 32 bits, or 32 Boolean variables. Because the number of variables is fixed, we can traverse the BDD in constant time. Like FIREMAN, NetSPA implements BDDs via the BuDDy library [17]. NetSPA models firewalls via rules, rulegroups, and chains. A rule matches a subset of reachability and acts upon it; these actions include allowing and denying the traffic. The specific dispositions are discussed later. Every rule belongs to a rulegroup. A rulegroup consumes a set of reachability as input and produces three output sets <A,D,R>. The A, D, R notation, adapted from FIREMAN, refers to the set of allowed traffic (A), denied traffic (D), and traffic that was not acted on by an allow or deny rule (R). Achain points to a rulegroup and dictates the next step for traffic in each of the rulegroup s three output sets. Each interface in the network is assigned an inbound and an outbound chain to adjudicate traffic passing through it. Inbound chains are used to explicitly designate how traffic moves through a host. Traffic that is given the default disposition, but refers to the inbound interface s listening address, is assumed to go to the host, i.e., to a port on the firewall itself. Outbound chains apply only to traffic from the host itself, not to traffic passing through the host but originating elsewhere. To traverse a rulegroup, we take the input source set S of reachability and traverse the rules, in order, one at a time. For rule number i, we consider <A,D,R i >, where A is the traffic that has already been accepted, D is the traffic that has already been denied, and R i is the traffic that was not accepted or denied by a rule prior to rule i. Foraset of n rules, we begin with < A,D,R 1 >=<,, S >; the final result is <A,D,R n+1 >. We write R n+1 as simply R. Filtering rules are the easiest to model, as they simply accept or deny traffic. For example, the rule [ * -> :25/tcp ]: ALLOW permits any available traffic targeting port number 25, protocol tcp, address to pass (i.e., go to the A output). To evaluate an allow rule i, we use the FIREMAN method of assigning it a match set P i, a BDD representing what the rule itself matches. For this example, P i is [ * -> :25/tcp ]. Of the reachability not yet acted upon (R i ), we must take what the rule matches and move it to A: R i+1 = R i P i A = A (R i P i ) A deny rule is handled similarly. A rulegroup with only filtering rules need only be evaluated once; the result can be reused for multiple potential source sets. It is sufficient to start with <,, >, compute < A,D,R >, and then, for any source set S, compute <A S,D S,R S > as the output.
4 B. Network Address Translation The FIREMAN system is very powerful and handles filtering rules very well, but it does not consider network address translation (NAT) rules. NAT rules modify the contents of R i, usually by manipulating either the source address (source NAT, or SNAT) or the target address or port (destination NAT, or DNAT). NetSPA s reachability system models both. NetSPA s handling of NAT rules via BDDs uses BuDDy s exist function. exist(x, Y ) takes all variables used in Y and removes them from X, essentially resetting those variables to a do not care state. For example, exist(y x (z y),y)=x z. This can be used to remove restrictions on sections of the reachability tuple. For example, consider the NAT rule [ /24 -> :25/tcp ] : SNAT to This rule changes the source IP address of matched reachability to , while the destination address, protocol, and port remain unchanged. We model a NAT rule using three BDDs. Recall that a filtering rule has only P i, the traffic matched by the rule. For a NAT rule, we build P i as well. We also require M i, the mask set representing the information that the rule changes every bit changed is set to one, and all other bits are left unset. Lastly, we require T i, the transform set, representing the translated value imposed by the rule. For the example rule, P i is [ /24 -> :25/tcp ], M i is [ > * ], and T i is [ > * ]. To process a NAT rule, we first isolate traffic that the rule matches. This, like a filtering rule, is computed as (R i P i ). Second, we compute the modified reachability by using the exist function to remove the values to be changed (M i ). Finally, we use T i to insert the changed values, taking care to not manipulate traffic that the rule does not match (R i P i ). R i+1 =(R i P i ) (exist(r i P i,m i ) T i ) NAT rules, by themselves, do not permit or deny traffic; A and D are unaltered. Consider as an example the rulegroup shown in the lefthand side of Figure 1. For this example we drastically simplify reachability by ignoring destination port and protocol, and restricting the source and destination addresses to the sets (1, 2, 3, 4) and (a, b, c, d), respectively doing so allows us to visually depict the resulting I K reachability matrix, shown in the upper left of the figure. In the matrix, a gray cell represents true, and white represents false. For illustrative purposes, we begin with S =(1, 2, 3). The first rule accepts only traffic from 1 to a (shown as 1 a), thus adding P i R i =1 a to the accept disposition A and passing the remainder R i P i to the next rule. The second rule is a NAT rule, translating reachability from source address 1 to the source address 4. As a result, eth0 Figure 2. Chain 1 Accept 1 a NAT 1 * to 4 Accept 4 b + accept disposition - deny disposition? default disposition + -? Chain 2 Chain 3 2 b: Goto Accept * b NAT 4 b to d NAT * b to d Example Arrangement of Three Chains with Three Interfaces 1 (b, c, d) is removed from R i+1, as it s been translated to something else, and 4 (b, c, d) is added; this value proceeds to the next rule. The final rule is another filtering rule, accepting traffic from 4 to b. It adds R i P i =4 b to the accept disposition A and removes P i from R i+1. The final result is A =(1 a, 4 b),d =,R= ((2, 3), 4 (c, d)). C. Branching between chains Transitioning between chains is accomplished via chain dispositions, which determine the destination of traffic from each of the three answers < A,D,R >. For example, consider the three chains shown in Figure 2. Here, the accept set of chain 1 becomes the input to chain 3, and the accept set of chain 2 exits the firewall via interface eth1. In addition to chain-to-chain branching, it is sometimes desirable to branch to another chain from within a rule. NetSPA supports two rule dispositions for this purpose: goto and plusgoto. In both cases, the traffic matched by the rules (R i P i ) is sent to another chain as its input S. A goto rule prevents the matched traffic from continuing in the original rulegroup (R i+1 = R i P i ); a plusgoto rule does not (R i+1 = R i ). NetSPA uses plusgoto rules extensively to model routing where multiple valid routes exist; via plusgoto rules, NetSPA can explore all of the possible routes in order to perform a worst-case evaluation. The combination of chains and the edges between them creates a directed acyclic graph, e.g., the graph shown in Figure 2. We refer to a chain that directly receives traffic from a given interface as that interface s entry node, and any chain that directly sends traffic to an interface as one of the interface s exit nodes. D. Reverse Reachability To support client-side attacks, NetSPA s reachability system has been extended to efficiently compute reachability backwards, starting at the malicious server and working backwards to the vulnerable clients. This could be accomplished by computing forward reachability from every host on the network. However, on networks with solid restrictions on outbound traffic, it is more efficient to traverse reachability chains, and their rules, backwards. To compute reverse reachability through a firewall, we must posit a set of reachability T that we wish to run + -? + -? eth1 eth2
5 from to abc d INPUT S = INPUT accept disposition deny disposition default disposition Accept 1 a NAT 1 * to 4 Accept 1 a NAT 1 * to 4 Forward Reachability + -? ACCEPT Accept 4 b DENY DEFAULT Reverse Reachability ACCEPT Accept 4 b DENY DEFAULT T = <,, > Figure 1. Simplified Example Reachability Flow Through a Rulegroup: Forward and Reverse backwards from a given subnet, through all interfaces connected to that subnet. For a given interface, we identify the interface s exit nodes and walk the chain graph backwards from them to all other interfaces entry nodes. Within a rulegroup, we walk the rules in reverse as well. Each rule disposition is handled differently. An allow rule must remove from R i+1 everything that the rule matches, because such traffic would never have been sent to R i+1 by the rule. It must also add to R i everything in A that the rule matches, as it would have flowed through the rule to A: R i =(R i+1 P i ) (A P i ) Deny rules are similar. NAT rules are more complicated. M i is unchanged, but we must use a new P i, the reachability after the NAT rule was applied, and T i, the altered reachability before the NAT rule makes its changes. For example, consider the NAT rule we evaluated in Section V-B: /24 -> :25/tcp : SNAT to M i remains the same, P i becomes > :25/tcp, and T i becomes /24 -> *. We do not remove the NAT rule s output from R i, as it could have occurred on its own; a NAT rule that translates X to Y does not prevent Y from occurring in the absence of X. We process the NAT rule as follows: R i = R i+1 (exist(r i+1 P i,m i ) T i ) Goto rules remove what they match, because that reachability would have been sent to some other chain: R i = R i+1 P i. Plusgoto rules have no effect: R i = R i+1. However, goto and plusgoto rules are treated differently when we branch back to them from another chain: in this case, evaluation of the rulegroup begins at the goto or plusgoto rule, not at the end of the rulegroup. We therefore begin at the goto/plusgoto rule i with everything that the rule could have sent to the chain that we re now coming from: <A,D,R i >=<,,P i S >. For example, consider again the chain graph of Figure 2 and hypothesize traffic traveling backwards through eth2. We begin on Chain 3 with T =<,, >. Processing backwards, we would arrive at the start of Chain 3 with S =. This propagates to the accept disposition of Chain 1, and also to the goto rule in the middle of chain 2 s rulegroup. Upon arrival at the goto rule, we compute P i, yielding R i =2 b; the only traffic that could have been sent to Chain 3 by this goto rule is P i =2 b, so that is all that could be propagated backwards. From chain 2, the result 2 b becomes the input to the default disposition of Chain 1. We can now traverse Chain 1 s rulegroup backwards, as shown in the right-hand side of Figure 1. The input is T =<,, 2 b>. The last rule in the rulegroup, Accept 4 b, computes R i =(R i+1 P i ) (A P i ); as a result, R i = ((2, 4) b). The NAT rule manipulates the contents of R i in reverse,
6 translating 4 back to 1 but not removing 4. The resulting R i = ((1, 2, 4) b). Finally, the first filtering rule acts on <,, (1, 2, 4) b>. From this, P i R i =(1 a), so it s added to the final answer, R 1 = ((1, 2, 4) b, 1 a). This is the sum total of reachability that could enter eth0 and emerge from eth2 as part of our originally hypothesized set T =<,, >. The discussion above focuses on traffic through firewalls. Addressing traffic from a victim host that has its own rules, or to a malicious server that has not disabled its own firewall, uses similar principles. If the traffic is from a victim host with address X, we start at the interface s outbound chain with T =< X,, > and travel backwards as before. Traffic to a firewalled malicious server, however, is more complicated, because there are no explicit exit nodes any chain reachable from the inbound chain could provide reachability to the host itself. The NetSPA system therefore computes forward reachability via S =<,, >, keeping track of all chains reached, and then performs reverse reachability from all of those chains as potential exit nodes. E. Non-Transparent Proxies and IPS Systems Transparent proxies look just like inline firewalls. To use a non-transparent proxy, however, a client machine must be configured to explicitly connect to the proxy host, which then makes the connection on the client s behalf. From a reachability perspective, the client only connects to the proxy, but the proxy can then connect to anywhere else on behalf of the client. We model this situation in NetSPA via destination NAT. We add a NAT rule of the form [ * -> X : DNAT to * ], where X is the proxy server s own IP and port number. Other target values, such as protocol and port number, could be wildcarded as desired. IPS systems that then restrict the servers that can be contacted could be modeled by adding deny rules after the DNAT rule. NetSPA uses a similar trick to model the effect of an IPS. Assuming a mapping from attack vector to vulnerabilities exists, NetSPA models the IPS by treating it like a firewall. NetSPA s filtering model has been extended to permit blocking traffic based on vulnerability, adding vulnerability to the normal tuple of source IP, destination IP, destination port, and protocol. F. Grouping Hosts and Firewalls An I K matrix for representing reachability is typically highly redundant; on typical networks, groups of interfaces are treated identically by the firewalls and other filtering devices. Interfaces within such a group will have identical rows in the matrix, as they will all be able to reach the same ports. NetSPA identifies these forward reachability groups and computes only one row for each, saving both time and space. To do this, NetSPA collects the set N of all IP address singletons and ranges used in all firewall rules. Two interfaces on the same subnet with identical rules can be grouped together if their listening addresses are in the same subset of N ; reachability for one is identical to reachability for the other. The grouping operation on a network with I interfaces and L rules is O(IL + I log I), but the savings obtained by running the algorithm is substantial. In the ideal case of a network with one interconnected internal subnet and a firewall that does not differentiate between the network s hosts, the factor of I in the I K matrix size can effectively drop out and be replaced by a constant. In the pathological case of a network where each interface is treated differently, then no savings are achieved. In practice, we ve found that real networks typically receive a substantial benefit from this approach. In the first case explored in Section VI-B2, we dropped from 65,025 cells to 3,825 a factor of 17 savings in time and memory. NetSPA can use a similar approach to create reverse reachability groups, combining redundant columns in the I K matrix. In addition, NetSPA groups hosts with identical personal firewall rulesets by forming target reachability groups. Two single-homed hosts are in such a group if they are on the same subnet and their inbound chains are isomorphic; that is, they use the same rulegroup and all of the chains dispositions are isomorphic. NetSPA s reachability engine can then traverse a target reachability group s common rules once to attempt reachability to every host in the group. However, the extra context means that the system also knows to traverse their chains, outbound and inbound, when traffic moves between members of the group. VI. PERFORMANCE To evaluate the scalability of the new system, we conducted a number of measured tests on various synthetic networks. All tests were executed on a 2.4GHz Pentium 4 computer running Linux with 1GB of RAM. Peak memory measurements were done via Linux s libmemusage.so library. We measured runtime via wallclock. For timing tests, the system was run five times, discarding the first result and averaging the remaining four. In all cases the system posited an external attacker, computed reachability as needed, constructed the attack graph, and computed recommended remediation steps. A. Full- and Partially-Synthetic Networks We begin by comparing the new system s ability to aggregate personal firewalls to the previous system s costly workaround. We use a set of test data from a small 251-host network. We placed identical synthetic personal firewalls on 52 of the hosts and varied the number of rules in the common ruleset from 0 to 10,000; these results are shown in the top of Figure 3. We then varied the number of hosts
7 Performance vs. Number of Personal Firewalls Old System (time) New System (time) Old System (memory) New System (memory) Performance vs. Number of Hosts (4 Enclaves) Time Memory Time (w/ Personal FW) Memory (w/ Personal FW) 40,960 hosts Performance vs. Personal Ruleset Size Old System (time) New System (time) Old System (memory) New System (memory) Time (seconds) Memory Usage (Δ MB) Time (seconds) Memory Usage (Δ MB) Number of personal firewalls Performance vs. Number of Firewall Rules (4 Enclaves) Time Memory Time (w/ Personal FW) Memory (w/ Personal FW) 16,384 rules Time (minutes : seconds) Memory (MB) Time (minutes : seconds) Memory (MB) Number of hosts Number of rules Number of rules per firewall Figure 3. NetSPA Performance with Personal Firewalls; Old System of [4] vs. New System Figure 4. NetSPA Performance with Enclave, Rule, and Host Scaling; New System with personal firewalls from 0 to 52, fixing the common ruleset at 250 rules. These results are shown on the bottom of Figure 3. In both cases we show the total time consumed, as well as the change in memory consumption from the zero point of the X axis. We show only the change in memory so scaling effects can clearly be seen between the two systems, as the differences in baseline memory requirements are comparatively unimportant. The benefit of the new system is clear: adding additional personal firewalls with a shared ruleset causes almost no impact. Adding rules to the ruleset causes a roughly linear increase, though this is difficult to see because the system remains very fast throughout the test. In practice, we would not expect personal firewall rulesets to exceed 2,000 rules. We conducted additional scalability experiments on the synthetic network shown in Figure 5. As shown, the network Figure 5. Outside DMZ Internal Enclave 1 Enclave 2 Enclave 3 Enclave 4 Synthetic Network Structure Used for Scaling Experiments includes a border firewall, a DMZ, an internal network, and four additional enclaves, each with its own border firewall. An attack path from the outside, to the DMZ, to the inside, and finally to each enclave was established. Ten ports were assigned to each host, half of which were assigned one vulnerability each. In the first case, shown on the top of Figure 4, we kept the number of rules constant at 250 per firewall and varied only the total number of hosts in the network. We show results
8 with and without personal firewalls, where the personal firewalls used common per-enclave rulesets of 250 rules. The graph s scale is log-linear and shows the tool s ability to handle large numbers of hosts in seconds. In the second case, shown on the bottom of Figure 4, we leave the number of hosts constant at 1,250 and vary the number of rules on each firewall. We again show results with and without personal firewalls; here, the number of rules on the personal firewalls equals the number on the infrastructure firewalls. The graph s scale is log-linear and shows that running time remains under two minutes in the typical 100 to 2,000 rules per firewall expected in practice. B. Evaluation on a Real Network We also evaluated the system using a real network of 85 hosts behind a Juniper Netscreen firewall. We began by collecting typical data, consisting of a Nessus scan and the Juniper firewall ruleset. We then collected additional hostbased data, discussed in Section VI-B1, and then evaluated several scenarios on the network in Section VI-B2. 1) OVAL Scanning: We deployed the OVAL scanner on the target network s Windows-based hosts and collected vulnerability scan data every time a user logged into the Windows domain. Over the course of a month, we obtained 155 scans of 43 hosts, logging a total of 402 unique vulnerabilities over that time. The NVD database categorized 233 of them as clientside vulnerabilities (the NVD entries have the user_init flag set). The remainder were classified as locally exploitable (26) or remotely (server-side) exploitable (143); of those 143, 25 are said to yield root access when exploited. We randomly chose ten of the 25 remote-to-root vulnerabilities identified as remotely exploitable and evaluated them by hand, examining the NVD entries and additional references. The ten CVE IDs and their evaluations appear in Table I. Based on our evaluation, eight of the ten were incorrectly classified as server-side vulnerabilities. This result makes us hesitant to trust NVD s otherwise solid data when evaluating a vulnerability that is suspected to be client-side. Until this is addressed, we suggest mitigating the risk of false negatives in the attack surface by considering all vulnerabilities discovered by OVAL to be client-side vulnerabilities and additionally using a networkbased scanner to discover server-side vulnerabilities. 2) Experiments: Data in hand, we began evaluating the results with NetSPA. In all cases we hypothesized an adversary on the outside of the firewall. The results of this and all other experiments on the real network are shown in Figure 6. Figure 6a clearly shows that the situation is dire; all 169 of the server-side vulnerabilities and 51 of the 84 hosts can be exploited directly, through the perimeter firewall. We investigated the reachability traces provided by NetSPA and identified three rules which were permitting the majority of the inbound traffic. All three were intentional, allowing traffic from an asset management server and a handful of machines that belonged behind the enclave but weren t physically located there. As a hypothetical hardening measure, we removed these rules. The adversary could now only directly compromise 69 vulnerabilities as shown in Figure 6b. Once past the firewall, of course, the other 100 can still be exploited from an initially compromised host, as shown by the light gray squares. All 51 vulnerable hosts are exploited, although only 22 are exploited in the first step. We then discovered an omission in the Juniper ruleset: a server called MS-WINS was used in an allow rule, but the port number was not defined. NetSPA models the worst case, so it assumed the rule allowed traffic to any destination port number. When redefined with the appropriate WINS port number of 1512, as shown in Figure 6c, the network became impervious to attack as shown, the vulnerabilities are known but cannot be exploited, and no hosts are compromised. At this point we introduced the OVAL scans from Section VI-B1, adding knowledge of 514 client-side vulnerabilities to the network. As shown in Figure 6d, the adversary could immediately take advantage, compromising even more hosts than before 65 instead of 51 as we are now aware of client-side vulnerabilities on hosts that had no serverside vulnerabilities. First, the client-side vulnerabilities are compromised, and then the server-side vulnerabilities can be attacked from any of those initially compromised hosts. We next added available data on personal/endpoint firewalls on the network, but they did not impede the adversary, as they did not restrict traffic from the adversary s starting location or from hosts within the enclave itself. As a final step, we hypothesized an inline IPS capable of blocking exploits against Microsoft Office. We assumed, for example, that an adversary relying on a vulnerable client downloading a corrupt Word document would be thwarted. Note that we are neglecting simple attacker workarounds, such as convincing the client to use an encrypted connection, but for the sake of example we assume the adversary is using unobfuscated transmission methods. Figure 6e shows the impact such an IPS could have; 267 of the client-side vulnerabilities are no longer immediately compromisable from the outside, though the same number of hosts (65) are still eventually compromised. What-if experiments such as these could help defenders decide if potential changes are worthwhile investments. VII. RELATED WORK To the best of our knowledge, no other commercial or research tools that use attack graphs to assess network risk include explicit models of personal firewalls, intrusion prevention systems, or modern client-side attacks. A comprehensive review of past attack graph research is presented in [8]. More recent approaches include [11], [18], and [19]. The
9 CVE ID Description Client-side? CVE Buffer overflow in Microsoft Word in a.doc file yes CVE vulnerability in Adobe Acrobat Reader ETD document yes CVE overflow in the DHCP Client service for Microsoft Windows 2000 yes CVE Workstation service (wkssvc.dll)... via NetrJoinDomain2 RPC no CVE (OLE) Automation in Microsoft Windows... remote attackers... via a crafted script yes request (from Microsoft: could allow remote code execution if a user viewed a specially crafted Web page. CVE Universal Plug and Play (UPnP) service... crafted HTTP headers no CVE An ActiveX control... is marked as safe for scripting yes CVE Microsoft Office Publisher... via crafted.pub file yes CVE Windows Media Player replies to authentication requests yes CVE Windows Media Player credential-reflection attacks, by sending an authentication request yes Table I EVALUATION OF TEN ALLEGEDLY REMOTE-TO-ROOT VULNERABILITIES FOUND BY OVAL Figure 6. Order of Vulnerability Instance Compromise in Six Scenarios. The upper bar represents compromised hosts: white is uncompromised; light gray is compromised via a stepping-stone host; dark gray is compromised immediately. The lower graphic represents vulnerability instances: white squares indicate known but uncompromisable vulnerabilities; light gray squares indicate vulnerabilities that can only be compromised via a stepping-stone host; dark gray squares indicate an immediately exploitable vulnerability. Topological Vulnerability Analysis (TVA) system [20] used in [11] does not explicitly model any type of firewall or analyze firewall rules. Instead, a subset of the network s host-tohost reachability is estimated using exhaustive host-to-host vulnerability scans. This introduces quadratic complexity, scales poorly to large networks, and complicates firewall modeling. This system also relies on a network vulnerability scanner and does not gather information about client-side attacks. The MulVAL system [21] used in [18] also does not explicitly model firewalls but assumes reachability is provided. Research in [19] uses our prior NetSPA system and thus scales well, but like our prior research, modern attacks and countermeasures are not modeled. Commercial attack graph products such as RedSeal [22] and Skybox [23] model firewalls and compute reachability from firewall rules but neither product s website mentions the ability to model personal firewalls, IPSs, or client side attacks. There are many papers on firewall ruleset analysis and a few companies that analyze rulesets. Wool et al. [24] provides typical sizes for rulesets and confirms that firewall configuration errors are very common. Systems like FIREMAN [16], FANG [25] and a few companies (e.g., AlgoSec [26], RedSeal [22], Skybox [23]) detect different types of firewall misconfigurations such as overlapping or contradictory rules. Some also compute reachability and determine if firewalls enforce an overall policy. We use BDDs from [16] for efficient rule application which are similar in purpose to Michigan State s Firewall Decision Diagrams (FDDs) [27] [29]. VIII. LIMITATIONS AND FUTURE WORK The current NetSPA tool includes many countermeasures and attacks, but these need to be supplemented and improved. Some additional countermeasures we plan to add include the Federal Desktop Core Configuration (FDCC) for Windows, application white listing on hosts, and filtering provided by IPSs for exploits related to specific vulnerabilities. We also plan to model additional threats such as conficker [1] that use restricted exploit sets and propagation vectors. We additionally plan to model adversaries exploiting trust relationships between hosts, for example by using open Windows shares or shares protected by weak or common passwords. We also plan to explore more complex client-side attacks and model attacks specific to web sites and database
10 servers such as SQL injection and cross-site scripting. Virtual machines offer another exploit vector that should be considered, as access to the host OS allows compromise of all guest OS images. Improved modeling of zero-day attacks will involve capturing the application inventory on clients using OVAL and adding the ability to insert hypothetical zero-day vulnerabilities into the applications discovered. Field tests of the tool are always highly instructive; they generally involve importing rules from additional types of firewalls and performing further tests on actual networks. The tool s usability will also be improved via further refinements to the attack graph GUI [5]. REFERENCES [1] P. Porras, H. Saidi, and V. Vegneswaran, An analysis of conficker s logic and rondezvous points, SRI International, Tech. Rep., February [2] S. Nagaraja and R. Anderson, The snooping dragon: socialmalware surveillance of the tibetan movement, University of Cambridge, Computer Laboratory, Tech. Rep. UCAM-CL- TR-746, Mar [3] R. Lippmann et al., Validating and restoring defense in depth using attack graphs, in IEEE Military Communications Conference (MILCOM), [4] K. Ingols, R. Lippmann, and K. Piwowarski, Practical attack graph generation for network defense, in ACSAC. IEEE Computer Society, 2006, pp [5] L. Williams, R. Lippmann, and K. Ingols, GARNET: A graphical attack graph and reachability network evaluation tool, in Visualization for Computer Security (VizSEC), ser. Lecture Notes in Computer Science, J. R. Goodall, G. J. Conti, and K.-L. Ma, Eds., vol Springer, 2008, pp [6] D. L. Buckshaw et al., Mission oriented risk and design analysis of critical information systems, Military Operations Research, vol. 10, pp , [7] P. Mell, K. Scarfone, and S. Raomanosky, A complete guide to the common vulnerability scoring system version 2.0, in Forum of Incident Response and Security Teams (FIRST), [8] R. P. Lippmann and K. Ingols, An annotated review of past papers on attack graphs, MIT Lincoln Laboratory, Project Report IA-1, [9] IBM Internet Security Systems X-Force 2008 trend and risk report, IBM Global Technology Services, Tech. Rep., [10] D. Turner et al., Symantec internet security threat report, trends for July - December 07, Symantec, Tech. Rep., [11] S. Noel and S. Jajodia, Optimal IDS sensor placement and alert prioritization using attack graphs, Journal of Network and Systems Management, vol. 16, no. 3, pp , [12] Tenable. Nessus security scanner. [Online]. Available: [13] R. Martin, Making security measurable and manageable, in IEEE Military Communications Conference (MILCOM), [14] Common platform enumeration. MITRE. [Online]. Available: [15] R. Ross et al., Recommended security controls for federal information systems and organizations, National Institute of Standards and Technology, NIST Special Publication , Revision 3, February [16] L. Yuan et al., FIREMAN: A toolkit for FIREwall modeling and ANalysis, in IEEE Symposium on Security and Privacy. IEEE Computer Society, 2006, pp [17] J. Lind-Nielsen et al. BuDDy, a binary decision diagram library. [Online]. Available: [18] R. E. Sawilla and X. Ou, Identifying critical attack assets in dependency attack graphs, in 13th European Symposium on Research in Computer Security (ESORICS), S. Jajodia and J. López, Eds., vol Springer, 2008, pp [19] N. Pham, L. Baud, P. Bellot, and M. Riguidel, A near realtime system for security assurance assessment, in 3rd International Conference on Internet Monitoring and Protection (ICIMP), 2008, pp [20] S. Jajodia, S. Noel, and B. O Berry, Topological Analysis of Network Attack Vulnerability. Kluwer Academic Publisher, 2003, ch. 5. [21] X. Ou, S. Govindavajhala, and A. Appel, MulVAL: A logicbased network security analyzer, in Proceedings of the 14th USENIX Security Symposium, 2005, pp [22] RedSeal. (2009, April) Redseal systems. [Online]. Available: [23] Skybox. (2009, April) Skybox security, inc. [Online]. Available: [24] A. Wool, A quantitative study of firewall configuration errors, Computer, vol. 37, no. 6, pp , June [25] A. Mayer, A. Wool, and E. Ziskind, Fang: A firewall analysis engine, in IEEE Symposium on Security and Privacy, 2000, pp [26] Algosec. [Online]. Available: [27] A. Liu, E. Torng, and C. Meiners, Firewall compressor: An algorithm for minimizing firewall policies, in 27th Conference on Computer Communications (INFOCOM). IEEE, 2008, pp [28] C. Meiners, A. Liu, and E. Torng, TCAM Razor: A systematic approach towards minimizing packet classifiers in TCAMs, in 15th IEEE International Conference on Network Protocols (ICNP), 2007, pp [29] A. Khakpour and A. Liu, Quarnet: A tool for quantifying static network reachability, Michigan State University, East Lansing, Michigan, Tech. Rep. MSU-CSE-09-2, January 2009.
Continuous Security Metrics for Prevalent Network Threats: Introduction and First Four Metrics
ESC-TR-2010-099 Project Report IA-3 Continuous Security Metrics for Prevalent Network Threats: Introduction and First Four Metrics R.P. Lippmann J.F. Riordan T.H. Yu K.K. Watson 22 May 2012 Lincoln LaboratoryMore information
June 8, 2011. (Revision 1)
Unified Security Monitoring Best Practices June 8, 2011 (Revision 1) Copyright 2011. Tenable Network Security, Inc. All rights reserved. Tenable Network Security and Nessus are registered trademarks ofMore information
Guidelines on Firewalls and Firewall Policy
Special Publication 800-41 Revision 1 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology Karen Scarfone Paul Hoffman NIST Special PublicationMore information
Guidelines on Firewalls and Firewall Policy
Special Publication 800-41 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology John Wack, Ken Cutler, Jamie Pole NIST Special Publication 800-41More information
The Critical Security Controls for Effective Cyber Defense. Version 5.0
The Critical Security Controls for Effective Cyber Defense Version 5.0 1 Introduction... 3 CSC 1: Inventory of Authorized and Unauthorized Devices... 8 CSC 2: Inventory of Authorized and Unauthorized Software...More information
Malware Defense Using Network Security Authentication
Proceedings of the IEEE International Information Assurance Workshop, 2005 Malware Defense Using Network Security Authentication Joseph V. Antrosio and Errin W. Fulp Wake Forest University Department ofMore information
Security Guidance for Deploying IP Telephony Systems
Report Number: I332-016R-2005 Security Guidance for Deploying IP Telephony Systems Systems and Network Attack Center (SNAC) Released: 14 February 2006 Version 1.01 firstname.lastname@example.com ii This Page IntentionallyMore information
Security Audits of Multi-tier Virtual Infrastructures in Public Infrastructure Clouds
Security Audits of Multi-tier Virtual Infrastructures in Public Infrastructure Clouds Sören Bleikertz IBM Zurich Research Laboratory email@example.com Dimitrios Pendarakis IBM T.J. Watson Research CenterMore information
Data protection. Protecting personal data in online services: learning from the mistakes of others
Data protection Protecting personal data in online services: learning from the mistakes of others May 2014 Contents Introduction... 2 What the DPA says... 4 Software security updates... 5 Software securityMore information
Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies. October 2009
Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies October 2009 DISCLAIMER This report was prepared as an account of work sponsored by an agency ofMore information
Firewall Strategies June 2003 (Updated May 2009)
Firewall Strategies June 2003 (Updated May 2009) 1 Table of Content Executive Summary...4 Brief survey of firewall concepts...4 What is the problem?...4 What is a firewall?...4 What skills are necessaryMore information
DDoS Attack and Defense: Review of Some Traditional and Current Techniques
1 DDoS Attack and Defense: Review of Some Traditional and Current Techniques Muhammad Aamir and Mustafa Ali Zaidi SZABIST, Karachi, Pakistan Abstract Distributed Denial of Service (DDoS) attacks exhaustMore information
Intrusion Detection Techniques for Mobile Wireless Networks
Mobile Networks and Applications? (2003) 1 16 1 Intrusion Detection Techniques for Mobile Wireless Networks Yongguang Zhang HRL Laboratories LLC, Malibu, California E-mail: email@example.com Wenke Lee CollegeMore information
FIREWALL DEPLOYMENT FOR SCADA AND PROCESS CONTROL NETWORKS GOOD PRACTICE GUIDE 15 FEBRUARY 2005 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC)More information
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In thisMore information
Securing EtherNet/IP Networks
Securing EtherNet/IP Networks Table of Contents 1 Introduction... 3 2 Basic Overview of Risk and Security Approach... 4 2.1 Risk and Risk Analysis... 4 2.2 Reducing Risk... 5 2.3 Costs and Tradeoffs...More information
Log Correlation Engine Best Practices
Log Correlation Engine Best Practices August 14, 2012 (Revision 3) Copyright 2012. Tenable Network Security, Inc. All rights reserved. Tenable Network Security and Nessus are registered trademarks of TenableMore information
Network Support for IP Traceback
226 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 9, NO. 3, JUNE 2001 Network Support for IP Traceback Stefan Savage, David Wetherall, Member, IEEE, Anna Karlin, and Tom Anderson Abstract This paper describesMore information
Port Blocking A BROADBAND INTERNET TECHNICAL ADVISORY GROUP TECHNICAL WORKING GROUP REPORT. A Uniform Agreement Report
Port Blocking A BROADBAND INTERNET TECHNICAL ADVISORY GROUP TECHNICAL WORKING GROUP REPORT A Uniform Agreement Report Issued: August 2013 Copyright / Legal Notice Copyright Broadband Internet TechnicalMore information
SAFE: A Security Blueprint for Enterprise Networks
WHITE PAPER SAFE: A Security Blueprint for Enterprise Networks Authors Sean Convery (CCIE #4232) and Bernie Trudel (CCIE #1884) are the authors of this White Paper. Sean is the lead architect for the referenceMore information
LOAD BALANCING FOR HIGH-SPEED PARALLEL NETWORK INTRUSION DETECTION. A Thesis. Submitted to the Graduate School. of the University of Notre Dame
LOAD BALANCING FOR HIGH-SPEED PARALLEL NETWORK INTRUSION DETECTION A Thesis Submitted to the Graduate School of the University of Notre Dame in Partial Fulfillment of the Requirements for the Degree ofMore information
SYMANTEC ADVANCED THREAT RESEARCH. The Teredo Protocol: Tunneling Past Network Security and Other Security Implications
SYMANTEC ADVANCED THREAT RESEARCH The Teredo Protocol: Tunneling Past Network Security and Other Security Implications Dr. James Hoagland Principal Security Researcher Symantec Advanced Threat ResearchMore information
Implementing PCI A Guide for Network Security Engineers Updated For PCI Data Security Standard Version 1.2.1
Payment and Security Experts Implementing PCI A Guide for Network Security Engineers Updated For PCI Data Security Standard Version 1.2.1 Tom Arnold, CISSP, ISSMP, CFS, CPISM/A, PCI/QSA Partner, PSC SponsoredMore information
Guide to Security for Full Virtualization Technologies
Special Publication 800-125 Guide to Security for Full Virtualization Technologies Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya Paul Hoffman NISTMore information
Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries
Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries Aaron Johnson 1 Chris Wacek 2 Rob Jansen 1 Micah Sherr 2 Paul Syverson 1 1 U.S. Naval Research Laboratory, Washington DC {aaron.m.johnson,More information
Load Shedding for Aggregation Queries over Data Streams
Load Shedding for Aggregation Queries over Data Streams Brian Babcock Mayur Datar Rajeev Motwani Department of Computer Science Stanford University, Stanford, CA 94305 {babcock, datar, firstname.lastname@example.com information
This guide aims to assists asset owners to maximise the return on their investment when commissioning assessments of their ICSs.
Executive summary Cyber security has become a vital part of conducting business in today s world. The threats to organisations and individuals are real. Industrial Control Systems (ICSs) were originallyMore information
Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications
Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications Sebastian Poeplau, Yanick Fratantonio, Antonio Bianchi, Christopher Kruegel, Giovanni Vigna UC Santa Barbara SantaMore information
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics Mark Handley and Vern Paxson AT&T Center for Internet Research at ICSI (ACIRI) International Computer ScienceMore information
Application-level simulation for network security
Application-level simulation for network security Stephan Schmidt, Rainer Bye, Joël Chinnow Karsten Bsufka, Ahmet Camtepe and Sahin Albayrak firstname.lastname@example.com DAI-Labor, Berlin Institute of Technology,More information