text:
SEC505: Securing Windows and PowerShell Automation
Sun, October 23 - Fri, October 28, 2016
You have the best instructors available. Other training never comes close and is a waste of money.
This is my fifth SANS course. Jason is exceptionally hard working instructor who adds tremendous value with his unrestricted contributions to the community.
SECURITY 505: Securing Windows and PowerShell Automation
Hackers know how to use PowerShell for evil, do you know how to use it for good? In SEC505 you will learn PowerShell and Windows security hardening at the same time. SecOps requires automation, and Windows automation means PowerShell.
You've run a vulnerability scanner and applied patches - now what? A major theme of this course is defensible design: we have to assume that there will be a breach, so we need to build in damage control from the beginning. Whack-a-mole incident response cannot be our only defensive strategy - we'll never win, and we'll never get ahead of the game. By the time your monitoring system tells you a Domain Admin account has been compromised, it's TOO LATE.
For the assume breach mindset, we must carefully delegate limited administrative powers so that the compromise of one administrator account is not a total catastrophe. Managing administrative privileges is a tough problem, so this course devotes an entire day to just this one critical task.
Learning PowerShell is also useful for another kind of security: job security. Employers are looking for people with these skills. You don't have to know any PowerShell to attend the course, we will learn it together. About half the labs during the week are PowerShell, while the rest use graphical security tools. PowerShell is free and open source on GitHub for Linux and Mac OS too.
This course is not a vendor show to convince you to buy another security appliance or to install yet another endpoint agent. The idea is to use built-in or free Windows and Active Directory security tools when we can (especially PowerShell and Group Policy) and then purchase commercial products only when absolutely necessary.
If you are an IT manager or CIO, the aim for this course is to have it pay for itself 10 times over within two years, because automation isn't just good for SecOps/DevOps, it can save money, too. Besides, PowerShell is also simply fun to use.
This course is designed for systems engineers, security architects, and the Security Operations (SecOps) team. The focus of the course is on how to automate the NSA Top 10 Mitigations and the CIS Critical Security Controls related to Windows, especially the ones that are difficult to implement in large environments.
SEC505 will also prepare you for the GIAC Certified Windows Security Administrator (GCWN) certification exam to prove your Windows security expertise. The GCWN certification counts towards a Master's Degree in Information Security from the SANS Technology Institute (www.sans.edu) and satisfies the Department of Defense 8570 computing environment requirement. The GCWN is also a foundational certification for soldiers in the U.S. Army's 255-S Information Protection Program, especially now that the DoD has standardized on Windows 10.
This is a fun course and a real eye-opener, even for Windows administrators with years of experience. We don't cover patch management, share permissions, or other such basics - the aim is to go far beyond that. Come have fun learning PowerShell and agile Windows security at the same time!
You Will Learn
- How to use PowerShell for security automation
- How to run PowerShell scripts on thousands of hosts
- How to do SecOps/DevOps continuous enforcement
- How to deploy and manage a Windows PKI
- How to manage privileges for assumed breach
- How to do endpoint protection for assumed breach
- How to do pre-forensics to help the Hunt Team
- How to secure Kerberos, DNS, TLS, RDP and SMB
- How to use PowerShell WMI for the Blue Team
Day 1: PowerShell Automation and Security
- New to scripting? No problem!
- Quick intro to scripting, such as ForEach loops
- PowerShell remote command execution
- Transcription logging for forensics
- Parsing and mining nmap port scanner XML output
- Searching event logs faster with XPath queries
- Writing your own functions and scripts
- Capturing command output for parsing
- Preparing to pipe .NET objects, not text
Day 2: Continuous Secure Configuration Enforcement
- PowerShell Desired State Configuration (DSC)
- Using Group Policy to target PowerShell scripts
- Scheduling elevated PowerShell tasks safely
- Empowering the Hunt Team and incident responders
- Server hardening automation for DevOps
- Why Server Nano and Server Core?
- Microsoft Security Compliance Manager (free tool)
- Windows Operating System and application hardening tools
- Customizing INF security template text
- Group Policy continuous enforcement
Day 3: Windows PKI and Smart Cards
- Windows Public Key Infrastructure (PKI) can be fun!
- Installing and managing a PKI, a step-by-step walk through
- Detecting malicious trusted root Certification Authorities with PowerShell
- Hands-free Group Policy deployment of certificates
- Private key archival and lost key recovery
- How to quickly deploy smart cards for admins
- Best practices for private key security
- Installing an Online Certificate Status Protocol (OCSP) responder
- Issuing a code signing certificate for PowerShell scripts
- Scripting to compare file hashes, like a poor-man's Tripwire
Day 4: Administrative Compromise and Privilege Management
- PowerShell Just Enough Admin (JEA)
- Automate local Administrators group management
- Limiting privileges, logon rights, and permissions
- LSASS memory protections against DLL injection
- Token abuse and pass-the-hash attack mitigations
- User Account Control (UAC) and smart cards
- Safely delegating IT power for least privilege
- Active Directory permissions for IT delegation
- Designing Organizational Units for administrative least privilege
- Active Directory logging of bad admins
- Windows 10 facial biometrics and Credential Guard
Day 5: Endpoint Protection and Pre-Forensics
- Application whitelisting with AppLocker
- Automating AppLocker with PowerShell
- PowerShell constrained language mode
- Microsoft's benevolent rootkit: EMET
- IPSec is not just for VPNs!
- IPSec is built into Windows for endpoint protection
- IPSec share permissions for TCP/UDP ports
- PowerShell scripting of Windows Firewall rules
- Group Policy management of Windows Firewall
- Pre-forensics for incident response preparation
- Pre-forensics requires particular audit policies
- System snapshot baselines to help the Hunt Team
Day 6: Defensible Networking and Blue Team WMI
- Windows Management Instrumentation (WMI)
- PowerShell for WMI scripting
- Group Policy use of WMI filters
- Remote Desktop Protocol (RDP) weaknesses
- Hardening TLS and eliminating SSL
- SSL/TLS cipher suites for perfect forward secrecy
- Kerberos armoring and restricting NTLM
- PowerShell management of DNS records
- DNS sinkholes for malware and phishing sites
- Implementing DNSSEC with PowerShell and Group Policy
- DNS secure dynamic updates with Kerberos
- SMBv3 encryption and downgrade attacks
- How to disable IPv6 tunneling, but keep IPv6
Course Syllabus
SEC505.1: PowerShell Automation and Security
Jason Fossen
Sun Oct 23rd, 2016
Today's course covers what you need to know to get started using PowerShell. You don't need to have any prior scripting or programming experience. We have PowerShell labs throughout the week, so today is not the only PowerShell material. We start with the essentials, then go more in depth as the week progresses. Don't worry, you won't be left behind, the PowerShell labs walk you through every step.
About half the labs this week are PowerShell, the rest use graphical security tools (some of which actually run on top of PowerShell). A six-day course on nothing but PowerShell would be too exhausting, so we mix Windows security and PowerShell together to make it more fun and practical. SEC505 has had at least one day of PowerShell since 2007, so we know how to get the right mix (for the more advanced scripters, we also talk about WMI, JEA, and DSC later in the week).
PowerShell is made for Security Operations (SecOps) automation on Windows. PowerShell is built into Windows 7, Server 2008, and later operating systems by default. Linux and Mac OS users can download PowerShell from GitHub. SecOps requires automation in order to scale out security changes and monitoring beyond a handful of hosts. For example, when a vulnerability must be remediated but there is no patch for it yet, automation is needed to quickly and consistently enact the changes necessary.
PowerShell "remoting" is encrypted remote command execution of PowerShell scripts in a way that can scale to thousands of endpoints and servers. It is vastly better than PSEXEC. Imagine being able to hunt for indicators of compromise across thousands of machines with just a few lines of PowerShell code. Or imagine having the local Administrator account password reset every night on thousands of endpoints in a secure way, and being able to retrieve that password securely too. We will show how to do these tasks and more.
We will also talk about security for PowerShell itself, such as transcription logging for forensics, strong encryption, code signing, application whitelisting of scripts, IPSec port control, and Just Enough Admin (JEA). JEA is like Linux sudo and setuid, but for PowerShell remoting.
As more and more of our systems are moved up to the cloud, PowerShell will become even more important. Amazon Web Services, Microsoft Azure, Office 365, Hyper-V and VMware already support PowerShell administration for many tasks, and open source PowerShell is available for Linux and Mac OS too. So learning PowerShell is not only good for network security, it's also good for job security.
CPE/CMU Credits: 6
Overview and Security
- Transcription logging to catch hackers
- IPSec and firewall rules for remoting
- AppLocker for PowerShell
- Just Enough Admin (JEA)
- Constrained language mode to block hackers
- Customizing your profile script
Getting Around Inside PowerShell
- Don't memorize, use the built-in help
- Cool tricks with the ISE graphical editor
- Piping .NET and COM objects, not text
- Using properties and methods of objects
- Helping Linux admins feel more at home
- Aliases, cmdlets, functions, modules, etc.
What Can We Do With It?
- PowerShell remoting and scalability
- Capturing the output of commands
- Parsing text files and logs with regex patterns
- Searching remote event logs faster with XPath
- Mounting the registry as a drive
- Parsing and mining nmap port scanner XML output
- Running scripts as scheduled jobs
- Pushing out scripts through Group Policy
- What can't we do with it?
Write Your Own Scripts
- Writing your own functions
- Function parameters and returning output
- Flow control: if-then, do-while, foreach, switch
- The .NET Framework class library: a playground
- How to pipe data in/out of your scripts
SEC505.2: Continuous Secure Configuration Enforcement
Jason Fossen
Mon Oct 24th, 2016
Running a vulnerability scanner is easy; remediating vulnerabilities across a large number of systems is what can be difficult. Most vulnerabilities are fixed by applying patches, but this course does not talk about patch management, you're doing that already. What about the other vulnerabilities, the ones not fixed by applying patches? These vulnerabilities are, by definition, remediated by configuration changes. Enter SecOps.
So here is the challenge: How do we automate configuration changes across many endpoints and servers? How do we continuously reinforce these configuration changes to make sure they "stick," and that the desired configuration is automatically reapplied again if the host somehow drifts away from what we want? And by the way, we want to do this all for free, using only built-in Windows and Active Directory tools, and do it in a way that is relatively easy whether we have 100 or 10,000 hosts. Is this possible? Yes, we can do it with PowerShell and Group Policy!
Group Policy Objects (GPOs) are like configuration templates that can be applied and re-applied automatically. Desired State Configuration (DSC) is a PowerShell feature that can automatically return a machine to the desired configuration we want (hands-free) if the machine drifts away from this configuration. DSC is like Puppet or Chef, but built into PowerShell for free. DSC is good for DevOps too, not just SecOps.
Group Policy and PowerShell are made for each other. We can use Group Policy to push out PowerShell scripts to hundreds of thousands of hosts and have the scripts executed hands-free, even if no one is logged on, then return data back to us through Server Message Block (SMB) shares, syslog packets, or some other mechanism. Group Policy can also be used to manage scheduled jobs, and these jobs can run PowerShell scripts related to forensics, monitoring, continuous configuration enforcement, or kill chain commands. For example, we can hunt for indicators of compromise, gather inventory data, reset passwords, create/delete/disable/enable user accounts, kill malicious processes, remove malicious services/drivers, remotely hash files for tripwire-like integrity checking, search remote event logs, write to event logs, send syslog packets, and much more. This is how we can help the Hunt Team and incident responders to fight back!
You might be familiar with Group Policy already, but today's course emphasizes the targeting capabilities of Group Policy. How can we precisely target a security template or PowerShell script to just the machines in a particular global group, or just to the Server Nano VMs, or just to the Windows 7 laptops that have Adobe Acrobat installed, or just to the Windows 10 tablets that have a particular indicator of compromise? Group Policy gives us a scalable targeting system for PowerShell and security templates.
CPE/CMU Credits: 6
Continuous Secure Configuration Enforcement
- How to use Group Policy and PowerShell together
- Automate with INF security templates
- How to customize INF templates
- Microsoft Security Compliance Manager (SCM)
- SECEDIT.EXE scripting
- Building an in-house security repository for SecOps/DevOps
Group Policy Precision Targeting
- Managing Group Policy Objects (GPOs) with PowerShell
- LSDOU, Block Inheritance, Enforced GPOs
- Group Policy permissions for targeting changes
- ADMX templates for mass registry editing
- Deploying PowerShell startup and logon scripts
- WMI item-level targeting of GPO preferences
- GPO scheduled tasks to run PowerShell scripts
- Remote command execution via GPO (not remoting)
- Empowering the Hunt Team to fight back!
Server Hardening for SecOps/DevOps
- Server Manager scripting with PowerShell
- Adding and removing roles and features
- Remotely inventory roles, features, and apps
- Why Server Nano or Server Core?
- Running PowerShell automatically after service failure
- Service account identities, passwords, and risks
- Tools to reset service account passwords securely
PowerShell Desired State Configuration (DSC)
- DSC is like Puppet or Chef, but built in for free
- Using DSC for continuous reinforcement of settings
- Writing your own DSC configuration scripts
- Free DSC resource modules: www.PowerShellGallery.com
- How to push DSC configurations to many targets
- DSC background job processing in push mode
- Examples: sync files, install roles, manage groups
- Auditing a remote target against a DSC MOF template
- "ApplyAndAutoCorrect" mode for continuous enforcement
SEC505.3: Windows PKI and Smart Cards
Jason Fossen
Tue Oct 25th, 2016
Don't believe what you hear on the street: Public Key Infrastructure (PKI) is not that hard to manage on Windows! You'll be pleasantly surprised at how much Group Policy, Active Directory, and PowerShell can help you manage your PKI. And we don't really have a choice anymore: having a PKI is pretty much mandatory for Microsoft security.
This day of the course is basically one long hands-on lab to install and configure a full Windows Server PKI. This includes a root Certification Authority (CA), Group Policy certificate auto-enrollment on endpoints, Online Certificate Status Protocol (OCSP) revocation checking, private key roaming for users, smart card certificate deployment, and, of course, more PowerShell examples.
Even if you already have a PKI, this course will still be useful for you, since the hardest part of PKI is the endpoint management, not the CA installation.
Digital certificates have an essential role in Windows security. Certificates are used with smart cards, S/MIME e-mail, SSL/TLS to web servers, VPNs, PowerShell remoting, BitLocker drive encryption, the Encrypting File System (EFS), IPSec computer authentication, code signing, AppLocker process whitelisting, Device Guard policies, user authentication to web services, and more. As we move towards the cloud and Bring Your Own Device (BYOD) mobile devices, having your own PKI will become even more important.
Everything you need to roll out a smart card solution for your administrators is included with Windows, except for the cards and readers themselves (and generic cards are available in bulk for cheap). If you have a Trusted Platform Module (TPM) chip in your laptop or tablet, the TPM can also be used as a built-in smart card. TPM-based smart cards are invisible to users, requiring little or no training. Smart cards can hold other certificates too, such as for Remote Desktop Services, BitLocker, EFS, and code signing.
Because malware can inject fake root Certification Authority (CA) certificates into our machines, we will also look at PowerShell scripts to audit and manage trusted root CA certificates on endpoints. When hackers alter the trusted root CAs on our endpoints, it subverts the authentication provided by SSL/TLS and allows the attackers to create digitally-signed malware that our users will blindly trust.
The labs in today's course mostly use graphical PKI tools, but there are also PowerShell labs to delete unwanted certificates installed by malware, audit our lists of trusted CAs, perform file hashing, compare thousands of recorded file hashes at two different times (similar to Tripwire), and encrypt secret data in our own PowerShell applications, such as for encrypting admin passwords.
CPE/CMU Credits: 6
Why Is A PKI Necessary?
- PKI is for strong authentication and encryption
- Passwords are obsolete, we need smart cards!
- Examples: VPNs, wireless, IPSec, SSL, S/MIME, etc.
- Certificates for mobile endpoints and BYOD
- Code signing certificates for AppLocker and PowerShell
How to Install the Windows PKI
- PowerShell installation script for PKI
- PKI installation with Server Manager
- Root versus subordinate CAs
- Enterprise versus Stand-Alone CAs
- Should you be your own root CA?
- Custom certificate templates in Active Directory
- Controlling certificate auto-enrollment
- Set up an Online Certificate Status Protocol (OCSP) responder web farm
- Configure Certificate Revocation List (CRL) publication
How to Manage Your PKI
- Where are private keys?
- Private key security best practices
- PowerShell script to audit trusted root CAs
- PowerShell script to delete hacker certificates
- Group Policy auto-deployment of certificates
- How to revoke compromised certificates
- Automatic private key backup and recovery
- Credential roaming of keys and passwords
- Delegation of PKI management to non-admins
Deploying Smart Cards
- Everything you need is built in!
- Smart cards for Kerberos, BitLocker, EFS, etc.
- TPM virtual smart cards are just too cool...
- Smart cards on a limited budget for the admins
- Safely enroll cards on behalf of other users
SEC505.4: Administrative Compromise and Privilege Management
Jason Fossen
Wed Oct 26th, 2016
Why do submarines have pressure doors to seal off compartments? Because they are designed to assume a breach will occur. In a Windows environment, a security breach will occur, count on it, so we must design with an "assume breach" mindset as well.
If we assume that someday the computers and credentials of our administrators will be compromised, then how do we build damage control into the network from the beginning? This is not about detection and incident response. The challenge here is how to design for damage control when we decide how to delegate administrative privileges. We need to proactively design damage control into the system, not wait until after there is a breach (when it's too late). As always, our guide is the Principle of Least Privilege.
Is there a Windows version of sudo, like on Linux? Yes, it's called Just Enough Admin (JEA) for PowerShell. JEA allows non-admin users to remotely execute commands with administrative privileges, but without exposing any administrative credentials to them (kind of like setuid root on Linux). With JEA, all PowerShell commands are blocked by default except those you explicitly allow, and you can even use regular expression patterns to limit the arguments to those commands. And for less-technical users who'd prefer a graphical interface, don't forget that graphical applications can be built on top of PowerShell JEA too. In this course, we will see how to set up JEA and PowerShell Remoting.
The password of the local Administrator account on every machine must be different and reset at least weekly to limit post-exploitation abuse. We will see how to use scheduled PowerShell scripts to do this in a secure way that's also convenient for the admins when they need the plaintext password. To help defend against pass-the-hash attacks and token abuse, we talk about LSASS memory protections, Windows 10 Credential Guard, restricting network logon rights, User Account Control (UAC), RDP Restricted Admin Mode, and more.
Moving up to Active Directory (AD), we will see that every object in AD has a set of permissions and audit settings that we can leverage for delegation of authority. Instead of simply adding everyone in the IT department to the Domain Admins group, we can more precisely delegate authority at the Organizational Unit (OU) level. We can create an OU Admins group that is just like Domain Admins, except that its power is limited to that one OU only. Then we can create other custom groups, such the Help Desk group or the Auditors group, and grant them the minimum powers they need for the OU too. By analogy, AD forests and OUs can be used like those pressure doors on submarines mentioned earlier.
CPE/CMU Credits: 6
You Don't Know The Power!
- What are the various "admin privileges" on Windows?
- How do we manage privileges on thousands of hosts?
- What privileges can be exploited to take over a machine?
- How to steal a password hash or Security Access Token (SAT)
Compromise of Administrative Powers
- Limiting pass-the-hash and token abuse attacks
- Getting users out of the Administrators group (without a revolt)
- Limiting the power of administrative users
- Limiting privileges, logon rights, and permissions
- User Account Control (UAC) instead of RUNAS.EXE
- Enforcing different per-group password and lockout policies
- Using PowerShell to manage password resets
- Picture password and PIN logons on Windows 10
- Windows 10 biometric logons
- Password managers for administrators
- KeePass best practices and PowerShell script
- Windows 10 Credential Guard
PowerShell Just Enough Admin (JEA)
- JEA is Windows sudo, like on Linux
- JEA is Windows setuid root, like on Linux
- Restricting commands and arguments
- Verbose transcription logging
- How to set up and configure JEA
Active Directory Permissions and Delegation
- Active Directory objects have permissions
- Active Directory objects have auditing
- Empty the Domain Admins group!
- Delegating authority at the OU level instead
- Granting limited powers to the Help Desk
- Designing Active Directory for the inevitable breach
SEC505.5: Endpoint Protection and Pre-Forensics
Jason Fossen
Thu Oct 27th, 2016
You are already applying patches and updating anti-virus signatures. But endpoint protection is much more than that. Because most advanced malware infections start with a compromised endpoint, we want to proactively build defensibility and damage control into our systems using a zero-trust or assume-breach model. How?
The Enhanced Mitigation Experience Toolkit (EMET) is a benevolent rootkit from Microsoft, not an anti-virus scanner. It's one of the several anti-exploitation products that are growing in popularity today. EMET integrates into vulnerable applications, like browsers and PDF viewers, to reduce infection rates and disrupt post-exploitation actions. And EMET is free! In the hands-on lab, we will see how to manage EMET through Group Policy and configuration scripts.
AppLocker is an application whitelisting tool built into Windows to control which executables, scripts, DLLs and installer packages users may run. If hackers or malware attempt to launch an unauthorized process post-exploitation, the aim is to block it and log it. In the lab, we'll use PowerShell and Group Policy to manage AppLocker. Application whitelisting can be hard to manage if used too aggressively, so we'll also talk about how to get started without making the help desk phone ring off the hook.
When we adopt the assume breach mindset, we assume hackers are attacking us and sniffing packets from inside the Local Area Network (LAN). This is how they can move laterally from host to host. When we focus too much on perimeter defenses, these internal malicious actions go unchecked. We need defense-in-depth at the endpoint level. And for more data-centric security, we need to secure sensitive data not just on disk, but also while in motion inside the LAN, not just in motion across the perimeter.
Host-based firewalls can block the lateral movement of hackers inside the LAN and the outbound connections of malware. On mobile devices, we must do host-based packet filtering because mobile devices roam outside the LAN where the perimeter firewall cannot protect them. The trick is being able to apply different sets of firewall rules to different sets of machines in a scalable, repeatable, and automated way. This is what we will do with the built-in Windows Firewall through Group Policy and PowerShell.
IPSec is not just for VPNs! In fact, we won't discuss VPNs at all today. The built-in Windows IPSec driver can authenticate users in Active Directory in order to implement share permissions for our TCP/UDP listening ports based on our users' global group memberships in Active Directory. Imagine configuring the Windows Firewall on your endpoints and servers to only permit access to their RPC, RDP or SMB ports if (1) the client has a local IP address, (2) the computer is pre-authenticated by IPSec to be a member of the domain, (3) the user is pre-authenticated to be a member of the Domain Admins group, and (4) the packets are all encrypted with 256-bit AES. Not only is this possible, today's course will show you exactly how to do it!
Despite our best efforts, we must still assume breach. Pre-forensics describes what we should configure on Windows to prepare for a security incident. It's not about the response itself, it's about the preparations, such as enabling centralized logging. Preparation is half the battle. Pre-forensics also means gathering ongoing operational data to give to the Hunt Team and incident responders while they look for indicators of compromise. When the Hunt Team has a baseline of what is "normal" on a server to compare against, identifying what is new and out of place is vastly easier. PowerShell makes creating these scheduled baseline snapshots easy.
CPE/CMU Credits: 6
- Microsoft's benevolent rootkit: EMET
- EMET scripting and Group Policy
- Application whitelisting with AppLocker
- Scripting AppLocker with PowerShell
- PowerShell constrained language mode
- The Principle of (Endpoint) Least Privilege
IPSec Port Permissions
- IPSec for everything besides VPNs
- We don't discuss VPNs at all today!
- IPSec for blocking lateral post-exploitation
- Limit access to ports based on global group membership
- IPSec-based encrypted VLANs
- Group Policy management of IPSec rules
- PowerShell and NETSH.EXE control of IPSec
Host-Based Firewalls
- PowerShell scripting of Windows Firewall rules
- Group Policy management of Windows Firewall
- Blocking malware outbound connections
- Role-based access control at the network level
- What does "deep IPSec integration" mean?
- Using the firewall logs for network forensics
- Pre-forensics for incident response preparation
- Audit policy and Windows event logs
- System snapshots to help the Hunt Team
- Event log wrapping vs. flush attacks
- Preparation is half the battle
SEC505.6: Defensible Networking and Blue Team WMI
Jason Fossen
Fri Oct 28th, 2016
Hackers love the Windows Management Instrumentation (WMI) service, and so should we. We are the linebackers on the Blue Team and the WMI service was made for us, not them. The WMI service is enabled by default and accessible over the network. Through WMI we can do remote command execution (without PowerShell being installed at the target), forcibly log off the user, reboot the machine, stop services, search for processes running as Administrator, kill any process, and much more. The WMI service is nearly all-powerful and it's built for remote administration. PowerShell is tightly integrated into WMI, and we'll look at several PowerShell examples.
Hackers will try to elevate their privileges and move laterally from machine to machine inside the LAN. One way they do it is by abusing protocols and network services that we cannot live without. Could you live without SSL/TLS, DNS, Kerberos, Remote Desktop Protocol (RDP), or the File and Print Sharing protocol (SMB/CIFS)? Probably not, but these protocols can all be attacked with terrible consequences. In particular, we are totally dependent on DNS, but it is difficult to design a protocol worse than DNS.
Hackers love DNS too, but for all the wrong reasons. There are several things we can do to make DNS more secure though. We can do DNS sinkholing of names used by malware, use DNSSEC, require Kerberos dynamic updates, disable zone transfers, implement a split architecture, and encrypt DNS traffic with IPSec. DNSSEC is vastly easier to configure now than in the past. DNS sinkholing is also very effective in disrupting malware control channels, and sinkholing can be done for free with a PowerShell script. DNS logging helps with threat detection too.
SSL should be eliminated, there are too many flaws in this old protocol. Instead, we should use the latest version of TLS available, and optimize our cipher suites for 256-bit AES with Perfect Forward Secrecy (PFS).
Kerberos Golden Ticket attacks allow hackers to impersonate domain controllers. If this catastrophe were to happen in your environment, how would you respond? We will talk about how to reset the krbtgt password and force immediate Active Directory replication.
Wireshark can sniff SMB traffic to file shares and carve files out of the packet payloads. Hackers can also inject malware into Group Policy Objects as the endpoints download their GPOs over SMB. SMB is plaintext by default, but we'll see how to configure SMB encryption with or without IPSec. It's also time to eliminate SMB 1.0 from our LANs.
Finally, the most popular way to remotely manage Windows is to use the Remote Desktop Protocol (RDP) and a thin client like MSTSC.EXE. But RDP is vulnerable to man-in-the-middle attacks! And an RDP logon can leave admin credentials in memory for malware to steal. As more virtual machines are moved up to the networks of cloud providers, RDP use over the Internet will increase. But with PKI, IPSec encryption, and proper hardening, RDP can be made safe enough to use, even for administrators.
CPE/CMU Credits: 6
PowerShell and WMI
- Windows Management Instrumentation (WMI) service
- What is WMI and why do hackers abuse it so much?
- Using PowerShell to query WMI CIM classes
- Searching remote event logs faster with WMI
- Inventory operating system versions and installed software
- WMI remote command execution versus PowerShell remoting
Hardening DNS
- Why is DNS so easy to attack?
- Don't believe the haters, DNSSEC is fun!
- How to deploy DNSSEC step-by-step
- Kerberos for DNS secure dynamic updates
- DNS sinkholes for malware and threat detection
- Sinkholing unwanted DNS names with PowerShell
- PowerShell management of all networking settings
Dangerous Protocols We Can't Live Without
- Hackers want you to use RDP
- Remote Desktop Pwnage (RDP)
- SSL is dead, long live TLS
- TLS cipher suite optimization
- SMBv3 native encryption vs. Wireshark
- NTLM, NTLMv2, and Kerberos
- Kerberos Golden Tickets (Silver too)
- Kerberos double-encryption armoring
- What about IPv6 tunneling?
Additional Information
Laptop Required
Please bring the following with you when you attend SEC505:
- Laptop with 8GB or more of memory, a USB port, with any operating system you wish.
- A virtual machine (VM) running the free, evaluation version of Windows Server 2012 R2 Datacenter Edition (make sure it is "Server 2012 R2", not just "2012"). Please install your VM before you arrive, not the morning of the training.
- When you install the VM using Microsoft's OS installation program, choose the option for "Windows Server 2012 R2 Datacenter Evaluation (Server with a GUI)". Do not accept the default "Server Core" option.
- Bring a copy of the evaluation ISO file for Windows Server 2012 R2 with you.
- You may use any virtualization software you wish. Windows 10 Pro or Enterprise edition includes Client Hyper-V for running VMs. You can also obtain VMware Workstation Player for free. On a Mac, there is also VMware Fusion and Parallels.
Please don't let your IT department spoil your training experience by giving you a "loaner laptop" that is too slow. Also, do not install Windows Server directly onto your laptop, you must use a VM for the training.
How should the Windows Server training VM be configured?
To test your training VM for the course, please confirm the following:
- In your virtualization software, such as VMware or Hyper-V, configure the VM to use "Host-Only" or "Private" networking (not "NAT", "Bridged" or "External"). Do not apply updates to the VM.
- Confirm that you can log into the VM using the built-in Administrator account. Do not rename the Administrator account or use a different account. Do not install Active Directory or run any SETUP scripts.
- On the desktop of the VM, confirm that it does not say "Evaluation Expired" in the bottom right-hand corner of the desktop. Create a new, fresh VM if your evaluation period has expired (do not run slmgr.vbs).
- Disconnect your host laptop from any wireless network and pull out any networking cables. Then, open the Control Panel inside the training VM, go to the "Network and Sharing Center" applet, click on the "Change adapter settings" link on the left, then confirm that your network interface is still enabled and appears to be connected to a live network. If your VM's network interface cannot stay enabled or connected, right-click that interface and disable it (disable the interface inside the VM, not on your host laptop). You will need to install the Loopback Adapter in Control Panel inside the VM (see instructions below).
If you wish to install VMware Tools or other similar virtualization support software inside your training VM, feel free to do so, but it is not required.
Setup Questions?
If you have questions about the laptop setup, please contact email@example.com. We are here to help!
What does the "Server with a GUI" option look like when installing Windows Server?
You will see the following screen after you've booted your VM from the Windows Server installation ISO file. Choose the "Server with a GUI" option at the bottom of the list.
Where can I get the free evaluation version of Windows Server 2012 R2?
You can download a free trial version of Windows Server 2012 R2 from Microsoft as an ISO image file (an ISO file is an exported copy of a CD/DVD disk). Just do an Internet search on "site:microsoft.com windows server trial eval" to find the download link to the ISO file on Microsoft's web site. Make sure to get Windows Server 2012 R2, not Server 2012.
Bring the ISO file with you on your hard drive when you attend the course.
VMware prompts me for a license number or I get a license error message!
Make sure you have the evaluation version of Windows Server, not the retail version.
When creating the virtual machine in VMWare, it is best to choose the option that says "I will install the operating system later" and then provide the path to the ISO file for Windows Server after the VM has been created, not during the initial creation.
After the VM has been created, go to the Settings of that VM and provide the path to the source ISO file. Now, when you start the VM, there should be no evaluation licensing problems.
Why doesn't SANS just provide attendees with a pre-built virtual machine?
We would if we could! Microsoft does not allow us to redistribute evaluation versions of Windows Server 2012 R2 virtual machines, even though the ISO download is free and does not require a license number.
Do I need to install the Microsoft Loopback adapter? (Most likely not.)
Most likely, you do not need to install the Microsoft Loopback adapter inside your VM. Inside the VM, not on your host laptop, if the VM's network adapter will not stay enabled and connected when your host laptop does not have a live network connection, you will need to install the Microsoft Loopback adapter in Control Panel. This problem is common on older Dell laptops, but rare on other laptops (it's a driver issue, not hardware).
If you need to install the Microsoft Loopback adapter, follow these steps:
First, open the Control Panel inside the training VM, go to the "Network and Sharing Center" applet, click on the "Change adapter settings" link on the left, then right-click your current interface and disable it (this is the non-loopback interface). Go back to the main Control Panel list of applet icons.
Second, in Control Panel inside your training VM, double-click the "Device Manager" applet > right-click your server at the top in Device Manager > select "Add Legacy Hardware" > Next > select "Install the hardware that I manually select from a list (Advanced)" > select "Network Adapters" > Next > choose "Microsoft" as the manufacturer on the left > choose "Microsoft KM-TEST Loopback Adapter" on the right > Next > Next > Finish.
The Microsoft Loopback adapter is a simulated Ethernet network interface card which always appears to be connected to a live network, even though it is not.
If you have additional questions about the laptop specifications, please contact email@example.com.
Who Should Attend
- Security Operations (SecOps) engineers
- Windows endpoint and server administrators.
- Anyone who wants to learn PowerShell automation.
- Anyone implementing the NSA Top 10 Mitigations.
- Anyone implementing the CIS Critical Security Controls.
- Those deploying or managing a Public Key Infrastructure (PKI) or smart cards.
- Anyone who needs to reduce malware infections.
There are no prerequisites to attend the course, but a familiarity with basic Windows and Active Directory concepts is presumed. You do not need any prior scripting experience; we will learn PowerShell as we go along together.
What You Will Receive
- A USB flash drive or DVD disk with over 200 PowerShell scripts written by the course author, plus security templates and other tools used in the labs.
- A set of SEC505 manuals. The manuals are much more than just slides with some sparse notes. They are written as textbooks with screenshots, lab exercises, table of contents, and more. In general, SEC505 attendees rarely need to take hand-written notes during seminar, the notes are already in the books.
- When bundled with the GCWN certification exam, audio recordings of the entire course that you can take with you.
You Will Be Able To
- Execute PowerShell commands on remote systems and begin to write your own PowerShell scripts.
- Harden PowerShell itself against abuse, and enable transcription logging.
- Use Group Policy to execute PowerShell scripts on an almost unlimited number of hosts, while using Group Policy Object permissions, organizational units, and Windows Management Instrumentation (WMI) to target just the systems that need the scripts run.
- Use PowerShell Desired State Configuration (DSC) and Server Manager scripting for the sake of SecOps/DevOps automation of server hardening.
- Assuming a breach will occur, use Group Policy and PowerShell to grant administrative privileges in a way that reduces the harm if an attack succeeds.
- Configure PowerShell remoting to use Just Enough Admin (JEA) policies to create a Windows version of Linux sudo and setuid root.
- Configure mitigations against attacks such as pass-the-hash, Kerberos golden tickets, Remote Desktop Protocol (RDP) man-in-the-middle, Security Access Token abuse, and others.
- Use PowerShell and Group Policy to manage the Microsoft Enhanced Mitigation Experience Toolkit (EMET), AppLocker whitelisting rules, INF security templates, Windows Firewall rules, IPSec rules, and many other security-related settings.
- Install and manage a full Windows Public Key Infrastructure (PKI), including smart cards, certificate auto-enrollment, Online Certificate Status Protocol (OCSP) web responders, and detection of spoofed root Certification Authorities (CAs).
- Harden SSL/TLS, RDP, DNS, and SMB against attacks. This includes deploying DNSSEC, DNS sinkholes for malware, SMB encryption, and TLS cipher suite optimization.
- Use PowerShell with the WMI service, such as remote command execution, searching event logs, and doing a remote inventory of user applications.
Press & Reviews
"Gold standard of Windows security training." - Alexander Kotkov, Ernst & Young
"The best Windows Security course I've attended in 25 years of administering Windows environments. Every time I pick up one of my GCWN books, I learn something new that's immediately applicable to my current situation. A must-have course for any system administrator who is serious about securing their environment." - Armond Rouillard, NES Associates, U.S. Army (retired)
"SEC505 course content is on point with projects I am currently working on to improve our Windows security posture. The lessons learned will help me achieve my project goals with a high degree of confidence and quality." - Anthony DeVoto, EY
"Home run hit for modern Windows security." - Russ Gritto, ERG
"I loved the course, when I return to the office I am recommending it to the rest of my team." - Alex Fox, Federal Home Loan Bank Chicago
"Invaluable! Every day was directly pertinent to what we are doing at work. I wish I had taken this course many years ago." - Jerry Sanchez, Southwest Research Institute
"Every lesson provides information I can immediately use at work when I return." - Dan Fleischer, MiTek Industries
"It's nice to see Windows training that isn't 'controlled' by Microsoft." - Rich Wessler, West Virginia University
"If you think you know Windows, take this Windows security class - your review of your own skills and understanding will be challenged, for the better!!" - Matthew Stoeckle, Nebraska Public Power District
"You will know and be confident how to enable Windows PKI after taking this course. I had no practical experience but plenty of theory. The instructor broke down the pros and cons of the whole process. Excellent!!" - Othello Swanston, DTRA-DOD
Related Courses
- SEC401: Security Essentials provides a foundation in the essential Windows and Active Directory concepts necessary for this course.
- SEC566: Implementing and Auditing the Critical Security Controls presents the overall framework that this course applies. SEC505 is a deep-dive into how to specifically apply this framework to Windows and Active Directory.
- SEC504: Hacker Tools, Techniques, Exploits and Incident Handling presents the hacker's perspective, whereas SEC505 examines how to defend against or mitigate the attacks described in SEC504.
- SEC511: Continuous Monitoring and Security Operations emphasizes threat detection, logging, alerting, and monitoring at both the network and host levels.
Author Statement
The courses I write for SANS are always guided by two questions: (1) What do administrators need to know to secure their networks? and (2) What should administrators learn to advance their careers as IT professionals? I am neither a Microsoft employee nor a Microsoft basher, so you will not get either kind of propaganda here. My concern is with the health of your network and your career. As a security consultant, I have seen it all (good, bad, and ugly), and my experience goes into the manuals I write for SANS and the stories I tell in seminar. The Securing Windows with PowerShell course is packed with interesting and useful advice that is hard to find on the Internet. We always have a good time, so I hope to meet you at the next training event!
- Jason Fossen, SANS Faculty Fellow


text:
> Tropical Traditions sent me their Organic Moisturizing Lotion to review. It smells divine. I love using this first thing when I get out of the shower in the morning, because the citrus really perks up my mood!!
Mandatory: Visit Tropical Traditions and…
Tell me what scent you would choose for the lotion!
Sign up for the Tropical Traditions Newsletter
I received a sample of this product to facilitate my review. Opinions expressed within are my own.

subset: commoncrawl


text:
• Activate your PSP with your Sony Entertainment Network account.
• For more tips and hints on using your PlayStation system, visit our technical support forums at community.eu.playstation.com.
We use cookies to personalise your experience and ads on this site & others. For more info or to change settings, click here.


text:
The Big Bang Theory (2007)
The Big Bang Theory is centered on five characters living in Pasadena, California: roommates Leonard Hofstadter and Sheldon Cooper; Penny, a waitress and aspiring actress who lives across the hall; and Leonard and Sheldon's equally geeky and socially awkward friends and co-workers, mechanical engineer Howard Wolowitz and astrophysicist Raj Koothrappali. The geekiness and intellect of the four guys is contrasted for comic effect with Penny's social skills and common sense.
- Chuck Lorre
- Bill Prady
- Adam Faberman
- Release Date: 2007-09-24
- Views: 2345
- Country: US
- Language: En
- Runtime: 22
Episode 1 - The Electric Can Opener FluctuationRelease Date: 2009-09-21
When Sheldon learns the guys tampered with his expedition data he got from the arctic, he leaves to Texas in disgrace. This results in the guys following him, which threatens Leonard's hope for some romantic time with Penny and the guys' friendship with Sheldon.
Episode 2 - The Jiminy ConjectureRelease Date: 2009-09-28
Leonard and Penny struggle to recover from an awkward first hookup while Sheldon and Howard stake their best comic books on a bet to determine the species of a cricket.
Episode 3 - The Gothowitz DeviationRelease Date: 2009-10-05
Howard and Raj visit a Goth nightclub to pick up women while Sheldon attempts to build a better Penny using chocolate-based behavior modification.
Episode 4 - The Pirate SolutionRelease Date: 2009-10-12
Raj must find a new job or be sent back to India, but Sheldon has a solution, which leaves Leonard and Penny dealing with Howard as a third wheel.
Episode 5 - The Creepy Candy Coating CorollaryRelease Date: 2009-10-19
After overhearing that Wil Wheaton is entering a trading-card competition, Sheldon decides to enter it himself. Meanwhile, Penny sets up one of her friends on a date with Wolowitz.
Episode 6 - The Cornhusker VortexRelease Date: 2009-11-02
Sheldon becomes Leonard's teacher in order to understand football, while an incident with flying a kite threatens Howard and Raj's friendship.
Episode 7 - The Guitarist AmplificationRelease Date: 2009-11-09
A squabble between Leonard and Penny sees Sheldon playing mediator, though out of his own incovenience from the sitiation rather than altruism.
Episode 8 - The Adhesive Duck DeficiencyRelease Date: 2009-11-16
With Leonard, Howard and Raj away camping in the desert, an injured Penny has only Sheldon to rely on.
Episode 9 - The Vengeance FormulationRelease Date: 2009-11-23
After he's humiliated on National Public Radio, Sheldon vows to destroy Kripke, while Wolowitz tries not to destroy his new relationship with Bernadette.
Episode 10 - The Gorilla ExperimentRelease Date: 2009-12-07
Penny gets help from Sheldon in order to understand what Leonard's work is, while Wolowitz develops a jealousy when Leonard starts hanging out with his new girlfriend.
Episode 11 - The Maternal CongruenceRelease Date: 2009-12-14
A Christmas visit from his mother has Leonard discovering she's kept a lot of news from him that she shares with Sheldon and worrying if she'll approve of his romance with Penny.
Episode 12 - The Psychic VortexRelease Date: 2010-01-11
Leonard is aghast to find out a secret of Penny's: she believes in psychics. Meanwhile, Sheldon tries to assist Koothrappali in picking up a girl at a university mixer.
Episode 13 - The Bozeman ReactionRelease Date: 2010-01-18
When their apartment is robbed, Leonard and Sheldon turn to their friends to create a state-of-the-art security system.
Episode 14 - The Einstein ApproximationRelease Date: 2010-02-01
Sheldon's search for the answer to a physics problem leads him to work at the Cheesecake Factory with Penny.
Episode 15 - The Large Hadron CollisionRelease Date: 2010-02-08
Leonard can only bring one guest on a trip to see CERN's Large Hadron Collider (the world's largest and highest energy particle accelerator) in Switzerland on Valentine's Day.
Episode 16 - The Excelsior AcquisitionRelease Date: 2010-03-01
Sheldon winds up in traffic court when he gets a ticket because of Penny.
Episode 17 - The Precious FragmentationRelease Date: 2010-03-08
When the guys find a ring from "The Lord of the Rings" at a garage sale, it threatens to tear them apart.
Episode 18 - The Pants AlternativeRelease Date: 2010-03-22
Sheldon's friends come to his aid when his fear of public speaking stands between him and a coveted award.
Episode 19 - The Wheaton RecurrenceRelease Date: 2010-04-12
A fight between Leonard and Penny threatens their relationship, while Sheldon battles Wil Wheaton in bowling.
Episode 20 - The Spaghetti CatalystRelease Date: 2010-05-03
When Leonard and Penny aren't speaking, Sheldon goes to extremes to keep them both happy.
Episode 21 - The Plimpton StimulationRelease Date: 2010-05-10
Leonard and Sheldon compete for the attention of a famous female physicist.
Episode 22 - The Staircase ImplementationRelease Date: 2010-05-17
Leonard tells Penny about how he met Sheldon for the first time...and what happened to the elevator.
Episode 23 - The Lunar ExcitationRelease Date: 2010-05-24
While Penny worries that dating Leonard has ruined her for normal guys, Wolowitz and Koothrappali search for Sheldon's perfect match online.


text:
A forum about Atari 16/32 computers and their clones. This forum is in no way affiliated with Atari Interactive.
Moderators: Jookie, Moderator Team
ccarl84 wrote:You talk about Paypal. It's your prefered payment ? I don't have Paypal count, I want to pay with transfert Bank.
But if you say to me : "It's better with Paypal to be sure to obtain the C.E. I opened one.
ccarl84 wrote:Hello Jookie,
I'm trying to buy a CE, I can't. It's write "you can buy the device now" and we can't ... I hope it isn't sold out for this morning ?
spiny wrote:yep, page was open for orders for about 30 mins ... I need to be quicker
ccarl84 wrote:Is it possible to know if just for those who pay by bank, our purchase was took into account.
I was able this morning to buy a Cosmos Ex and as I pay by bank transfer, I do not know if my purchase is considered.
areeve wrote:One thing I don't understand about CosmosEx is why I would want one with just ACSI when the one with both SCSI and ACSI costs the same. What am I missing?
Dave400 wrote:I'm very tempted by the Cosmosex, missed out on the current batch by a couple of hours..
Dave400 wrote:I do have a question, although the Zero is rare as chuff at the moment, seeing as it's effectively the same hardware as a Model B could one be used with a wifi dongle in lieu of the wired LAN port?
Rustynutt wrote:Using HD Driver, would the multiple cards be recognized each as a different drive using the CosmosEx as a USB interface to the cards?
AtariSociety wrote:Is there a top to the CosmosEx?
AtariSociety wrote:Also where can I get proper cable to connect it to the Falcon and TT, The Falcon has a SCSI 2 port. I forget but think the TT has both a ACSI and SCSI?
AtariSociety wrote:Lastly, how much is the ACSI/SCSI version with proper cables shipped to USA?
AtariSociety wrote:But what is the cost of the actual device? I would guess the 14 is shipping along. I could not find price of the device itself.
1st1 wrote:But I have an idea which should be quite easy to implement, can you? The idea is the emulation of an ATARI SLM 804/605 laser printer
1st1 wrote:just bitmap format conversion and output to CUPS and then print on any configured printer (locally on USB, shared by other computer with LPR or CIFS/Samba or direct network printer).
Users browsing this forum: No registered users and 8 guests


text:
Why you should add Monaco to your Indie/RTW trip
- Bring your yacht, your pearls and your credit cards to Monaco, the tiny country outside of France famous for its fast cars, high stakes, and big payouts to the world's richest gamblers.
- Monaco is the second smallest independent principality in the world, behind only Vatican City.
- Not exactly the best place for indie travelers, with high costs of travel and few attractions.


text:
Unique seamless abstract design, with inspiring vintage elements. Good quality, neat finition. Best choice for an affordable price. Dare to make someone or yourself the coolest gift!
Design a head rest that matches perfectly with your car seats! Great for office chairs as well to keep your neck and shoulders stress free.
Cushion case material: 100% Polyester
Filled material: 100% 3D polyester fiber
Filling weight: 220g
Approx. dimension: 10.5''(27cm) x9''(23cm) x 4''(11cm)
Note: Cushion come vacuum packed. Please hand fluff cushion to retain its shape once opened
If you order more than 50 pcs items (can be combined), please click here to contact us for whole price quotation, please include the SKU# and the quantity you want for each of them. For order less than 50 pcs, please order directly from our website.


text:
- (2.11) - This update adds wallpapers for widescreen monitors and a SLiM theme for widescreen monitors.
- (2.12) - This update changes the default "Desktop" icon and removes the system sounds.
- (2.11) - This update removes mplayer as a dependency, eliminates a configuration file redundancy, and has the correct commands set to automatically launch Decibel or Totem when you insert a CD or DVD respectively. I'm not sure if the settings to launch Decibel and Totem will be updated in installed systems, but this is necessary for the final release as it definitely applies to newly installed systems.
- (2.12) - This update removes the system sound command from the Fluxbox startup script.
- (2.13) - This update makes OpenOffice use the default GTK theme and changes a couple of commands.
- (0.20) - This update reflects the app and menu changes in the livecd environment, and now looks for ubiquity to make it's changes. Nobody should have any reason to download this, as it's only present in the live environment, is removed by ubiquity, and does absolutely nothing in an installed system.
- (0.21) - Adds "Asunder CD Ripper" to live CD menu.
- (0.6) - This update adds zenity and acpi as dependencies.
- (0.7) - This update adds dummy scripts for skl and sms into /etc/skel so there are no errors on Fluxbox startup.
- (0.8 ) - Removes a few nonworking keyboard layouts from Simple Keyboard.
- (2.10) - This update moves the Fluxbox submenu into the System submenu and prevents GNOME-MPlayer from showing up in the menu. After installing this update, in order to shutdown you will need to log out and hold F6 button, or shutdown from the command line (sudo shutdown -P now). This should only happen once and the system will return to normal the next time you start it. What happens here is replacing mint-fm2 kills the upstart process that reads the shutdown triggers.
- (2.11) - This updates corrects a few translations and removes references to the system sounds. Like the previous update, installing it will break the shutdown dialog until you restart the computer. Please restart by opening a terminal and typing "sudo shutdown -r now" or shutdown by typing "sudo shutdown -P now".
- (8.0.5) - This update corrects the path for any system links to the "What's New" page.
- (1.00-2mint1) - This update preloads the Audio CD module in decibel so that when you launch it, it defaults to the CD drive instead of defaulting nowhere.
- (1.03-1mint1) - This update adds support for playing all music within a directory, including music in it's subdirectories
- (0.1.1-2mint3) - Clerical update, no functional differences.
- (0.1.1-2mint4) - mintfb-randr now stores actual screen resolution for recall at Fluxbox startup instead of a line reference. This is due to some machines having different xrandr output than others.
- (1.3.1-0mint17) - This update adds support for setting up automatic login and theme switching. Both options will show up in your System -> Preferences submenu. Canceling or saving no name in the automatic login dialog box will store no user to be automatically logged in.
Other notes: after installing the above updates it's a very good idea to remove mplayer. It's a redundancy in the system and it's presence can cause some bugs, especially dealing with CD playback. Open a terminal and type the following command:
Code: Select all
sudo apt-get purge mplayer
Also, there is no default application for ripping audio CD's. This is a complete oversight on my part. I messed with a couple of them and I like asunder for it's size and it's ease of use. In order to rip to MP3 format, you'll also need to install lame. Open a terminal at type:
Code: Select all
sudo apt-get install asunder lame
- (0.2.0-0mint3) - This is now in the helena-fluxbox repository and it will be included in the final release. This plugin makes it WAY easier to share folders in Thunar as opposed to going through the "System -> System Tools -> Shared Folders" application. Right click a folder, click preferences, and there will be a "Share" tab to work with. To install either reload Synaptic and search for it, or open a terminal and type:
Code: Select all
sudo apt-get update
sudo apt-get install thunar-shares-plugin


text:
Please contact us at email@example.com
Please contact us at firstname.lastname@example.com
This class is for anyone interested in an introduction to the Agile methodologies. We will cover the different types of Agile methodologies with emphasis on Scrum. We'll also go more in-depth on how Scrum can help you in the way you work with your company no matter what team size or industry. Agile revolutionized the way we work as individuals and teams and it adds transparency and ways to communicate and collaborate in an iterative fashion versus waterfall. This course is for anyone who has an interest in applying Agile and Scrum for their teams even after receiving a certification and then having still having a lot of questions on the best implementation.
1. Why and What is Agile
2. Scrum framework in detail
3. Progress Tracking
4. Infrastructure requirements
If you are a Project Manager, Product Manager, Functional Lead, Director, Business Analyst, Engineer, or Software Developer, this class will provide a solid foundation for how to take Agile concepts and Scrum to the next level in your organization or get started on a new path of collaboration, focus, and quality to propel your product development to new heights.
Geneva, Switzerland
Change city
Agile and Scrum Training in Zurich


text:
Finance & Development, September 2005 »
Volume/Issue: 42/3
Series: Finance & Development
Author(s): International Monetary Fund. External Relations Dept.
Publisher: INTERNATIONAL MONETARY FUND
Publication Date: 16 September 2005
DOI: http://dx.doi.org/10.5089/9781451953985.022
Keywords: monetary fund, website, inflation, press, facsimile
This paper explores why increased aid flows require economic policymakers to confront some specific issues. Ensuring that increased aid promotes growth and reduces poverty is certainly the most important task. Empi...


text:
- Overview
OptiClimate Water-Cooled Systems are the ultimate solution for growers seeking to closely control their indoor climate. Each model will work to establish and maintain targeted grow room temperatures by effectively cooling, heating, dehumidifying, filtering and circulating the air when it is necessary, in turn letting you provide plants with the optimum growing conditions. For an unprecedented level of control, use an OptiClimate Water-Cooled System in conjunction with a Dimlux Maxi Controller and Dimlux Expert Series Lights and you can then adjust the intensity of your grow lights according to the desired grow room settings. Benefits of OptiClimate Water-Cooled Systems include the following:
- Complete, highly efficient, ultra quiet, climate control systems
- Impressive range of effects from a single appliance
- Fully automatic once installed, just set the desired temperatures
- Water cooled design means you don't need to use external chillers
- Pre-Heat and Slow Cooldown functions protect plants when switching from day to night mode and night to day mode
- Dual room operation lets you manage two rooms with one system
- Protection against water leakages and fire, with all issues recorded in a Log
Four different sized OptiClimate Water-Cooled Systems are available, each combining a high level of build quality with incredible low power consumption. The OptiClimate 3500 suits a room with 6 x 600 Watt lights or 9 x 400 Watt light, the OptiClimate 6000 suits a room with 10 x 600 Watt lights or 15 x 400 Watt lights, the OptiClimate 10000 suits a room with 16 x 600 Watt lights or 24 x 400 Watt lights and the OptiClimate 15000 suits a room with 24 x 600 Watt lights or 35 x 400 Watt lights.
You can see the OptiClimate Water-Cooled Systems in action as part of our unique Closed Loop Room display at the following stores:
- GroWell Bristol (Unit 1 Day's Road Commercial Centre, George Jones Road, Bristol, BS2 0QS)
- GroWell Coleshill (Units 8-11 Coleshill Trade Park, Station Road, Coleshill, Birmingham, B46 1HT)
- GroWell Sheffield (Parkway Drive, Sheffield, South Yorkshire, S9 4WU)
- GroWell Wembley (Brent Trading Estate, North Circular Road, London, NW10 0JF)
IMPORTANT NOTE: if you plan on using a humidifier in the same room as the OptiClimate Water-Cooled System (recommended), you must use it with RO water. Either run your water through an Reverse Osmosis System or direct the condensation water (which is RO) into the reservoir for the humidifier.
- Kit Contains
OptiClimate System Specifications:
OptiClimate 3500 Pro 3 System
Voltage Phase Power Usage Cooling Capacity No. of Lamps Water Usage Heating Size (mm) Weight 230V 1 of 3 740W 3.5kW 6 x 600W -- or -- 9 x 400W 1-2L/min 2 x 1500W 870 x 580 x 405 57kg
OptiClimate 6000 Pro 3 System
Voltage Phase Power Usage Cooling Capacity No. of Lamps Water Usage Heating Size (mm) Weight 230V 1 of 3 1450W 6kW 10 x 600W -- or -- 15 x 400W 2-4L/min 3 x 1500W 990 x 630 x 505 80kg
OptiClimate 10000 Pro 3 System
Voltage Phase Power Usage Cooling Capacity No. of Lamps Water Usage Heating Size (mm) Weight 230V 1 of 3 2150W 10kW 16 x 600W -- or -- 24 x 400W 3-6L/min 3 x 2000W 1050 x 660 x 505 120kg
OptiClimate 15000 Pro 3 System
Voltage Phase Power Usage Cooling Capacity No. of Lamps Water Usage Heating Size (mm) Weight 400V 3 3100W 15kW 24 x 600W -- or -- 35 x 400W 5-9L/min 3 x 2700W 1230 x 810 x 545 160kg
- How to Use
Each OptiClimate System has a water inlet and outlet, enabling them to be connected up to a cold water supply and a drainage network. The included remote is also a controller that allows all the processes to run automatically and be monitored at the same time. Once the minimum temperature (night) and maximum temperature (day) have been set using the remote, the OptiClimate system will either heat or cool, depending on whether it is night or day (indicated by the light sensor), ensuring the preset temperatures will not be exceeded. On the day setting, the OptiClimate system cools and also dehumidifies. If required, using the included humidistat, the OptiClimate can also dehumidify when it is on the night setting, thus lowering the humidity.
Questions and Answers
- Downloads
- Reviews


text:
Armenian Language Lessons
Հայերեն Դասեր
This section has a free Eastern Armenian Lessons Online book, which will enable English speakers to learn Armenian at their own pace. Eastern Armenian is spoken in Armenia, Russia and Iran. If you need to learn Western Armenian, this would give you a base of Armenian knowlege, but it may just confuse you.
Introduction
 Armenian Alphabet
 Chapter 1 - Phonetics (other version to merge changes from OldChap1)
 Chapter 2 - Morphology
 Chapter 3 - Adjectives
 Chapter 4 - Numerals
 Chapter 5 - Pronouns
 Chapter 6a - Verbs
 Chapter 6b - Verbs
 Chapter 7 - Adverbs, Prepositions, Conjunctions, Interjections
 Chapter 8 - Lexicology and Word Formation
 Chapter 9a - Syntax
 Chapter 9b - Syntax
 Chapter 10 - Texts for Reading (Armenianhouse.org)
References [ Alphabet | Transliteration | Dictionary ]


text:
Students Receive Special Gift from Pratt & Whitney at Hartford Youth Scholars Foundation 'Senior Send Off'
The Hartford Youth Scholars Foundation recently celebrated the college acceptances of the 14 members of the Class of 2014 at a "Senior Send Off" held at On20 in Hartford, Conn.
The May 1 event not only acknowledged this significant milestone in the students' college journeys, but also served as a fundraiser for the foundation.
Ben Hollenshead, a manager for Global Supply Chain at Pratt & Whitney, is on the Hartford Youth Scholars Foundation Board of Directors. He explained that the Hartford Youth Scholars Foundation provides academic programs that increase college access for Hartford school children. "Students are recruited in the sixth- or seventh-grade timeframe for HYSF's Steppingstone Academy," he explained.
Hollenshead said the foundation knows these children are interested in pushing themselves academically, since those wanting to join the Steppingstone Academy understand that the program requires a commitment throughout the summer as well as after school several days a week during the regular academic year.
Because of student commitment and the support and preparation offered by the academy, Steppingstone scholars are often accepted into some of the most prestigious independent high schools in the state and country. Upon graduating, many Steppingstone scholars end up attending the college of their choice, as well.
The Senior Send Off was attended not only by the new high school graduates and their families, but by sponsors, staff and volunteers.
"Board members are all here, as well," said Hollenshead. "Whether it's the Travelers, Hartford Steam Boiler, etc., there are about 30 of us on the board representing a wide variety of businesses, schools and organizations within the Hartford community, all focused on achieving our mission of seeing a higher graduation and college attendance rate."
Board member and Trinity College President James Jones, Jr., was also on hand, as Steppingstone Academy and Hartford Youth Scholars Foundation administrative offices are housed on Trinity's campus.
As an added bonus to an already remarkable evening, Hollenshead presented graduating students with Nooks, courtesy of Pratt & Whitney.
For more information about the Hartford Youth Scholars Foundation and the Steppingstone Academy, visit www.hysf.org.


text:
As a result, we've decided to temporarily close all of our local stores. During this period of time, we can and will fulfill your weekly shopping needs and Passover orders directly from our warehouse, via phone or e-mail as indicated below.
We remain open for business as usual, as long as we can do so safely. Our sales and customer service teams are available to answer your questions via phone (888-664-6887) or e-mail ([email protected]).
Oh! Nuts Team
Ingredients: Walnuts.
Allergen Information: Processed in a facility that also processes Peanuts, Tree Nuts, Wheat, Soy and Milk products


text:
Blushing Apple Braid
Every Christmas for the past 20 years, I've been making and giving these braids as gifts to shut-ins, special friends and teachers.
Total TimePrep: 30 min. + rising Bake: 25 min. + cooling
Makes3 loaves
- 2 packages (1/4 ounce each) active dry yeast
- 1/2 cup warm water (110° to 115°)
- 1-1/4 cups warm buttermilk (110° to 115°)
- 1/2 cup butter, softened
- 1/2 cup sugar
- 2 teaspoons baking powder
- 1-1/2 teaspoons salt
- 2 eggs
- 5-3/4 to 6-1/4 cups all-purpose flour
- 2 cans (21 ounces each) apple pie filling
- 3/4 cup red-hot candies
- 1-1/2 cups confectioners' sugar
- 5 to 6 teaspoons water
- Red candied cherries, optional
- In a large bowl, dissolve yeast in warm water. Add the buttermilk, butter, sugar, baking powder, salt, eggs and 2-1/2 cups flour. Beat on medium speed for 3 minutes. Stir in enough remaining flour to form a soft dough.
- Turn onto a floured surface; knead until smooth and elastic, about 6-8 minutes. Place in a greased bowl, turning once to grease top. Cover and let rise in a warm place until doubled, about 1 hour.
- Punch dough down. Turn onto a lightly floured surface; divide into thirds. Roll each into a 13-in. x 9-in. rectangle. Place on greased baking sheets. Remove apples from pie filling. Discard remaining filling or save for another use.
- Place a third of the apples down the center third of each rectangle. Sprinkle with a third of the red-hots. On each long side, but 1 in.-wide strips to the center to within 1/2 in. of the filling. Starting at one end, fold alternating strips at an angle across filling. Pinch ends to seal and tuck under. Cover and let rise until doubled, about 1 hour.
- Bake at 375° for 25-30 minutes or until golden brown. Cool for 2-3 minutes before removing from pans to wire racks to cool.
- For glaze, combine sugar and enough water to achieve desired consistency. Drizzle over breads. Decorate with candied cherries if desired.
Editor's NoteWarmed buttermilk will appear curdled.
Every product is independently selected by our editors. If you buy something through our links, we may earn an affiliate commission.


text:
BACKGROUND IMAGE: iSTOCK/GETTY IMAGES
- FeatureDisaster Recovery Extra: Distance your data from disaster
- FeatureSurvey Says: Fibre Channel SANs have best utilization rates
- FeatureFocus on remote-office backup
- FeatureCreating storage tiers for backup services
- FeatureQuality Awards: Top NAS products
- FeatureSingle-pane storage management
- FeatureVendor support falls short
- FeatureNew tape formats are bigger, faster & safer
- FeatureILM isn't just tiered storage
- FeatureStorage tears
- FeatureData storage security trends
iSTOCK/GETTY IMAGES
Data storage security trends
2005 was a big year for storage security, with major vendors doing more than just paying lip service. Vendors are beginning to integrate security into new products or add encryption capabilities. But there's a lot more to do in 2006 to build a secure storage infrastructure.
- Jon Oltsik, Enterprise Strategy Group
Storage security focus for 2006
Storage security turned a corner in 2005. Now it's time for storage pros to get serious about security.
AS FAR AS I'm concerned, 2005 was a watershed year for storage security. EMC announced to the world that, moving forward, security would be integrated into the company and its products. Network Appliance voted with its wallet by acquiring Decru. Tape leaders such as Quantum and Spectra Logic added encryption capabilities to their systems.
Storage security victory! Well ... not quite.
Don't get me wrong. After three years of carrying on about storage security, it's great to see this new wave of progress ripple through the industry. In spite of this, IT storage managers and the storage vendor community still have a myopic view of security. Too many folks think the term "storage security" can be interpreted as either backup encryption or as a security appliance à la Kasten Chase or NeoScale.
So, my storage-centric brethren, when it comes to security there are a few things to keep in mind:
- Security must be systemic. Remember the television show Get Smart? At the beginning of each episode, Maxwell Smart (Agent 86) had to pass through a number of security checkpoints before arriving in his office. In this vintage TV example, each checkpoint is another "layer" of security, a model often referred to as "defense-in-depth." Storage security is no different; to be truly effective, encryption must be supported with things like access controls, strong authentication and monitoring.
- Security threats are always changing. Think about all the stuff you have to guard against on your PC: viruses, worms, spam, phishing, etc. The bad guys are discovering new attack vectors all the time. This means that the storage community has to remain in a constant state of security awareness. You have to make patching management servers and monitoring bug-tracking sites a priority, and ensure your staff is trained to know a scam when they see one.
- You can't manage (or in this case, secure) what you can't measure. I know this is a tired old business saying that everyone has heard from some dorky boss, but with security it's certainly a truism. If I don't capture baseline information, monitor changes and offer all this information up as reports, how can I tell how secure my storage is?
Focus areas for 2006
Storage managers and vendors need to expand their horizons in 2006 for the sake of protecting mission-critical data. Alas, the real estate of this column is too dear for an exhaustive list of security topics, so allow me to elaborate on four important storage security focus areas that professionals and vendors should pay attention to:
- Storage security standards. The biggie here is the Fibre Channel Security Protocol (FC-SP), which is set to be ratified by the American National Standards Institute's (ANSI) T11 working group any day now. FC-SP is kind of the FC equivalent of IPsec, a set of standard algorithms and protocols providing authentication, confidentiality, integrity checking and non-replay protection for IP packets. Granted, the first version of FC-SP has a long way to go, but you have to start somewhere. FC-SP will eventually provide ample protection for SAN-based data in flight as the standard gets baked into host bus adapters, switches and storage systems.
- Security by default. Historically, configuring devices for security demanded an "opt-in" model. IT technologies were shipped in an unsecured state by default, so securing them meant extra configuration steps. Given the growing number of digital threats, the technology industry is quickly morphing to an opt-out paradigm. The best example of this change is Windows XP Service Pack 2, which turns on a firewall upon installation.
Storage won't move to an opt-out security model overnight, but you can certainly expect more security configuration and installation options. Examples of this change will consist of things like ACLs on management interfaces, forced changes to default passwords, removal of unnecessary TCP services and role-based administration. When you're configuring your brand-new storage system in October, you'll see messages like, "You have not changed the default administration password, which may present a security risk. Are you sure you want to proceed?"
- Logging. Storage devices either don't log events, don't log enough events or log events in some proprietary format. As Lyndon Johnson might have said, "That dog don't hunt." Logging fits under the "you can't manage what you can't measure" category--especially when it comes to regulatory compliance and keeping the auditors happy. In other words, ever-increasing regulations move logging storage to the "gotta have" list.
- Key management. This area isn't well understood by most storage people. Heck, even a lot of security folks don't understand key management and its application. I'll probably dedicate an entire column to key management in the future, so I'll spare Storage readers from a crypto-geek explanation for now, but here's a simple explanation for the burgeoning key management requirement. Key management goes hand in hand with encryption. Encryption keys can be seen as random numbers used to encrypt data--no keys, no data. Because of this, keys must be protected, backed up, rotated offsite, etc. Now suppose you have six separate storage devices (disks, tapes or appliances) that do encryption. That means you have six key management systems to operate. This means that in the event of a disaster, you have six systems that must be restored before the data is useful. Does anyone else see an operations nightmare approaching? Centralizing key management can help you avoid these issues and is why Enterprise Strategy Group advocates a proactive plan.
User plan for 2006
Each of these focus areas demands security knowledge and an action plan. Storage professionals should:
- Assess SAN configuration and administration against FC-SP. In many shops, SAN deployment is limited to specific data centers and trusted members of the storage team, so authenticating storage devices and encrypting FC communications might be overkill. On the other hand, enterprise SANs can have hundreds of FC ports and distributed devices crossing data centers and public networks. Storage managers need to assess risks and SAN topology strategies, and then map FC-SP accordingly.
- Understand the ramifications of "secure" configurations. Examine the tradeoffs between security and operational processes. For example, if storage administrators log into devices from their homes, assigning ACLs associated with internal IP addresses alone won't work. In other words, it's important to look at all existing processes, procedures and technology needs before simply locking down storage boxes.
- Map storage security with compliance obligations. This is true with regard to access controls as well as logging, where log files can eat up a lot of storage. Grab the compliance auditors and determine what data they need, in what format and how often they need it. Because this is a new activity, expect several iterations before you get it right.
- Approach encryption with your eyes open. Scrambling bits on backup tapes is just the tip of the iceberg. As vendors pitch encrypted storage devices, make sure you understand what they provide for key lifecycle management. Do they have Federal Information Processing Standards (FIPS) certification? Do they adhere to standards? Can their products be integrated into a centralized service? Upfront work here will prevent a serious operational headache down the line.
Security isn't industry rhetoric--it's serious business. Given the increased emphasis on security, every vendor is bound to have a story, so it's incumbent upon storage professionals to be knowledgeable enough to spot a phony. As you increase your knowledge, make sure to include chief information security officers or other security people with a keen eye for security smoke and mirrors.
One other note: It's one thing to offer secure products, it's a completely different thing to embrace security. Does your vendor have security included in its software development process? Are its field engineers trained in storage security? Is the company providing secure remote support? If the answer to any of these questions is "No," you should immediately find out when they will address these shortcomings. It's best to avoid equivocating vendors that lack definitive roadmaps and schedules.


text:
Infertility: Aging Egg SupplySkip to the navigation
Topic Overview
From birth, females have a fixed-though plentiful-supply of eggs (ovarian reserve). As a woman ages past her mid-30s, her eggs gradually degrade, making it less likely that she will naturally conceive, or that an assisted reproductive technology (ART) procedure will result in pregnancy and a healthy baby.
Among American women in their 20s to mid-30s, over 35 out of 100 give birth for each ART cycle using their own eggs. As women age, the live ART birth rate gradually drops: footnote 1
- To about 20 out of 100 for each IVF cycle by age 39.
- To 5 or less out of 100 for each IVF cycle in women over age 43. Many women over age 40 choose to use donor eggs, which greatly improves their chances of giving birth to a healthy child.
While there is no definitive test of ovarian reserve, a woman's follicle-stimulating hormone (FSH) level can be measured to evaluate how well her ovaries are working. A high FSH level is a sign that the body is trying to stimulate the ovaries to make more egg follicles , but the ovaries are not responding and conception is unlikely.
A woman's FSH level can be tested using a blood sample:
- Early in her menstrual period, around day 3.
- Before and after a clomiphene challenge test , early in her menstrual period.
Health Tools
Health Tools help you make wise health decisions or take action to improve your health.
Related Information
ByHealthwise Staff
Primary Medical Reviewer Kathleen Romito, MD - Family Medicine
Specialist Medical Reviewer Femi Olatunbosun, MB, FRCSC - Obstetrics and Gynecology
Current as ofMarch 16, 2017
- Top of Page
Next Section:Health Tools
Previous Section:Topic Overview
- Top of Page
Next Section:Related Information
Previous Section:Health Tools
- Top of Page
Next Section:References
Previous Section:Related Information
- Top of Page
Next Section:Credits
Previous Section:References
- Top of Page
Current as of: March 16, 2017
Author: Healthwise Staff
Medical Review: Kathleen Romito, MD - Family Medicine & Femi Olatunbosun, MB, FRCSC - Obstetrics and Gynecology


text:
Clark Atlanta University's Dr. Tamica Smith-Jones doesn't mind being singled out. In fact, she prefers being "one in a few" or "the only one," when it comes to promoting student-athletes during their journey through college.
Smith-Jones is currently "one of only two" female athletics directors in the Southern Intercollegiate Athletic Conference (SIAC), which is composed of 13 institutions in five states including Alabama, Georgia, Kentucky, South Carolina and Tennessee. Both she and Dr. Denisha Hendricks of Kentucky State University are African-American.
Just recently, Smith-Jones served as the "only" featured panelist to represent the NCAA's Division II institutions during the 2012 National Association of Academic Advisors for Athletics (N4A) Regional Fall Conference, held at Georgia State University, Oct. 14 – 16.
The three-day N4A Conference included representatives from both Division I and Division II schools in the region, focusing on "Today's Vision, Tomorrow's Reality."
"Having an opportunity as the only panelist from a Division II school to share my experiences in athletic administration and to offer my expertise in the field along with my colleagues was an honor," said Smith-Jones.
Dr. Smith-Jones, an Atlanta native, served on the administrator's panel during one of the breakout sessions regarding the transition from within athletics into athletic administration, an area she is most passionate about where she shares her own career path.
Meanwhile, Smith-Jones said she finds it advantageous being a woman in a male-dominated field.
"I don't feel pressure a lot of pressure being in a field dominated by men," Smith-Jones said.
On one hand, she said she finds it easier to relate to her male colleagues when it comes to sharing ideas and in getting feedback. But on the other hand, she finds that by belonging to the National Association of Collegiate Women Athletics Administrators (NACWAA) since 2001 gives her a huge support system in relying on other women: "The NACWAA is where I get a lot of my support, too," she continued.
However, Smith-Jones will be the first to tell her audiences that her overall commitment since taking over as CAU's athletic director in 2009 continues to be the overall development of student-athletes as well-rounded citizens, and the retention of them through graduation.
"Our biggest task is that our student-athletes become good role models themselves and that they are ambassadors for the school," said Smith-Jones. "It is not enough that we go out and do community service, but that our athletes serve as windows to the university. For example, our football team was recently involved in a class on domestic violence."
Echoing Dr. Smith-Jones' mission of supporting student-athletes during their matriculation, Angela Freeman, the University's Registrar and Susan Gibson, the Director of Academic Success and Enrichment, also attended the recent N4A conference.
"Our first priority regarding student-athletes is academics first with the overall goal of helping them move toward degree progression," said Freeman. "…we have to work together for student-athletes to be successful students."
According to the Division II Athletics Directors Association (DIIADA), prior to taking over as CAU's athletic director, Smith-Jones served as the SIAC Conference's Senior Woman Administrator, a position directly responsible to the conference commissioner. Her decision to accept the AD position at CAU came one year after her promotion to the school's position of Interim Director of Athletics in 2008.
The DIIADA also notes that during her leadership at CAU, the Panthers have demonstrated marked success in the classroom, community, and on the playing fields, and that retention and graduation rates have steadily been on the rise.
When asked at what point in her own life did she realize athletics administration would be her expertise, Smith Jones explained that it was in her final semester as an undergraduate student-athlete at Alabama A&M when she was faced with a challenging situation.
"It was in my senior year at Alabama A&M where I was playing basketball as a shooting guard. I elected to pledge a sorority, something my coach had told us not to do," Smith-Jones explained. "During my exit interview with our coach, he informed me that my scholarship would not be renewed for my final semester because of my decision to pledge.
"I was hurt but respected his decision, so I asked him to help me get another scholarship in another sports and he agreed."
After considering track and field but realizing it wasn't track season, Smith-Jones opted to try her abilities at distance running. She joined the cross-country team, but the results didn't quite work to her advantage. The challenge, however, helped shape her future path.
"I remember pulling up in the van with the cross-country team and all the runners jumping out in the rain and running to the starting line. After running three miles, the next day I told the coach 'I can't do these three-mile runs," Smith-Jones jokingly recalled. "The coach then gave me an opportunity to help out with travel and by running errands. That turned into a full-ride scholarship. I did everything that was given to me."
From that point forward, Smith-Jones knew that athletics administration would be her calling.
Smith-Jones earned her B.S. Degree in Business Administration from A&M in 1997, and went on to earn her Master's in Public Administration from Savannah State University in 1999 while serving as interim head women's volleyball and basketball coach. She obtained her Doctorate in Business Administration from Kennedy-Western University in 2005.
Dr. Jones is married to T'Michael Jones, a graduate of Morris Brown College. They are the parents of two children, T'Micah Jordan and T'Miyah Jourdan.


text:
My friend Daniel Stephens is a super-skilled writer, filmmaker, cinematographer, computer scientist, and entrepreneur who lives just a couple of hours up the coast from me in Rockport, Maine. I first met Daniel through my buddy John Rooks (another all-around creative superman) and worked with him last summer on an indie movie shot and produced around Rockport (he was the producer/cinematographer, and I ran their social media).
I am really excited about his latest project, "Tuberville the Series." Stephens teamed up to write this one with his partner Mark Booker, a talented actor who also wears a producer hat in addition to playing Russ Murphy, the citified bank teller who struggles to fit into small-town Maine culture after he inherits a potato farm from his grandfather. Booked is joined by the talented Giselle Brasseur, Nic Roewert, Allison Byrnes and Susan Traylor while Stephens is helped out behind the lens by producer, director and writer Anelisa Garfunkel and producer Ralph Perkins.
Besides being a great show, "Tuberville" has the added bonus of helping to support a fantastic organization that shares a name with the series. Tuberville the Organization is a nonprofit started in 2004 that works to encourage farms to set aside a few acres of land to harvest for local food banks. It's a wonderful concept that promotes local food and puts food on people's tables. Right now Tuberville farms are found in Maine and Vermont but Stephens and Booker are hoping to help raise awareness of the concept to help it spread nationwide. No one should ever go hungry.
Daniel, Mark and the rest of the "Tuberville" crew are raising money on Kickstarter to complete the last two episodes of the six-episode season. The first four episodes have been produced and made available, the fourth has been shot but is yet to be released, and the last two are written and waiting to be shot. Each episode costs $16,000, which is the goal of their Kickstarter project. If you are the project-supporting type and would like to help a great group of people and an amazing organization, click over and drop them some love.
You can see the first three episodes of "Tuberville the Series" here.
Related story on MNN: 11 extreme ways to eat and drink closer to home
Are you on Twitter? Follow me (@sheagunther) there, I give good tweets. And if you really like my writing, you can join my Facebook page.


text:
DIXON (WIFR) -- Some new jobs are coming to town. A Maryland company says it will relocate its Mexico manufacturing plant to Dixon.
SGS Refrigeration has bought a property off of Progress Drive. Over the next few weeks, workers will start to make the necessary upgrades. SGS hopes to start production in late spring or early summer. They manufacture industrial cooling equipment and over the next three or four yoears, they hope to add 100 jobs or so. SGS's president says those jobs should be easy to fill.
"We did look at one or two other places here in the U.S., but they didn't have the same appeal as far as having a talented and skilled workforce being available," said SGS President, Peter Speller.
SGS isn't taking applications just yet. They say when they can get a permanent office up and running, they'll start the hiring process. We will continue to update you on this as we learn more.


text:
Ceilings with high light-reflectance create brighter spaces.
A well designed ceiling with high light reflectance improves the overall illumination and lighting uniformity of the room, directly affecting working comfort, well being and productivity.
Ceilings with high light reflectance, returning up to 90% of light back into the space, can reduce energy consumption by up to 20%.
Ceiling systems are a key element of energy conservation. A well designed ceiling with high light reflectance improves space illumination, allowing for fewer light fixtures, a reduced electrical light output, lower maintenance costs and a reduced cooling load.
Daylight and electrical lighting represent the two primary sources of lighting in the workplace. The light reflectance of the ceiling, floor and wall surfaces play the second most important role for overall illumination of the room, directly affecting working comfort and productivity.
Benefits of High-LR Ceilings:
- Light Reflectance ≥ 90% ⇒ 20% cost saving with indirect lighting
- Total building energy savings up to 11%
- 7% savings in cooling system energy
- High light reflectance ceilings contribute to LEED®, BREEAM, HQE, DGNB and Ska credits by improving visual comfort
High-LR Solutions
Other Performance Criteria to Consider
Mould/Mildew Resistance
Sound Attenuation
Clean Room
Scratch Resistance
Disinfection Resistance
VOC Emissions
Fire Reaction
Humidity Resistance
Sound Absorption


text:
Dealer Comments
Vision Pack - $1,500
Tech Pack - $1,900
Panoramic Glass Roof - $1,000
5 x STAR ANCAP Safety Rating. That is Simply Clever. That is . Visit our Award Winning dedicated
Dealership. We are located 15 minutes southeast of the Melbourne CBD. We stock a huge range of New, Demo & Pre-owned Vehicles. We take satisfaction in knowing that all of our Pre-owned vehicles are road worthy and workshop tested before being presented for sale. Trade ins of all makes and models welcome. We also offer personalised yet competitive finance, warranty and insurance packages. Interstate buyers welcome, we offer a simple solution from us to you in a few easy steps. ENQUIRE NOW to find out why this car is *Simply Clever*


text:
Who are the Daughters of the Cross?
"The Daughters of the Cross
Will never separate the love of God
From the love of people"
— Constitutions Article 5
"The Daughters of the Cross form an institute of apostolic life
which has as its aim
to understand and to proclaim to others
that the love of God
has been revealed to us in the most striking way
in the passion, death and resurrection of Jesus.
Their response to this love
is to glorify and honour Christ
by loving and serving him,
above all in his weakest and most suffering members"
— Constitutions Article 1


text:
Frequently Asked Questions:
What will be picked up at roadside pickup?
Household trash. Recylables are to be taken to the recycling centers and yard waste can only be recycled by way of backyard compositing.
What can be recycled at the recycling centers?
Aluminum, appliances/scrap metal, cardboard, food cans, glass bottles and jars, plastic bottles and jars, newspapers, oil, oil filters, electronics, and tires.
Where are the recycling centers?
The Palmetto Hardwood Recycling Center on Senator Gasque Road in Marion, the Britton's Neck Recycling Center on Highway 41 in Britton's Neck, and the Marion County Landfill on Red Bluff Ct. off Old Stage Road in Mullins.
What are the hours of the recycling centers?
The Palmetto Hardwood Center is open Monday, Wednesday, and Friday from 1:00-5:00 pm and Saturday from 8:30 am to 5:00 pm excluding 12:00 to 1:00 pm for lunch. The Marion County Landfill is open Monday through Friday from 7:30 am to 4:30 pm and Saturday from 8:00 am to 12:00 pm.
What form of payment do you take?
We take cash, check, and money order. Currently we do not have the capabilities to use credit, debit, or bank withdrawal.
How much is the service?
Per month the service costs $15.75 and if you have two carts, $24.50. We have avaliable a discount for those who pay a year in advance. Paying for 12 current months of $189.00 will give you a 13th month for free.
My cart is broken or missing, what can I do?
Simply let us know and we'll provide a replacement. Even if it was broken or taken during trash pick up we will not be notified. You may let us know by visiting our office at 2523 East Hwy 76 in Marion or by calling us at 843-423-8234.
I am behind in payments, what can I do to assure continued trash pickup and what programs are available to help me catch up the balance?
Speak with in person or by phone any of our staff in our office and we'll explain our Non-Termination Agreement with you. This Agreement assures both that you will continue having our service, and that we will receive the necessary payment for that service.


text:
There is no pleasure without at least a little pain.
That even goes for wine making.
This year's unseasonably warm and dry weather is pushing Livermore's wine grape vineyards to begin blossoming a tad on the early side.
The appearance of buds is known in wine making jargon as "bud break."
It's a springtime call for winemakers to spring into action.
"When you get warm weather you produce buds or bud break," said John Concannon, a fourth generation winemaker from Livermore's Concannon winery. "So bud break is really the beginning of wine making."
The catch is; the year's record dry start is forcing winemakers to irrigate a little on the early side.
On top of that worry, buds on the vine are vulnerable to frost. "Frost is our biggest threat," said Concannon. "We're not really worried so much about rain but just thirty minutes of exposure under 30 degrees can damage the buds at this point."
Fortunately, Livermore's geographic orientation rarely exposes it to damaging frosts. So the giant fans, helicopters and other frost-coping measures can stay in the shed for now.
"Mother nature does bat last," said Wente Vineyards senior viticulturist Rob Sorenson. "It's just a matter of being proactive versus reactive."
Mostly though, bud break is a cause of celebration among wine growers and their wine-sipping public.
This weekend Livermore will mark the arrival of the buds with its annual barrel tasting weekend, with over 30 wineries offering tastings before their vintages even hit the bottle.
"Barrel tasting weekend is a great time to celebrate this," said Chris Chandler of the Livermore Valley Winegrowers' Association, "and see the little buds breaking on the white varietals in the valley."


text:
TMJ Treatment Cost
If you are seeking treatment for temporomandibular joint (TMJ) disorder, you are likely concerned about cost. Treatment for TMJ disorder is highly personalized to each patient and as such, the price can vary widely. Since there are so many factors at play, TMJ treatment cost is difficult to estimate. Patients with mild symptoms can often relieve discomfort with home care techniques which cost little to no money. However, if you have a severe case of TMJ disorder, you may require surgery. Surgical treatment for TMJ disorder is rarely covered by insurance and can cost several thousand dollars depending on the procedure. The overall cost of your TMJ treatment will depend on the extent of your symptoms, the type of treatment you need, and your dentist's experience level, among other factors.