text:
Central Branch AGM, 13th January 2018
The bells were already ringing at St Vincent, Caythorpe when we arrived.
Access to the tower is from the outside of the church and not through the church, although I gather there is a sneaky door from the vestry to the tower stairs.
In the ringing room, Colin Ward had the ringing under control. There was lots of rounds, Plain Bob, some Grandsire, Stedman, even some Kent Treble Bob. We even managed some spliced Surprise major and 3 leads of Bristol Surprise Major.
We left 8 ringers in the ringing room to ring a bob course of Cambridge Surprise Major as a service touch and made our way down into the church. The local "ladies that do" were handing out the green service booklets and Les Townsend was getting to grips with the organ.
The service was conducted by the local lay preacher Tony Kingsman. The reading (read by the Branch Ringing Master, Colin Ward) was from Romans, Chapter 12. "For just as each of us has one body with many members, and these members do not all have the same function, so in Christ we, though many, form one body, and each member belongs to all the others."
Tony preached a short sermon on bellringing being teamwork which was pretty much the theme of the reading. Bells have been about since 400AD and are an important part of the church. Yes there is prayer and praise and reading of the scripture, but the bells are a public sign that the church is active. They mark our daily lives celbrating births and weddings they toll when a person has passed away.
The service proceeded smoothly apart from a slight mix up with the hymns. As the BRM later stated in his vote of thanks and para-phrasing a popular Morecambe and Wise sketch "Les played all the right hymns but not necessarily in the right order"
After the service we made our way to the Village Hall, which is a quite a trek from the church. Inside the inevitable cups of tea and coffee were being served. The meal consisted of a choice of 4 different soups with a nice big chunk of bread and a selection of sandwiches. Cakes had already been put out on the tables.
Once the raffle had been drawn, the AGM started.
John Nicholson has had to step down as President because of ill health. Colin Ward therefore took the chair until a new President could be appointed.
The AGM Agenda was quite long, but despite this the meeting proceeded quickly and smoothly.
Apologies were received, we had a minutes silence in memory of Ian Bland (Heckington) and Jim Sutherland (Wragby). Colin Ward gave the vote of thanks at the start of the meeting and then the members, having already read through the minutes of the previous AGM over tea, approved the minutes as a true record. There were no matters arising.
Claire Howard gave her report as secretary, Dot Mason gave her report as Treasurer, Chris Jackson gave a report on Fundraising and Colin Ward have a report as Ringing Master.
We then very quickly re-elected the officers. Sandra Underwood was willing to stand as President with no other nominees and all other officers and committee members were willing to continue in their current positions. The Officers of the Central Branch are therefore as follows:
President: Sandra Underwood
Treasurer: Dot Mason
Secretary: Claire Howard
Ringing Master: Colin Ward
Safeguarding Officer: Jonathan Clark
Guild Fund Raising Rep: Christine Jackson
Guild Committee Rep: By Proxy
Committee members: Gill Gladman, James Northway, Richard Short & Mick Stracey
Account Examiners: Alan Haines & Geoff Wilkinson
We then moved to Election of members. Harold Gibson was proposed by Les Townsend for Honorary Life Membership and it was agreed by the members that the application should proceed to the Guild committee.
There were 14 new members elected at the meeting, and also a couple of transfers from one tower to another.
We then moved to AOB
Dot Mason (Treasurer), Sandra Underwood (President)
Colin Ward (Ringing Master), Claire Howard (Secretary)
Chris Turner (the Guild Master) gave a report on forthcoming Guild events and the AGM in April.
Colin Ward gave a quick overview of the legal requirements for Risk Assessments for Health and Safety stating that they did not need to be particularly onerous and he was willing to help out any towers that needed to complete one.
Jonathan Clark gave an overview of the requirements for Safeguarding for Tower Captains and Ringing Teachers and also alluded to the fact that bellringers in general might need to do some basic online Safeguarding training.
Colin Ward discussed the Branch Programme of Events and a couple of the events were re-scheduled due to clashes with Guild Events like the Guild 6 Bell and the Young Ringers Day.
Dot Mason discussed the BRF applications and grants of which there had been only one to Brant Broughton for the rehanging of the bells.
The meeting was then closed and the members proceeded back to the tower for some more ringing.
Jonathan Clark (webmaster)


text:
Tuesday, September 22, 2020
I read an interesting post over the weekend on PRSquared about passion as it relates to your business. In it, author Todd Defren touts:
In the world of Public Relations, we unofficially use Passion as a barometer for the likely success of a client program. Are the members of the C-suite energized, gleeful, determined, convincing? If so, the PR team is eager to set-up appointments with media influencers; we know that these clients will pass the Spouse Test.How many times have you come home – late – from a meeting, and grunted noncommitally to your spouse when they asked about your day? Now imagine how many times a Wall Street Journal business reporter meets with some nondescript executive spokesperson and subsequently shrugs impassively when their own spouse asks about their slate of meetings.What if you were in one of those meetings? Is that how you want to be remembered? – as just another empty suit?I've been known to tell clients in advance of a "Big Meeting" to be prepared for a kick under the table if I sense that their energy levels are waning. I urge them to clench a pencil between their teeth during conference calls with the media, to get those "happy-face endorphins" pumping.It can be challenging in our business to find the same the passion about our clients' products as they do, but it is, after all, part of what they're paying us to do. It's always a good thing to keep in mind when pitching the media: exude some passion about the goods you're hyping and even if you don't know if you're feeling it, fake it until you do. And never let 'em see you wane.

subset: commoncrawl


text:
by Mike Adams, Natural News
New evidence is now emerging that Malaysia Airlines flight 370 was almost certainly hijacked. This is now readily apparent from the fact that the aircraft cockpit electrical systems were tampered with, reports the Telegraph.
Immediately after the aircraft was hijacked, the persons(s) in control of the flight deck powered down the aircraft's transponder which "squawks" location and altitude details to air traffic controllers. Boeing 777 aircraft electrical systems can be independently powered down or restarted from the flight deck, as long as the person knows what they're doing.
This effort to power down the transponder caused a power outage of the plane's connection with a satellite, requiring that connection to be renegotiated to establish a new "handshake." It is this highly unusual request for a new satellite handshake that raised a red flag in the minds of investigators: aircraft don't normally make such handshake requests unless recovering from a power outage (i.e. the rebooting of electrical subsystems).
© 2014 The Natural News Network


text:
Thursday, Nov. 15
Media Contacts:
Claudine McElwain | email@example.com | 434-977-4090
Lee Francis | email@example.com | 804-225-1902
Kate Addleson | firstname.lastname@example.com | 804-225-9113
Denise Robbins | firstname.lastname@example.com | 240-396-2022
Walton Shepherd | email@example.com | 804-401-9236
Mary Raferty | firstname.lastname@example.com | (804) 614-7670
Statewide Conservation Groups Call on Northam to Reverse Decision to Replace Air Board Members During Pending Permit Decision
RICHMOND – Today, Governor Northam's Secretary of the Commonwealth informed two Air Pollution Control Board members, Rebecca R. Rubin and Samuel A. Bleicher, that they would be removed from the Board. This comes just weeks before the body is expected to vote on a crucial air permit for Dominion Energy's Atlantic Coast Pipeline.
The removal of the members in the midst of debate is unusual, and concerning. The action comes less than a week after both Board members raised environmental justice concerns that pollution from Dominion's proposed project will cause disproportionate air pollution impacts to the people of Union Hill. Dominion Energy is proposing to build the 55,000 horsepower industrial compressor station in the historic, predominantly African American neighborhood.
The Air Pollution Control Board is comprised of citizen experts tasked with upholding specific environmental statutes related to clean air, including authorizing permits that regulate or protect against air pollution.
The air board is scheduled to continue deliberations and vote on the compressor station permit on Dec. 10. Both Bleicher and Rubin were informed today they would be removed from the Board before that vote.
Governor Northam has repeatedly stressed the need for transparency and independence in the pipeline permitting process. In April 2018, Governor Northam said, "You know I have a lot of faith and confidence in our DEQ, and I need to let them do their work. We need to do this with science we want to do it with the law and we want to do it with transparency." The removal of these members is in direct contradiction to these essential guiding principles.
In response, leading statewide conservation organizations issued the following joint statement:
"We are shocked and extremely disappointed in Governor Northam's decision to interrupt the Virginia Air Pollution Control Board's deliberation on the proposed Buckingham County compressor station. Removing citizen board members in the midst of contentious debate sends the wrong message. Citizen boards must remain independent from political interference during the decision-making process. We call on the Governor to reverse this decision until the current board has finalized its deliberations on the proposed permit."
Virginia Conservation Network
Southern Environmental Law Center
Sierra Club Virginia Chapter
Virginia League of Conservation Voters
Natural Resources Defense Council
Clean Virginia
Chesapeake Climate Action Network


text:
The success of BT's Panorama platform shows the dominance of the big institutions and Australia's appetite for investment platforms, says Treysta Wealth Management.
"There is an addiction to platforms within Australia and there has been some stifling of innovation around this because the market is dominated by big institutions," Mr Nagle told ifa.
"In the US, platforms have been surpassed because new technology has come through so advisers can operate more efficiently."
These comments come as BT's Panorama platform continues to gain traction in the market.
More than 1,000 advisers have joined since Panorama's launch in 2014 and, according to a BT spokesperson, IFAs have the largest appetite.
"Sixty per cent of the flows are from new relationships that indicate that the majority must be IFAs," the spokesperson said.
Mr Nagle said this came as no surprise to him.
"We don't use platforms wherever possible and we've been able to save our clients that additional cost. On the occasion we do utilise platforms they are not institutionally aligned and we are therefore not conflicted by them," he said.
"From an institution perspective use of their platforms still serves as a gateway to distribute product and that is where conflict can exist."
This week BT Financial Group (BTFG) chief executive Brad Cooper said the Panorama platform was resonating both with the 1,363 advisers on board as well as with clients.
"We launched a new managed portfolio facility which was very well received at our national BT Adviser Forums," he said.
Panorama is currently in year two of the delivery of a five-year schedule. According to the BTFG half-yearly results, expenses were driven up by $3 million compared with the same period last year due to investment in the platform and a rise in planner numbers.
The two big four banks have made certain roles redundant in the higher ranks in ...
ifa, in partnership with Capital Group, is pleased to announce the finalists for...
The financial services industry has been forecast to be the most likely to adop...


text:
Easy Keto Everything Bagels Recipe
Minggu, 10 Maret 2019 Add Comment
Easy Keto Everything Bagels Recipe - delicious everything bagels that are low carb using just cheese, eggs, and everything bagel seasonings for a filling keto bagel everyone will love!
- 1 cup shredded cheese, cheddar, mozzarella, any kind of cheese that melts well.
- 1/2 cup grated parmesan , or asiago, other hard, dry, grated cheese.
- 2 eggs
- 2 tbsp everything bagel seasoning
|Easy Keto Everything Bagels Recipe
- Preheat oven to 375 degrees Fahrenheit.
- Combine the shredded cheese and egg in a bowl and mix it until the ingredients are fully combined.
- .....
- ........
You can get the complete recipes here!!!


text:
First Week of College" This first week of college has been very exciting . I remember on Sunday all day not knowing what and how to feel and what to expect. I woke up Monday morning nervous and excited, but also blessed because I feel lucky for what I call "one of those fortunate kids to be able to attend college". Vive been reading this devotional book each morning since I began Monday and I pray before I leave the house.
Monday morning, I got on this campus, and I immediately started walking towards my first class, excited and anxious, but nervous because I didn't know anyone in the class. I met my first teacher for the day, Mrs.. Martinez for Math, and she is such a sweet and nice woman. Then, I had my hour-and-a-half until my next class, Student Success, so I met up with my best friend Whitney, which I haven't seen the last time we were at Taco Bell with her mom and grandma, sometime in late June or early July.
Her mom passed away last month and Thursday, August 29th would be one month. I was so happy to see her and share my college experience with her!!! Then, I had lunch and bought a ham and Swiss cheese sub. Then, it was time to go to my last class, Student Success with Mrs.. Butler, who is also a lovely lady. I walked in the class, with my friend Alison, and was nervous not knowing what to expect. The syllabus and presentation was very informative and I enjoyed playing and listening to the "Have
You Ever? " and the "Head, Shoulders" games. The day ended. I left the campus happy and grateful to be a part of this experience. Tuesday afternoon came and I went to my English class, and met my teacher, Mr.. Approach, who is a really funny guy and sarcastic. I also left this day feeling happy and grateful and I'm really starting to feel comfortable in my own skin and I'm loving passing through many of my friends from whom I went to high school with or young adults from my church.
We Will Write a Custom Essay Specifically
For You For Only $13.90/page!
order now
One thing I did twice is that for me personally, I felt that the atmosphere was different… In a good way. It's very unique and I'm beginning to get accustom with it and a liking to it. I also believe that I'm going to use all these resources to my benefits and Vive met some incredible people already that will make some great study buddies. Over these past 2 days, it's Just been an incredible feeling, I'm looking forward to the rest of this year, and I Just feel incredibly blessed. First Day of College By Turbulence


text:
The open book page is a cool idea, but I'm not sure if it's really necessary in this wall...the painting-like texture is what really sets the scene though! And of course, we can't forget that cute scan ^_^
1152x864 Wallpaper
Artist Comment
Well after some years.. :D i decided to make my a wallie.. well for the third time i guess.. /swt..
while i was looking on some of the couple scans here in MT.. i saw this Chrno Crusade scan.. it's been a while since i made one.. XD thanks to frunty for sharing the scan and to DigitalArt for providing my BG.. ^_^'
I entitled it Smile.For.Me coz of reasons that i do not knOw of.. it just came through my mind... o_0
Well it took me hours to make this.. but i guess it still lacks something... your comments would be highly appreciated..
Thanks and have a good day~ :pacman:
hope you like it! :)
More Chrno Crusade Wallpapers
Browse Chrno Crusade Gallery: Recent | Popular.
Kyelor Feb 12, 2007
Gabriele Feb 12, 2007
Great wall! You did great, I love the background and the two main character from chrono crusade^^
Firemace Feb 12, 2007
Chii, this is a piece of Fantastic work !
Where the scene depicts the theme's meaning, if not for the scan, i think it probably will have lost some points to score from me right there.
Not only do i like your background but the way you place those small nifty touches of a countryside elements and their effects. It is the Font and Style of your Text that add the final touch up of the overall ar piece.
Don't get me having the wrong idea but i find that you probably am missing some good old blending of the effects you put in. A little too much else, it need to retouch up on the placement of those birds and the celestial book wordings right there.
Nice Wall !
x-lawss Feb 12, 2007
Nice wallpaper you have here~!
Background is great XD
Keep it up!
Sinever Feb 12, 2007
nice wallie
the bg looks great
well done
vatican92 Mar 13, 2007
Looks peaceful and nice
And really realistic
reload Apr 27, 2007
wow! very beautiful
great work
Miyuki89 Mar 24, 2008
So cute!
cornelia4 Nov 23, 2008
Awesom wall, my favourite :)
Hakimichan Jan 20, 2009
Oh wow, this may be one of the best Chrono Crusade wallpapers I've seen yet! ~<3 Chrono and Rosette look absolutely adorable together here, and your use of background, lighting and color is stunning. This is truly amazing, I applaud you! X3 Nice job~
mblog106 Apr 25, 2010
nice piece of art.... ^_^
Atemina Jan 02, 2011
Wonderful.......... Very beautiful!
page 1 of 1 12 total items
Only members can post comments, please register.


text:
Deliveries & Returns
Plus Equals is a UK based, independent fashion label that hand makes every item to order. Due to this, it may take a little longer for your order to be dispatched while we make it up, also if it is Made to Measure. We advise allowing 7-18 days for your order to be processed and dispatched but during busier periods, this may take a little longer. We will always try to accommodate urgent orders where we can, so do get in touch with us if you need something for a super special occassion!
Shipping Costs
We ship globally! Check the list below to get the shipment rates for your country.
U.K Shipping - 1st Class Signed For (Dispatched by Royal Mail): £4.99
European Shipping* - Tracked & Signed (Dispatched via Royal Mail) : £21.99
Rest of World Shipping** - Tracked & Signed (Dispatched via Royal Mail): £31.99
We know it's strange shopping online, sometimes you want to try pieces on, sometimes it's completely different when it arrives, and we totally get it. All items (including sale) including our Upcycled & Vintage lines are eligible for a full refund when returned, in original condition, to us within 14 days of receiving the item if said item is faulty, or if you just change your mind! If you are unhappy with your item or if it's faulty, please give us an email on firstname.lastname@example.com and we will get back to you as soon as possible. We do politely ask customers to be sure of what they are purchasing before buying, as we are an indie business. Please note we are unable to offer refunds on Custom Orders or Made to Measure orders.
*European countries include: Albania, Andorra, Armenia, Austria (EU), Azerbaijan, Azores (EU), Balearic Islands (EU), Belarus, Belgium (EU), Bosnia Herzegovina, Bulgaria (EU), Canary Islands, Corsica (EU), Croatia (EU), Cyprus (EU), Czech Republic (EU), Denmark (EU), Estonia (EU), Faroe Islands, Finland (EU), France (EU), Georgia, Germany (EU), Gibraltar (EU), Greece (EU), Greenland, Hungary (EU), Iceland, Irish Republic (EU), Italy (EU), Kazakhstan, Kosovo, Kyrgyzstan, Latvia (EU), Liechtenstein, Lithuania (EU), Luxembourg (EU), Macedonia, Madeira (EU), Malta (EU), Moldova, Monaco (EU), Montenegro, Netherlands (EU), Norway, Poland (EU), Portugal (EU), Romania (EU), Russia, San Marino, Serbia, Slovakia (EU), Slovenia (EU), Spain (EU), Sweden (EU), Switzerland, Tajikistan, Turkey, Turkmenistan, Ukraine, Uzbekistan, Vatican City State.
** Rest of World covers any other country or state that has not been listed in the above category.


text:
With this Amulet evil spirits will leave your life physically and spiritually. Don't be jinxed, hexed, or crossed anymore! Wearing this necklace will kill all voodoo, hate, evil, jinx, hexes and curses that enemies may try to put on you! Be free of all Evilness, now!
Website developed by VisionFriendly.com


text:
A few weeks ago, I was catching up with a friend from home. She was still hooked on some guy she'd been seeing on and off for two years – a guy who had another girlfriend. She went on to tell me how terrible of a person this girlfriend was and how he was totally miserable in the relationship and needed to just dump her. She somehow needed my reassurance. "Doesn't she just sound awful? I mean, I would never do that if I were in her position." My response to her was short and simple, "Sounds messy. Run."
I'm not perfect, but one thing I am very dedicated to is to avoid judging others. I have enough shit going on in my own life and I'm in no place to point my finger in any direction but toward myself.
Imagine a world where no one judged you, and instead, offered support and empathy for your experiences. Well, I realized that when I made the change and started minding my own business, everything got a little bit brighter in my life.
So here's why you should do the same.
You never know the whole story
No matter what you think you know, or how close you think you are to someone, you never know the whole story. You're either judging gossip or you're going off of little one-sided tidbits you overheard at some hen filled baby shower. A story is much more than the he/said she/said bullshit; it includes emotions, history, and other details known only to the parties involved – things you could never understand.
Everyone has shit going on
Life is hard and everyone's just trying to figure their lives out and make it through their various tunnels. Careers, relationships, and lifestyles are living, breathing things; they change, they evolve, and in order to grow, they have to encounter a challenge. These are things we all deal with on a daily basis. Curveballs and shit storms; affairs and betrayals; sharp turns and rock bottoms. We're all in this together.
Do what you're supposed to do and just be supportive
Imagine how much better life would be if we could just be a little more understanding of one another's struggles. If we could offer a shoulder to cry on instead of a condescending glance. Your job as a friend is not to talk down or talk shit, it's to take a step back and say, "Hey. I get it. I'm here." Your job as an outsider is just that: to stay outside. We often forget that people that make mistakes are just normal people; and oftentimes, though they're the ones at fault, they're going through their own emotional rollercoaster for the decisions that they made. Have respect for their journey.
Put some ear muffs on and stop fucking gossiping
Are you still in high school? Because if you're not, you need to learn when something is not your business to hear; and if you do hear it, you need to not have a role in spreading it. When in doubt, ask yourself, "If this was something that happened to me, would I want the entire office to know about it? Would I want everyone chilling by the water cooler talking about my affair with the gardener?"
Quit acting like your life is rainbows and butterflies
A big problem with judging others is that it gives you this illusion that you're holier-than-thou and your life is filled with perfection, when we both know it's not. I call bullshit. You've made mistakes in your life. There are things behind the veil that you don't want others to know. You, as a normal human being, are flawed. And that's okay.
You're creating a false reality for your own life
That illusion leads to a false sense of stability, which means when shit inevitably goes wrong in your life – and it will – you'll have no idea how to handle it. Being open to the reality that life is not black and white, that 20 year long marriages end, that people sometimes do shameful things when trying to climb out of dark holes… that is life. And when you accept life for being the complicated cycle that it is, you'll do a much better job handling it when your life gets complicated. Stop pretending you're somehow immune – because you're not.
It's really, really fucking annoying
Look, no one likes your judge-y pants. When you do your low blows and you take a sip of wine and you roll your eyes, it makes most people want to punch you in the face. What are you trying to prove, and most importantly, who are you trying to prove it to? You're spreading your ignorance, hate, and negativity and you seriously think it makes you look cool. We're not in high school anymore, we see through your bullshit, and it still makes us want to punch you in the face.
Just live and let live
Leave people alone. Let them live their lives while you live yours. Don't focus on how you would have handled a situation, or on what your perception of right and wrong is; focus on being there, offering advice when it's warranted, and being a beacon of strength for friends going through a hard time. Set an example for others and ignore shit that's none of your business. Learn to not have a say about every single thing you hear.
Embrace the fact that life is complicated and we're all just trying to figure it out.
And don't be an asshole.


text:
Orange Carrot Puree
Orange carrot juice is one of the most pleasant yet unexpected combinations! Somehow they just work together in spite of how different they seem. They don't just taste good together, though, they pack a huge nutritional punch when paired! The vitamin C and beta carotene alone is worth a swig or two. My only reservation is the juice part. Carrots are more nutritious when cooked because their hardness makes them difficult for the body to break down, so juicing is the answer, right? No, because when they are juiced the fiber is left in the juicer but not the juice. How to create this pairing without loosing the fiber? Easy! Cook the carrots, combine the orange juice and the cooked carrots in the puree and boom! All the flavor and vitamins of orange carrot juice, with the fiber to go with it! This puree is so delicate and tasty, it will surprise even the picky eater.
6 large Organic Carrots
1- Boil water on the stove top in a medium sauce pan.
2- Peel and cut the carrots into rounds and place in the boiling water. Boil for 15-20 minutes or until soft.
3- Cut the Oranges in half and juice. You cannot get unpasteurized juice in the store, so you are better off getting a bag of fresh Florida Oranges and juicing them yourself! Have the older kids help, but be sure to go back for the extra juice in each half! Kids don't always get it all!
4- Strain the cooked carrots and place in the food processor.
5- Add the orange juice and blend until smooth!
6- Transfer first to the Foodii squeeze bottle and then the Kiinde Twist Pouches and store in the freezer for up to 3 months!


text:
"> "> ">
Looking to get spotless & wrinkle free laundry? Superior Dress Laundry is at your service. Be it washing & folding of your routine wear or special services, choose from their services and enjoy a hassle free experience.
That means you won't be able to enjoy perks like
1- Free pickup and delivery
2- Discounts and offers by justclean partners
3- Order tracking feature
4- justclean's 5-start customer service round the clock.
5- Variety of payment options such as "Cash on Delivery", Pay by credit / debit cards, pay by telcos
If you would like justclean to list Superior Dress Laundry as a partner, please reach us out and we'll try to add the Superior Dress Laundry in justclean for you.
The good news is that we have 4 other laundries ready to offer you all the above laundry services in Al Hidd.
Signup now on justclean and discover great deals and discounts offered by laundries in your area. At the same price as offered by your laundry, enjoy more services like free pickup and dropoff, around the clock support, 4-hours fast laundry and lots more.
As far as laundry goes, we will always have your back.
Superior Dress Laundry is located in Al Hidd. Currently, we have 43 laundries in Al Hidd. Please note that when there is not enough laundries in Al Hidd, justclean gets another 4 laundries to pick up your clothes in Al Hidd. Thanks to our logistic solutions, we make sure that we can pick up and deliver your laundry in Al Hidd, whenever you need.
To make your laundry pickup & delivery smoother, our support team is at your service by email, chat & phone.
There is a good number of laundries in Al Hidd. It is one of the best served laundry pickup & delivery in Muharraq. You should be able to find the right one for your cleaning services.
If you need any help to choose the right laundry, please do not hesitate to contact us. Our support agents are experts when it comes to choosing the right laundry for your clothes - regular or delicates.


text:
Today is the last chance to submit ideas for the conceptual design commemorating the Great Synagogue in Tłomackie. Works can be still sent till the end of the day to the e-mail address: email@example.com or postal address of the Jewish Historical Institute (date as postmarked). We are extremely happy to see the interest in the contest not only among the architectural studios but also among the amateurs. It is an important evidence for us that the memory of the Great Synagogue is still present among various communities.
The next stage of the contest will include getting acquainted with the works and the deliberation of the jury after which we will choose the winners. We are also planning a post-contest exhibition of the submitted works combined with the announcement of the results of the competition.
On that day, with relation to the 70th anniversary of the demolition of the Great Synagogue in Tłomackie, we are planning to commemorate it in the urban space in a special way.
See you on 16th May at the Jewish Historical Institute!


text:
henry n.
San Francisco, CA
American Furniture Galleries
The sales staff here is so knowledgeable and great to work with. They seem to really try and help customers find the right pieces to fit their needs and not their pocket books! I stopped by the store on the recommendation by a friend because I did not know what I wanted for my new place AND it is a difficult space to work with. The salesman that helped me was amazing; I was blown away by how much he knew not only about the furniture itself, but also decorating. I would definitely recommend American Furniture!
Cabrillo Plumbing & Heating
We always have an excellent experience with Cabrillo and it's skilled plumbers. Great service; reliable and prompt.
Canyon Creek Pet Hospital
I had only been in here once before a few weeks ago for the groomers. But when my dog was hit by a car, this was the first place I thought of. I was blown away with how quickly they got us in and were able to calm our dog down almost immediately. The urgent care here is amazing, too bad hospitals do not run this efficiently. I am so grateful for Canyon Creek, my family and I will be forever thankful for you all.


text:
Everyone desires to reside in a state of the art home, but very few of us take time to plan how this will actually happen. Have you ever bought a piece of furniture only to note that it cannot get through your front door and you have to take it back or count your losses? Others have had bigger issues, and it all stems from poor planning. Decorating your home can be one of the most fulfilling undertakings. But, things can go wrong, and you end up with a worse than what you had originally. The following are some of the mistakes to avoid when decorating your home
Poor budgeting
You must come up with an estimate that will guide you when making these decorations. It can be an expensive undertaking depending on the approach you take and raw materials that you use. Sit down with your designers and create a budget that will indicate what you should buy and where. You may find your project stalling halfway simply because you underestimated. In other cases, you may find that you use fixtures and fittings that do not blend with the rest because you are on a tight budget.
Failure to consider the design of your house
You may have the most expensive or fanciest pieces of furniture, but they never fit in your living room. If you have a vintage house, then your fittings and fixtures should be the same. The outer design should blend seamlessly with what is inside the house. Attend open houses with designs that you like and get a mental picture of what to expect in your home.
Not taking care of your plants as expected
You can bring life into your home by growing various types of plants in your house. The only challenge is that there are a lot of challenges, such as adverse weather conditions that affect growth. LED grow lights are an excellent solution to help you grow such plants without much struggle. However, you have to understand how they operate. You can read the full info and get a glimpse of the mistakes to avoid when using LED growing technology.
Not paying attention to the colors
You may have expensive pieces of furniture and an elegant house, but the colors fail you. It is crucial to consider the message that you want to pass using the paint you choose. Neutral colors will always win the hearts of many people.


text:
Brad is an Associate in the litigation section of the firm's New Orleans office. He specializes in the defense of aviation, products liability, and admiralty and maritime claims. Brad has also represented clients in cases involving insurance coverage, business disputes, personal injury, property damage, and toxic tort.
Brad earned his J.D., magna cum laude, from Tulane University Law School in 2013. While in school, Brad served on the Senior Editorial Board of the Tulane Maritime Law Journal, worked as research assistant to Professor A. N. Yiannopoulos and completed an externship in the chambers of Justice Greg G. Guidry of the Louisiana Supreme Court. At graduation, he was awarded a certificate of specialization in admiralty and maritime law.
Brad is admitted to practice before all Louisiana state courts, the United States District Courts for the Eastern, Middle, and Western Districts of Louisiana, and the United States Court of Appeals for the Fifth Circuit. He has also been admitted pro hac vice in the United States District Court for the Southern District of Mississippi.


text:
Article by Niru Raghavan
Veracode Marketing recently polled a list of InfoSec luminaries, asking them "What is the biggest mistake companies make with Application Security and how can they fix it?"
We're pleased to present the responses from a wide array of security experts including Bill Brenner of CSO Magazine, Andrew Hay of the 451 Group, Jack Daniel of Tenable Network Security and Veracode's own, Chris Wysopal.
While all our experts have their unique perspectives, some common themes arose including the basic idea of taking application security more seriously and committing to a programmatic approach vs. ad hoc manual testing.
We want to thank all our respondents for participating and we welcome your thoughts too – use our comment area and tell us, "What do you think is the biggest appsec mistake companies are making today?"
Q: What is the biggest mistake companies make with Application Security and how can they fix it?
Alan Shimel, Co-Founder and Managing Partner, The CISO Group, @ashimmy
While some may point to technical coding and development mistakes in App Security, I am going to keep my answer simple. The single biggest mistake companies make about Application Security is complacency around thinking the world is static.
Apps don't live in a static world any more than we do. Even if the app code has not changed, it does not mean that server, client or network has remained static. Patches, upgrades and new equipment are constant in the technology field. Just because you checked and re-checked your code and app when you first installed it and you haven't upgraded or changed it doesn't mean it is secure today.
Did you account for things like a change in the firewall rule set? What about a patch to the OS of server you are using? A hypervisor update maybe? How about which clients are accessing the site or what browser and browser version they are using? There are so many variables that are constantly changing.
Too many people think that App Security testing is a onetime thing or something done only when you update your app code, but there is more to App Security then just the app.
I remember back when performing vulnerability scans on a regular basis was considered too much. Once every year or two at best was the norm. Today, no one would consider an annual vulnerability test good security. The same for App Security. Even if you have a WAF or some other technology sitting in front of your App, you need to be testing and probing for vulnerabilities, exploitability and reachability on a regular basis.
An app security program that makes testing a regular event is the best thing companies can do to improve their app security. Don't be complacent and don't think if it was secure then, it is secure now!
Alan Shimel is co-founder and Managing Partner at The CISO Group, Alan Shimel is responsible for driving the vision and mission of the company. The CISO Group offers security consulting and PCI compliance management for the payment card industry. Prior to The CISO Group, Alan was the Chief Strategy Officer at StillSecure. Shimel was the public persona of StillSecure as it grew from start up to helping defend some of the largest and most sensitive networks in the world. Shimel is an often-cited personality in the technology community and is a sought-after speaker at industry and government conferences and events. His commentary about the state of security, open source and life is followed closely by many industry insiders via his blog and podcast, "Ashimmy, After All These Years" (www.ashimmy.com). Alan is now also a regular contributor to The CISO Group's security.exe blog and podcast, as well as the Secure Cloud Review blog. Alan has helped build several successful technology companies by combining a strong business background with a deep knowledge of technology. His legal background, long experience in the field, and New York street smarts combine to form a unique personality.
Andrew Hay, Senior Security Analyst, 451 Research, @andrewsmhay
With regards to purchased COTS applications, I think that organizations place too much trust in the delivered product. Most organizations accept the product at face value and believe that the vendor has performed enough due diligence to ensure that the product is secure – I mean, who would release a product riddled with security problems simply to make money?
The answer, pretty much every vendor out there. Software vendors are in the business of making money and to do that they must take certain risks along the way to ensure that they can get their product to market in a timely manner. We'd all like to think that software vendors want to protect their customer base but, in reality, most simply want to protect their ability to sell future products into that customer base.
Unfortunately, most vendors treat security (i.e. bugs, vulnerabilities, etc.) as issues to be fixed using out of band updating mechanisms (such as patches) or in the next major release – new feature and functionality permitting, of course. Every organization should test new (and recently updated) applications deployed within their environment for vulnerabilities and potential breach vectors with the skepticism that the vendor may not have performed enough due diligence to secure its own software.
Andrew Hay is a Senior Security Analyst for 451 Research's Enterprise Security Practice (ESP). Andrew provides technology vendors, private equity firms, venture capitalists and end users with strategic advisory services – including competitive research, new product and go-to-market positioning, investment due diligence and tactical partnership, and M&A strategy. Through his work at 451 Research, Andrew has been instrumental in securing tens of millions of dollars in equity investment for numerous security product vendors. He is a veteran strategist with more than a decade of experience related to endpoint, network and security management technologies.
Bill Brenner, Senior Editor, CSO Magazine, @BillBrenner70
Companies rush their apps to market with no consideration for the security implications. An app is just another product to be sold, and when there's money to be made, developers aren't given the time to make sure the code is ironclad against potential exploits. So the apps go to market with security vulnerabilities the bad guys eventually discover.
The solution is to slow down the production process and allow developers to build security into the app from day one. Do I think there are any moves in the right direction on this front? A little bit. But not nearly enough. The sad part is that most customers would rather wait and have a more secure app than have quick access to one that leaves them vulnerable to thievery.
Bill Brenner reports, writes and edits content focusing on the latest information threats and defenses—from social networking to mobile phone security to glamorous subjects like SAS70 replacement SSAE16. He writes CSO's daily Salted Hash news analysis blog. Bill has more than 17 years of experience as a reporter and editor, and has focused on information security for the past seven and a half years. Before joining CSO that was senior news writer for TechTarget's Security Media Group. Going further back, he spent four years as an assignment editor at The Eagle-Tribune daily newspaper of Massachusetts' Merrimack Valley region.
David LeBlanc, Senior Security Technologist, Microsoft
There are actually a set of related problems, depending on the age of the code. If a company has an older code base that has been around for a long time, then it is likely that the code wasn't built using modern programming practices, or with any concern to security. If you attempt to retrofit security into older code, it is going to be difficult – older code is difficult to refactor, and advice along the lines of "Just use Standard Template Library containers, and now errors will be safe crashes" is just really not practical unless you have time thoroughly review, refactor and retest the code.
A second problem is thinking that you can consider security later, which happens more often with new code. People make similar mistakes with performance – if your performance or security problems are due to deep design flaws, then fixing them is going to be difficult. I find that I am usually given time to write something once, maybe with a rewrite if I'm fortunate – thinking I'm going to come back and tidy it up later is just not realistic. You may not do all the security work you'd like – shipping is a feature, especially in a start-up – but if you're at least thinking about security, you're more likely to avoid making major problems.
A third problem is lack of education – people usually don't come out of school knowing anything about security, nor do they typically get it working in many places. If you want best results, some of every team needs to have people who spend time understanding how security applies to what they do. Having a core group who live and breathe security is great if you can afford it, and you need experts to be able to help with tough problems, but the best results come when the people closest to the code are thinking about security.
Perhaps the biggest problem is thinking that there is some magic solution. All the systems and processes you can put into place to help ensure security and all the tools you might run are great – they all help. But they're not sufficient. What really works in the long run is to have people who care about creating a quality product, understand that security is an important part of quality, and are willing to do hard work to achieve that quality. That's why I named 'Writing Secure Code' after 'Writing Solid Code' – solid, robust code is most often secure code. Solid, secure code takes hard work – which is the real solution.
David LeBlanc is a senior security technologist in Microsoft's Information Technology Group. His primary role is defending the Microsoft network from attack. He has worked in the security field throughout his professional life, including working at Internet Security Systems where he was the primary engineer on ISS's award-winning security products. David serves on a number of external security-related advisory boards.
Eoin Keary, Global Vice Chair, OWASP and Director/CTO, BCC Risk Advisory @EoinKeary
The lack of developer & stake holder awareness and relying on a single time limited penetration test to ensure an application is secure is a common and big mistake. Developers should not need to be security experts but if they were aware of the tools available to them I believe they would write more secure code. If it is simply calling an encoding API or performing negative unit testing, this is not a large overhead if developers and architects are made aware early in the SDLC.
Understanding the risks "out there" be it client security issues or traditional server issues software design and architecture security would vastly improve if the threats and potential attacks were known. From a secure code perspective one fix may mitigate many classes of vulnerabilities if it was implemented. Strategies such as using a common enterprise-wide component for authentication or data validation pays back large dividends. All a developer would be required to do is use the component/API when they invoke certain functions. They do not need to even know why in some circumstances but all they need to know is to do it.
Reliance on a single pen test, with a finite test window is also a big mistake. It puts the security of the application immediately on the "back-foot". It must be remembered that an attacker has as long as they need to breach a system while defense relying on a single pen test is a loosing game. I'd suggest a continuous monitoring approach, like an "application radar" which constantly scans an application and flags changes as they occur. This can also help with metrics and correlation of vulnerabilities with code changes. Continuous monitoring coupled with a robust SDLC is a more sustainable approach than a single pen test.
Eoin Keary is Global Vice chair of OWASP he is also a director with BCCRiskAdvisory.com, based in Dublin, Ireland.
Guillaume Lovet, Head of Fortiguard Research EMEA, Fortinet, @GuillaumeLovet
Inconsistent patching policy, if they have one at all. I do understand that patching production machines, especially those providing a service to customers, cannot always be done right away, and that the stability of the patched servers must be ensured first in a testing environment. But in that case, you must be 100% sure that the IPS system shielding your servers does block any attack that could exploit the vulnerability that will be fixed by the patch.
Vulnerable applications are perhaps not the only entry point to a company's information systems, but given the availability of free and public tools implementing exploits for known vulnerabilities, it is likely the easiest, and the one an attacker will probably try first. Thus, by blocking it with an IPS system, not only do you prevent the attack, but you also become informed that you're subject to penetration attempts, and that attackers may from now on attempt to leverage more sophisticated attack vectors.
Guillaume Lovet is the head of Fortinet's FortiGuard security research team in EMEA and a regular speaker at international security conferences.
Jack Daniel, Product Manager, Tenable Network Security, @jack_daniel
I am not an "application security guy", but I have seen (and possibly even made) some fundamental appsec mistakes as a network security practitioner- let's look at two of them.
The first mistake is more social than technical. When there are questions or concerns about application security issues many of us in the network or systems admin world tend to avoid having a meaningful conversation about it, dismissing the ability of programmers, brogrammers, or DBAs to understand the fundamentals of security, as least as we see "the fundamentals of security".
The other mistake is that when network and systems security practitioners discover appsec problems we sometimes shrug and move on, thinking there is nothing we can do about appsec issues. We need to understand the problem- which probably requires a conversation (see above) with those who understand the issue. Then we need to explore and implement mitigations where possible, or at least crank up monitoring on systems potentially exposed by the problem(s).
We all need to get better at discussing the issues we face if we are going to make progress securing our environments, none of us can do it alone.
Jack Daniel, Technical Product Manager for Tenable Network Security, has over 20 years experience in network and system administration and security, and has worked in a variety of practitioner and management positions. Jack's Uncommon Sense Security was recently named the Most Entertaining Security Blog at the 2012 Security Blogger Awards. An early member of the information security community on Twitter, @jack_daniel is an active and vocal Twitter user. A technology community activist, he supports several information security and technology organizations; Jack co-founded and organizes Security B-Sides events, gatherings of security enthusiasts born from the desire for people to share and learn in an open environment. Jack is a frequent speaker at technology and security events including Shmoocon, DEFCON, SecTor, RSA, and Security BSides. Jack is a CISSP, holds CCSK, and is a Microsoft MVP for Enterprise Security.
Marco Ramilli, Computer Science Researcher, Marco Ramilli's Blog
I cannot find a general answer to this specific question. Companies are different and each one views Security from different perspectives. So my first step to answer would be to categorize companies trying to investigate the different points of view. I see 3 company types, under the Security perspective.
1. Companies who provide security. These companies are the most involved into Security such as, Antivirus companies, Security consultant companies and security related software companies.
2. Companies who design software. These companies strongly need security but "security" is not their main business. For example Facebook provides an innovative communication channel and its main business is very far from security related contents. Skype, another good communication software, strongly needs built in security, but security itself is not a Skype business. Or again, WordPress, strongly needs security, but it's main business is to provide a quick, easy and friendly way to build your web corners.
3. Finally, non software companies. Those companies have a very different business model. They do not provide software and or security, they just use software, and often, they even don't know what security is. For example private clinics, hardware providers, shopping centers, car builders and so on…
For each of the three categories I believe we have different problems.
Companies which belong to the first category are, obviously, the most conscious about application security issues, they provide solutions and consultancies specifically to solve such issues. My personal point of view, here, regards education. Often security related companies tend to sell their product(s)/consultancy(ies) without caring much about education. Even if the customer could use the best ANtiVirus engine but he does not know how to use it, or why to use it… The best antivirus engine does not make a secure system per-se. I think the main companies mistake in the first category is the lack of costumers education. These kind of companies should educate their customers about security, about the risks behind the corner if security policies are not respected.
Companies which belong to the second category often do the mistake of considering "security" only at the end of the software development process. My specific experience on this kind of companies is pretty wide and the big majority of the analyzed companies uses to introduce security only at the end of the development process, sometimes even after functional tests. Security should be included into the analysis layer, at the beginning as a straight and clear software requirement. Again, security should be a requirement and not a property. Respecting security requirements often means to make huge and deep changes into the developing process. Companies which add these requirements at the end of the process often need to radically change what they have done so far, this is a huge cost for the company, so huge that small companies often decide to not implement security at all. We have examples of that in everyday life.
Finally, companies which belong to the third category often are unaware about application security. Doctors, nurses or hardware engineers don't care about software security and tend to delegate security to the used applications. But even if the doctor is using the most innovative and the most secure clinical records management system and he uses a weak password or, even worst, he shares his own password with colleagues, the security of the whole system breaks. Those companies should understand that security is a whole process beginning from security consultants, following to developers and ending with them: the end-users. If only a ring of this chain is weak the overall system security will fail.
Security, application security, computer security, information security, or call it as you prefer, is one of the hardest requirements to respect. It is much more easy to compromise a system rather then protect it. Indeed the attacker needs only one weak ring to compromise the security of a whole system, contrary the system needs to assure "security" at all its stages, even where non security related users (companies) are involved.
Marco Ramilli is a computer scientist researcher with an intensive hacking background. He got his PhD in computer security from University of Bologna (Italy). Marco has been working with US Government (National Institute of Standards and Technology, Security Division) and currently works with the University of California, Davis (Security Labs) on new security paradigms, penetration testing methodologies and electronic voting systems' security.
Mikko Hypponen, Chief Research Officer, F-Secure, @Mikko
The biggest mistake companies make is focusing on Application Security only on traditional computer systems and ignoring it on all other platforms. They should be looking at the big picture and understand that Application Security should apply to any platform that can run general-purpose applications.
Mikko Hypponen is the world champion in Xevious.
Neil Roiter, Director of Research, Corero Network Security, @nroiter
Software Security is not a Series of Tasks — It's Commitment to a Program
We've had more than a decade of coming to grips with the self-evident truth that insecure software is the prime attack vector for cyber criminals, industrial espionage, hacktivists and agents of unfriendly nation states. Yet, far too many enterprises address software security on an ad hoc basis, responding to a particular need at a particular time. The greatest mistake in addressing software security is in not really addressing it.
Companies are prompted to review their security practices at various points. Perhaps they are obligated to meet security requirements laid down by a partner or large customer for a new business initiative. Or, management decides that an important new business application is a good time to start paying attention to security. Maybe a data breach or revealing penetration test prompts a knee-jerk reaction to "fix it."
In many cases, regulations such as PCI DSS, which mandates code review under Section 6.6, may spur companies to do enough to meet the requirements. This is not a substitute for a comprehensive software security program. We hear it time and again: Security does not flow from compliance, but, for the most part, compliance flows as a consequence of strong security programs.
Unsystematic, reactionary software security efforts often are costly and ineffective. Companies that do not have a well-defined and sustainable software security program often lack sufficient personnel with the requisite security expertise to properly vet applications at any point in the cycle: source code, compiled programs, and installed applications. All too often, there are no well-defined roles and no accountability.
The end-product is software that remains highly insecure and the next software security fire drill will be no better. Those who do not learn from history are certainly doomed to repeat it.
Enterprises have no excuse for failing to recognize insecure software as perhaps the greatest security threat to their business. It's well established that the application layer is the vector for the overwhelming majority of successful attacks. Witness one headline-grabbing event after another, exploiting both zero-day vulnerabilities and flaws that easily could be fixed.
However, while many enterprises have a more systematic and effective approach to dealing with network-layer threats, they are far slower to apply the same logic to the risk posed by insecure software. Or, they are not prepared to apply the level of effort and resources required to implement a comprehensive sustainable program.
Though it is counterproductive, it is not surprising. Enterprises may easily have hundreds, perhaps thousands of legacy applications that have not been vetted adequately for security. How does one establish priorities for review and testing? Who will perform the testing and who will be held accountable for it and for subsequent remediation? How will the enterprise fund security personnel, either internal or outsourced? And how will the enterprise implement and sustain both a secure software development life cycle going forward and systematic review of existing applications?
It's all somewhat daunting, but while the natural tendency to shy away from the challenge may be understandable at some level, it's a risky approach when one considers the potential impact to the business. The latest Ponemon Institute survey states that the average cost of a single data breach is $5.5 million (and that's down from the previous year). The risk associated with the theft of intellectual property is perhaps even more compelling: Cyber criminals, competitors and foreign entities are after source code, designs, business plans, research secrets, etc. Try to measure the cost in lost business, stock value and brand reputation. Then consider software security as an absolute business imperative and the failure to implement enterprise-wide governance in this critical area as an unacceptable business risk At a high level, this means a secure software program that starts with top management support and:
• Defines management and operational roles
• Includes training in application security
• Is built on clearly defined policies, such as tolerance for risk, definition of severity of vulnerabilities, time frames for remediation, etc. , and accountability for enforcement
• Reporting and tracking using metrics that are accepted across the enterprise.
Neil Roiter is director of research at Corero Network Security and editor of the Security Bistro Blog. He is best known for his decade of work as a technology journalist, focusing on information security, risk and compliance. Before joining Corero, he was features editor and senior technology editor at Information Security magazine and SearchSecurity.com, and has written about information security from the days of "Internet hooliganism" and hacking for the sheer perverse joy of it, to today's world of cyber crime as global business. An expert in network security, he is often quoted in technology publications.
Rosie Sherry, Founder and Community Manager, Software Testing Club, @rosiesherry
(Note: Rosie expanded her answer to include all of testing, not just AppSec)
Assumptions and failing to question
Often I come across situations where companies assume there is only one way of testing. The conversation typically starts with that they want so and so tested and they want very specific deliverables – Test Plan Documentation, Test Cases and of course they want everything tested and all bugs found.
When asked 'why' or 'how' they want or need all of these specific outputs and outcomes, often they are left speechless.
There can be so much waste in testing. Huge amounts of time planning up front to only find out that what they had been planning for was incorrect. Or perhaps working on things that aren't actually needed – like lengthy documentation that no one ever requests or reads and written test cases that are irrelevant.
How can it be fixed?
Always question why they are doing something – Is what they are doing adding real value? Is it something that is really needed? Are there better ways to approach the testing?
Never assume: What is really important to achieve within testing? Are standard documented test cases required? Or can coverage be documented in another way? Perhaps through an exploratory testing approach?
Rosie Sherry is started the Software Testing Club 5 years ago as a professional place to for software testers to hang out online. What started out as a side project has, over time, turned into a full blown business. It has grown to produce a publication (The Testing Planet), global community driven meetups, a conference and some training courses. Prior to The Software Testing Club, Rosie worked as a software tester for various startups and digital agencies.
Simon Knight, Editor – The Testing Planet, Software Testing Club, @sjpknight
(Note: Simon expanded his answer to include all of testing, not just AppSec)
I'm not sure if it's the biggest, but one mistake many companies make with testing is not investing in the people who perform this vital function. For too long the ISTQB Foundation certificate has been a HR pre-requisite for competence in testing, with further and ongoing education for practitioners seemingly deemed redundant.
For many companies we're living in frugal times and perhaps where money is tight this attitude can be excused. Having a great tester on your team will go a lot further towards gaining a competitive advantage in the marketplace than a mediocre one will though. And there are some other issues to consider too.
To retain a quality tester on staff, he needs to be able to see a future in testing in your company. Without investment in his testing education your tester won't see testing as a profession in its own right, viewing it instead as a stepping-stone to some other technical or managerial role. In the worst case scenario he will simply leave, taking his testing (and in many cases domain) expertise to a company that does value his skills – as I have done on more than one occasion.
Training for testers doesn't have to be expensive or certified. The marketplace has exploded with a variety of ways for test professionals to develop new skills – technical, analytical and soft:
• Coaching for example can help your tester identify and overcome weaknesses or build on strengths.
• Attending workshops or conferences can help testers network and share ideas or discuss problems.
• If money is tight, consider more radical ideas. Give your tester carte blanche to define their own [free or minimal cost] training and development routine and allocate them time out from their normal activities to implement it.
Go on – nurture your testers. They deserve it!
Simon Knight works as a tester by day and editor of The Testing Planet by night. When he's not engaged with one of those activities (or spending time with his family, reading, walking, gaming or tinkering with various coding/scripting languages), he can most likely be found hosting the increasingly regular Birmingham Software Tester Meetup. Simon has also been known to speak and write about testing related subjects.
Wim Remes, Manager, Ernst and Young ITRA FSO, @wimremes
Software Security
If there were a silver bullet solution for Software Security issues, we would all be applying it, wouldn't we? More than a decade old, SQL injection is still biting us in unpleasant locations and it seems that we are twisting and turning in a pool of quicksand rather than catching a glimpse of the shore as we try to cross the ocean. If I could point at three areas where we can do better, it would go like this:
1. Education
Any developer that comes out of a formal education track has a very limited overview of security requirements for enterprise-grade software. While I understand that there is a limited amount of time that can be spent on security-related subjects, I also believe that the only way to make software more secure is to engrain security in the mindset of the developer. This needs to go much further than bootcamps when they start their first gig or yearly awareness sessions. By then it is too late as it is bolted on to their knowledge and not an integral part of it. Make SDLC and security concepts mandatory in formal education programs.
2. Threat Modeling = overhead
It makes as much sense to do threat modeling as it does to gather user requirements. The big difference is that we don't have anyone to listen to for the former task. If we keep dwelling in the utopia where security is a 2nd class citizen, we are poised to keep losing. Both for existing software stacks as for new projects, understanding the threats against them is a penultimate priority. Only by understanding the threats, we will be able to protect the software. Threat modeling is also not a one-time exercise. Just like your user requirements threats against your applications are subject to change. Review your threat models regularly and apply changes to you application stack as required, handling them on the same level and with the same priority as those user requirements.
3. Know your frameworks
Just like productivity applications are geared towards making our live easier, development frameworks are ultimately designed to make a developers life easier. Allowing him/her to not to worry about the lower level stuff. In itself this is a good thing but we have to remain aware that the more abstract we are allowed to look at a problem, the higher the risk is that we will overlook the obvious issues we would otherwise see.
Simplicity, while attractive, is oftentimes our biggest enemy in security. Development frameworks are an obvious requirement but you should choose them carefully, for the right reasons and be aware of the security features (and lack thereof) when you chose them. They are an integral part of your development practice and they are, whether you want it or not, an cornerstone for the security of any application you will develop while using them.
Wim Remes is a Manager in the Ernst and Young ITRA FSO practice in Belgium. Apart from his professional activities he acts as Director to the board of (ISC)2, co-organizes BruCON, podcasts on the Eurotrash Security podcast and has spoken at conferences around the globe. He is passionate about information security and finding solutions for complex problems.
Chris Wysopal, Co-Founder, CTO & Chief Information Security Officer, Veracode, @weldpond
The biggest mistake that organizations make is not getting a handle on their application sprawl. They have applications being built, internally and externally, that are not known about to the people charged with managing organizational risk. How can you manage something you don't know about? Organizations need to understand their application perimeter, those applications that expose the organization's data and brand to risk. In order to do this all applications that belong to an organization need to be put under an application security program lest unknown risk build up and not understood until a breach occurs.
A simple application security program can keep application sprawl in check. There has to be an awareness by business owners and IT departments that applications should not be deployed on-site, off-site, or by service providers without a small amount of application inventorying and risk identification. Application risk identification may lead to further testing or auditing but in many cases it doesn't need to. The important part of the process is identifying risk coming from the application layer. Without that the organization is flying blind.
There are many reasons applications risk goes unknown to the organization. A business owner may outsource development and operations of an application to 3rd parties never exposing the existence of the application to the IT department. An application may be built by customizing open source and commercial components without development being involved. A SaaS provider may be utilized to process a marketing campaign. In all of these cases there is risk at the application layer that may bypass organizational controls that may work for internally developed code or outsourced code.
Putting an application inventory and risk registry in place is a great place to start on the path to a mature application security program. It puts a boundary and process around application security which encompasses the entire organization. As the program matures different levels of testing and due diligence can be applied to these applications commensurate with the identified risk.
Chris Wysopal is responsible for the security analysis capabilities of Veracode technology. Mr. Wysopal is recognized as an expert and a well known speaker in the information security field and was recently named one of InfoWorld's Top 25 CTO's and one of the 100 most influential people in IT by the editorial staffs of eWeek, CIO Insight and Baseline Magazine. Chris has testified on Capitol Hill on the subjects of government computer security and how vulnerabilities are discovered in software. He also has spoken as the keynote at West Point, to the Defense Information Systems Agency (DISA) and before the International Financial Futures and Options Exchange in London. His opinions on Internet security are highly sought after and most major print and media outlets have featured stories on Mr. Wysopal and his work.
Cross-posted from Veracode


text:
Ground was broken back in May on Habitat for Humanity's first North Cowichan project and, before the year ends, ground will be broken on the mid-Vancouver Island branch of the non-profit's first Duncan project, too.
Habitat MVI executive director Marcel Aubin said his group was granted some development permit variances by the City of Duncan on Tuesday, which should help to save some money on the ambitious six-plex project on Jubilee Street.
"The City of Duncan has really been stepping up," Aubin said. "We're trying to reduce some of our costs with the six-plex."
"Both [Jubilee Street and the property on Cowichan Lake Road] are interesting investments we've made into Cowichan here because we purchased both pieces of property at fair market value so it sort of put us behind."
Asking for variances on some development fees help them to catch up but Aubin also noted that local businesses and trades have been "phenomenal" in donating their time and services to keep the projects on budget.
"It's actually looking really good," Aubin said. "The business community has really stepped up and now that we have those relationships it's going to make it easier when we get to the six-plex."
Habitat is still looking for a family to fill the four-bedroom home on one side of the Cowichan Lake Road duplex. The deadline for submitting applications for the six-plex has also passed.
"We'll see how we've done as far as what applications we've received," Aubin said, adding that a six-member Family Committee will set to work sorting through the applications to select the candidates that fit their criteria best.
Habitat is always looking for more volunteers. Whether it's at the build sites or in the Re-Store or any number of other tasks, "every other day there's something that we need," Aubin said.
Like us on Facebook and follow us on Twitter


text: Atlanta Business Chronicle recognizes Beth Cayce with a Healthcare Hero Award in the Allied Health Professional category Posted in Beyond Finances on September 20, 2019 Beth Cayce found her love for the health care industry as an adolescent while taking care of friends and members of her own family. What she loved about taking care of them was the interaction with the older adults and the fact that she was helping others. That feeling stayed with Cayce, and today, she is the founder and chief executive officer of CaraVita Home Care in Roswell. After 44 years in the health care industry, Cayce said what she enjoys most about her job is teaching and mentoring staff and families in the area of best care practices. "My goal is to take everything I have learned in my career and share it with as many helping professionals and family caregivers as I can," She said. When Cayce decided to start her own home care business, she said she had the health care side of the business, but her challenge was learning how to start and grow her own health care business. "I have been blessed to have had many corporate jobs creating programs that provide senior care, but my challenge was learning how to be an entrepreneur," she said. "I had to learn new business and marketing skills to promote my services and to reach the audience I wanted to serve." Since that time, she has come a long way. Not only has she succeeded, but over the years Cayce and her business have been recognized with a number of awards, including a 2019 Atlanta Business Chronicle's Healthcare Heroes Award in the Allied Health Professional category in May. "First off, I believe all of the nominated are heroes, and to be chosen was an incredible honor in a profession I love," she said. "My career has been life fulfilling and to be recognized for my service is icing on the cake." For those who are looking at a similar career path, Cayce said it's good to adapt a love of lifelong learning and to be inquisitive. Learn best practices and seek to improve them. Put yourself in the shoes of those you serve. And she added that it's easy to experience burnout if you're not careful, so be sure to take time to recharge your own batteries. "I think when you find a profession that fulfills you, you are energized within it, and you are working in your God-given purpose, she said. "I encourage my students to find that purpose that will fulfill them and that melds their heart, mind, and spirit." We congratulate Beth Cayce for being recognized as a 2019 Healthcare Hero!