text:
Friday, October 27, 2006
Response to Daily Dave Thread
The offensive side really made an appearance with yesterday's thread, where Dave's "lots of monkeys staring at a screen....security?" thread says:
My feeling is that IDS is 1980's technology and doesn't work anymore. This makes Sourcefire and Counterpane valuable because they let people fill the checkbox at the lowest possible cost, but if it's free for all IBM customers to throw an IDS in the mix then the price of that checkbox is going to get driven down as well.
First, it's kind of neat to see anyone speaking about "IDS" instead of "IPS" here. I think this reflects Dave's background working for everyone's favorite three letter agency. The spooks and .mil types (like me) tend to be the last people to even think about detection these days.
Second, it seems to be popular to think of "IDS" as strictly a signature-based technology, as Gadi Evron believes:
IDS devices are signature based and try to detect bad behaviour using, erm, a sniffer or equivalent.
That's hasn't been true for a while, even if you're talking about Snort. Sure, there are tons of signatures, but they're certainly not just for content matching. If you're thinking about Bro, signatures aren't really even the main issue -- protocol anomaly detection is.
Python demigod Dave posts another message that is a little worrisome:
Making IDS part of a defense in depth strategy is giving it some credit for actually providing defense, which it doesn't do. The people who win the IDS game are the people who spend the least money on it. This is why security outsourcing makes money - it's just as worthless as maintaining the IDS yourself, but it costs less. Likewise, Snort is a great IDS solution because it does nothing but it does it cheaper.
The technology curve is towards complex, encrypted, asynchronous protocols. The further into time you look, the worse the chances are that sniffing traffic is an answer to anything.
The market is slowly realizing this technology's time has past, but in the meantime lots of people are making giant bus-loads of cash. Good for them. But IDS technology isn't relevant to a security discussion in this day and age and it's not going to be anytime soon.
I will agree that many commercial managed security monitoring services are worthless, to the extent that they are ticket- and malware-oriented. However, the idea that Snort "does nothing" is just wrong. Hopefully Dave is just being inflammatory to spur discussion. Sure, Snort is not going to detect an arbitrary outbound encrypted covert channel using port 443. That doesn't mean Snort isn't useful for the hundreds of other attack patterns still seen in the wild.
Since the majority of the posters to this thread are offensive, I doubt they have read any of my books. For example, reverse engineering guru Halvar Flake follows up with this insight:
I still agree with the concept of replacing an IDS with just a large quantity of tapes on which to archive all traffic. IDSs will never alert you to an attack-in-progress, and by just dumping everything onto a disk somewhere you can at least do a halfways-decent forensics job thereafter. Since everybody and his dog is doing cryptoshellcode these days you won't be all-knowing, but at least you should be able to properly identify which machine got owned first.
Welcome to network security monitoring, albeit at least a decade late. The fact that the criminal underground is using covert and encrypted channels now doesn't mean they weren't used 10 plus years ago, when smart people in the spook and .mil worlds needed a way to gain some sort of awareness of network activities by more dangerous adversaries.
Most respected IDS old-school critic Tom Ptacek isn't convinced:
I am waiting for someone to tell me the story about how an IDS saved their bacon. I'm not interested in the story about how it found the guy with the spyware infection or the bot installation; secops teams find those things all the time in their firewall logs and they don't
freak out about it when they do.
The last times I manned a console full-time as a "SOC monkey," for the Air Force in 1998-2001 and at Ball Aerospace in 2001-2002, we found intrusions all the time. I expect several people in the #snort-gui channel where I idle on irc.freenode.net also have stories to share. I'll have more to say on this later.
Tom continues:
This "signature" vs. "real intrusion detection" thing is a big red herring. Intrusion detection has been an active field of research for over 15 years now and apart from Tripwire I can't point to anything operationally valuable it has produced.
This sounds like the "Snort is worthless" argument Dave proposed. Finally:
Halvar, when you figure out how to parallelize enough striped tape I/O to keep up with a gigE connection, then, Halvar, then I will respect you.
This is another common argument. Most every detection critic argues their pipes are too big to do any useful full content collection. Let's just say that is not a problem for everyone. Many, many organizations connect to the Internet using OC-3s (155 MBps), fractional OC-3s, T-3s (45 Mbps) and below. Full content collection, especially at the frac OC-3 (say 60 Mbps) and lower, is no problem -- even for commodity hardware, if you use Intel NICs, a solid OS, and fast, large hard drives. Even if you drop some small percentage of the traffic, so what? What are the odds that you drop everything that is relevant to your investigation, all the time?
What if your pipes really are too big for full content collection, say in the core of the network? I would argue that's not the place to do full content collection, but let's say you are told to "do something" about detection in a high-bandwidth environment. That's where the other NSM data types come into play -- namely session data and statistical data. Can't save every packet, or you don't want to? Save sessions describing who talked to who, when, using what protocols and services, and how much data was transferred. That is absolute gold for traffic analysis, and it doesn't matter if it's encrypted. At the very least you can profile the traffic statistically.
The root of this problem with this discussion is the narrow idea that a magic box can sit on an arbitrary network and tell you when something "bad" happens. That absolutely won't be possible, at least not for every imaginable "bad" case. The "IDS" has been pigeonholed in the same way the "firewall" has -- as a product and not a real system.
A standard "IDS" isn't an "intrusion detection system" at all; it's an attack indication system. Snort gives you a hint that something bad might be happening. You need the rest of your NSM data to determine what is going on. You can also start with non-alert NSM data (as described in this war story) and investigate intrusions.
Similarly, a firewall isn't necessarily stopping attacks; it should be enforcing an access control policy.
A real detection system identifies deviations from policy, and perhaps should be called a network policy violation detector. A real network policy enforcement system prevents policy violations. The point is that neither has to be boxed into an appliance and sold as a "NPVD" or "NPES". (As you can see, acronyms which tend to accurately describe a system's functionality are completely marketing-unfriendly.)
I'll conclude by saying that I agree with Dave about "monkeys" staring at screens. Many of those sorts of analysts are not doing NSM-centric work that would truly discover intrusions. Yes, the network is a tough place to detect. However, I've argued before that in an age of ubiquitous kernel-mode rootkits, NSM is needed more than ever. If you can't trust a rootkit-controlled host to tell you what's happening, why would you ignore the network? Sure, the traffic could be covert, encrypted, and so forth, but if the pattern of activity isn't normal you can verify that at least something suspicious is happening.
It's time for another book.
Thoughts on Sourcefire IPO
I'm excited by this development. I'll probably even buy some Sourcefire stock, just so I can attend the shareholders meeting. I've never owned stock in a friend's company, so this would be novel enough to justify the purchase.
However, in the long term I expect Sourcefire to be acquired anyway. I stand by my ideas that all network security functions will collapse to the switch, something Richard Stiennon called Secure Network Fabric. This means Sourcefire either needs to sell switches that compete with Cisco (unlikely) or be bought by Cisco (possibly) or a Cisco competitor (probably).
Customers are growing increasingly disillusioned with buying more and more point products. If they simply perceive that existing equipment (switches and routers) can be upgraded to implement new security features, they'll pursue that path. Alternatively, they'll include the new functionality in the next switch/router technology refresh. At the most I see a "switch plus one" model, where no more than one stand-alone security device will support the core switch/router infrastructure. Everything that a switch/router cannot perform, security-wise, will be expected of the "firewall," which Marcus Ranum originally defined as a security system and not simply a product.
At some point a majority of hosts will be virtualized, and many network and host security measures will be performed by the hypervisor anyway.
Wednesday, October 25, 2006
Counterpane Bought: Investors Relax
As at 31 December 2004 the audited gross assets of the business were $6.8m.
That doesn't sound very promising.
I expect a good amount of reorganization and removal of personnel. BT will want the low-level analysts to stay, but some will probably leave. The middle-managers will want to stay, but BT will send them packing. Since Counterpane's brain trust has largely disappeared, they only need to keep Bruce Schneier as their "visibility guy" or "mantlepiece."
Good luck to them -- I imagine they will be morphed into protecting BT's cloud.
Update: After reading helpful comments and stories like this, it appears Counterpane's investors took a big loss if the company sold for around $40 million. According to the Counterpane series C VC funding press release:
The Goldman Sachs Group, Inc., and Morgan Stanley Dean Witter Private Equity, who all invested further in this round, bringing the total capital raised by Counterpane to $58 million.
Then add $20 million of series D VC funding and the total is $78 million. It looks like the "return on investment" I mentioned earlier was very negative.
Counterpane will run as a standalone operation until April 2007, before being integrated in to BT's Professional Services organisation.
Tuesday, October 24, 2006
Bejtlich Speaking on Tenable Webinar
Monday, October 23, 2006
Bejtlich Speaking on Insider Threat
By insider threat I do not mean flawed services on desktops. I mean parties with the capabilities and intentions to exploit vulnerabilities in assets. I guarantee you will hear me say that the "80%" figure is a myth.
Even though I am appearing with at least one other speaker (Jerry Shenk), this is not a debate. It will be a few people discussing an import subject. I have a few other Webinars in the works and all should be free. Please join us if you have the time and bandwidth.
Update: Here's a press release. I'm glad they included this quote:
"Insiders do not account for the mythical 80% of security incidents, but their privileged access allows them to inflict devastating harm upon organizations. Security tools and tactics designed to combat the traditional external threat will not work as well, or at all, against insiders," commented Mr. Bejtlich.
Right on.
Sunday, October 22, 2006
Pre-Review of Four Books
Remember I am teaching days one and two of TWS through USENIX LISA and days three and four independently at the same hotel, after USENIX LISA. See the information at the bottom of this post for more details. I am not sure if I will read the next two books. Prentice Hall shipped me Security in Computing, 4th Ed By Charles P. Pfleeger and Shari Lawrence Pfleeger. I've never read anything by either author. This book looks like a university text, so I may read it in tandem with Matt Bishop's Computer Security: Art and Science in preparation for academic study. The last book is Addison Wesley's Telecommunications Essentials, 2nd Ed by Lillian Goleniewski. I read and reviewed the first edition, which I liked as a thorough review of the telecom space. This makes me hesitant to devote reading time to this second edition. Amazon.com might let me review it (unlike some other later edition books) because I do not see my old review (or any reviews) listed with this new edition.
Right now I am in the middle of a massive reading push. I have several "free" hours each night between baby feedings, so I am working my way through a pile of books on software security. I haven't read a lot in this area, because I am not a professional programmer. About two years ago I did read, review, and enjoy Building Secure Software by Gary McGraw and John Viega. Thus far, Gary's latest book (Software Security: Building Security In) is my favorite, particularly for its proper use of terms like "threat" and its criticism of those who abuse it (e.g., Microsoft). I'll have far more to say this in the reviews of these books, probably next week.
Thursday, October 19, 2006
Sign Up for Tenable Webinars
The Webinars are not a selling vehicle for Tenable products. Instead, Ron explains one or more aspects of the security scene. If you know Ron you recognize he knows network security better than almost anyone out there. The next Webinar is scheduled for today, and all are free.
Tuesday, October 17, 2006
Bloom's Hierarchy for Digital Security Learning
These descriptions from Purdue are helpful:
- Knowledge entails the ability to recall or state information.
- Comprehension entails the ability to give meaning to information.
- Application entails the ability to use knowledge or principles in new or real-life situations.
- Analysis entails the ability to break down complex information into simpler parts and to understand the relationships among the parts.
- Synthesis entails the act of creating something that did not exist before by integrating information that had been learned at lower levels of the hierarchy.
- Evaluation entails the ability to make judgments based on previous levels of learning to compare a product of some kind against a designated standard.
I find this to be a useful way to evaluate mastery of a given subject.
For example, I propose many people detest technical certifications because they perceive the candidates as simply working at the knowledge level.
I think many people were disappointed by the removal of the SANS practical requirement, because meeting that challenge required work at the synthesis level -- a very high mark indeed.
I keep this hierarchy in mind when I review books. If I am reading material related to network security monitoring, I can absolutely make judgements not only about accuracy but also about relevance and worth. That's an evaluation level activity. On the other hand, books about reverse engineering malicious code might strain my ability to review at the comprehension or even the knowledge level when discussing assembly language.
If you're responsible for hiring people, you might consider using some of these ideas in your interviews. A security architect should demonstrate skills at the synthesis or evaluation levels, while those on the entry level should function at least at the knowledge level.
Thoughts on Gates Security Memo
[E]ven more important than any of these new capabilities is the fact that it is designed from the ground up to deliver Trustworthy Computing. What I mean by this is that customers will always be able to rely on these systems to be available and to secure their information. Trustworthy Computing is computing that is as available, reliable and secure as electricity, water services and telephony.
Today, in the developed world, we do not worry about electricity and water services being available. With telephony, we rely both on its availability and its security for conducting highly confidential business transactions without worrying that information about who we call or what we say will be compromised. Computing falls well short of this, ranging from the individual user who isn't willing to add a new application because it might destabilize their system, to a corporation that moves slowly to embrace e-business because today's platforms don't make the grade. (emphasis added)
Hold the phone (no pun intended). "[A]vailable, reliable and secure as electricity, water services and telephony"? You mean the solid electricity system that blacked out the northeast US in 2003? Or the two water pipes running into New York City that could be disrupted or poisoned? Or the telephone system owned by the Phone Masters in the late 1990s or spied upon by three letter agenices in this decade?
I propose that the main reason that electricity, water, and telephony are (wrongly) considered "secure" is the fewer number of threats facing them. Networked digital resources are exposed to far greater numbers of threats than analog resources like electrical power plants, water treatment facilities, and telephone closets. This is changing as all of these analog resources are being controlled by IP-enabled systems with global reachability.
This makes me wonder if digital security is being held to a higher, possibly impossible, standard. Is there any other system in the world that could be accessed by any threat, at any time? This is not a wise-guy question -- I'd appreciate your thoughts on this. What sorts of man-made systems are relentlessly under attack by intelligent adversaries? I'm adding intelligence here to remove comparisons to diseases, weather, earthquakes, and so on.
The first system that came to mind was the modern casino. People are always trying to cheat, so the threat level is high. A variety of financial systems come to mind, although I'm trying to avoid systems with close ties to digital functionality. Physical security probably has a few useful lessons.
What do you think?
Enterprise Rights Management
Enterprise rights management is technology that allows corporations to continuously control and protect documents, email and other corporate content through the use of encryption and security policies that determine access rights.
I found this case study compelling:
Fenwick & West was an early adopter, choosing ERM software by startup SealedMedia, a company recently acquired by Stellent.
Kesner took advantage of SealedMedia's free 30-day trial, tested it with several clients and was wowed by the results. His law firm's clients use hundreds of data types, including Microsoft Office, Adobe Acrobat, accounting databases, architectural drawings and computer-aided design documents--all of which SealedMedia supports.
In addition to the software's broad support, he was impressed by its ease of use. For the firm's lawyers, clients and outsiders to access protected files, they download a small plug-in to their computers. When they try to open protected files on the extranet, the plug-in checks in with Fenwick & West's servers to make sure they have the right to access the documents. It takes about five minutes to get most users up and running.
We're seeing defenses collapse to the level of data, as described by luminaries like Dan Geer. So-called ERM software helps implement this defensive strategy.
ERM, or what might also be called Digital Rights Management (DRM), is no panacea, however. An intruder sitting on a company desktop can read all the documents that the legitimate user can read, at least when the documents are being displayed to the user. Documents cannot be considered "secure" when they must be rendered to users of vulnerable platforms.
I expect to see systems like ERM widely deployed, although I wonder how well they will be accepted when encryption products tend to stump most users. We don't see ubiquitous deployment of encrypted email or documents, even though the technology has been around for years. Perhaps moving the trust decision out of the hands of non-technical users (as must be the case with technologies like PGP/GPG) will help facilitate deployment?
Monday, October 16, 2006
Extrusion Detection Sightings
Emerging tools known as extrusion-detection systems are helping government agencies and private companies detect whether sensitive information is leaving their organizations...
"Our goal is to monitor traffic from the inside going out," said Daniel Hedrick, product manager at Vericept and a former intelligence officer in the Air Force. "If I see content going out the door, with or without the approval or the knowledge of the user, I will automatically encrypt it." (emphasis added)
Wow, that's something. So once this "content" is "encrypted," what does the intended recipient do with it? I'm hoping this is an example of a writer misreporting Mr. Hedrick's answers to questions.
I mildly dislike seeing terms become hyphenated (e.g., "extrusion-detection") for no reason. I strongly dislike people claiming to invent terms. Consider the following SearchSecurity.com story:
Symantec Corp. says its latest products and partnerships will thwart online outlaws who attempt to raid company databases for sensitive information that can be used for a variety of fraud...
Symantec executives cited the growing number of data breaches and the resulting exposure of confidential information as the motivating factors behind the release of the tool. "It has a feature that I call extrusion detection, which alerts administrators when sensitive data is leaving the network," Steve Trilling, Symantec's vice president of research and advanced development, said in an interview recently. "And it operates on a copy of the network traffic, so it doesn't slow anything down." (emphasis added)
Now I know who coined the phrase extrusion detection... not. As I wrote three years ago, Robert Mozkowitz and Franke Knobbe have the best claims, dating back to November 1999.
Finally, this morning I stepped one toe into the audiobook world by recording an excerpt of my latest book Extrusion Detection within a joint Addison-Wesley and SearchSecurity.com (free) project. I don't know why people pirate my books when more and more parts are appearing online in one form or another!
When this recording (about 10 minutes) is available, I'll post a notice here. If you find the idea interesting, please let me know.
Thanks also for the many kind comments about the birth of my daughter. My family (including me, obviously!) appreciates it greatly. I also like seeing the sites that blindly repost my content (without attribution) reporting the addition to my family. :)
Wednesday, October 11, 2006
More Reasons to Discuss Threats
I noticed the OWASP is trying to define various security terms as well. (Because OWASP means Open Web Application Security Project, I didn't say "OWASP project." Those who say "ATM machine," "NIC card," and "CAC card," please take note.) OWASP has Wiki pages for attack, vulnerability, countermeasure, and, yes, threat.
For an example of a project that is largely not falling for the threat hype, check out the Vulnerability Type Distributions in CVE published last week. It provides research results on publicly reported vulnerabilities.
It might be helpful to look at already published work when thinking about what these terms mean. Good sources include the following.
- Use of A Taxonomy of Security Faults
- Common Vulnerabilities and Exposures (CVE) Terminology
- Cliff Berg's collection
- Fred Cohen's A Preliminary Classification Scheme for Information System Threats, Attacks, and Defenses; A Cause and Effect Model; and Some Analysis Based on That Model
- The Common Weakness Enumeration (CWE) project Classification Tree
The CWE Classification Tree contains a section labelled "Motivation/Intent," with an "Intentional" subsection containing items like "Trojan Horse," "Trapdoor," "Logic/Time Bomb," and "Spyware." Note these are not intended to be considered weaknesses, in the sense of a calling a "Trojan Horse" a "weakness." Rather, it seems the CWE considers the inclusion of such code to be a weakness in and of itself. This might be similar to an "Easter Egg."
While you're busy thinking of these security issues, you might want to download the latest release of Helix. I used it to try a recent version of Brian Carrier's Sleuthkit. I launched the Helix Live CD .iso within VMware, then used NFS on another system to export a dd image from Real Digital Forensics for browsing within Autopsy. I am sad to see the Sguil client is not in Helix anymore, though.
Tuesday, October 10, 2006
Pre-Review: Programming Python, 3rd Ed
I'll use O'Reilly's Programming Python, 3rd Ed and Python Cookbook, 2nd Ed as references. Two years ago I tried reading Learning Python, 2nd Ed but found it not that helpful as an introduction -- hence my interest in the new Apress titles.
Monday, October 09, 2006
Reviews of Digital Forensics Books Posted
Amazon.com just posted three new reviews on digital forensics books. The first is File System Forensics Analysis by Brian Carrier. Here is a link to the five star review.
The second is Windows Forensics by Chad Steel. Here is a link to the four star review.
The third is EnCase Computer Forensics by Steve Bunting and William Wei. Here is a link to the three star review.
All three books share the same introduction.
I decided to read and review three digital forensics books in order to gauge their strengths and weaknesses: "File System Forensic Analysis" (FSFA) by Brian Carrier, "Windows Forensics" (WF) by Chad Steel, and "EnCase Computer Forensics" (ECF) by Steve Bunting and William Wei. All three books contain the word "forensics" in the title, but they are very different. If you want authoritative and deeply technical guidance on understanding file systems, read FSFA. If you want to focus on understanding Windows from an investigator's standpoint, read WA. If you want to know more about EnCase (and are willing to tolerate or ignore information about forensics itself), read ECF.
In the spirit of full disclosure I should mention I am co-author of a forensics book ("Real Digital Forensics") and Brian Carrier cites my book "The Tao of Network Security Monitoring" on p 10. I tried to not let those facts sway my reviews.
Sunday, October 08, 2006
Government Contracting Lists from FCW
Saturday, October 07, 2006
Security Is Not Refrigeration
Consider the refrigerated train car at left. Refrigeration is definitely a "business enabler." Without refrigeration, food producers on the west coast couldn't sell their goods to consumers on the east coast. Refrigeration opened new markets and keeps them open.
However, refrigeration is not the business. Refrigeration is a means to an end -- namely selling food to hungry people. Refrigeration does not generate value; growing and selling food does. (Refrigeration is only the business for those that sell refrigerated train cars and supporting devices.)
You might think "security" is like refrigeration. Like refrigeration, security could be said to "enable" business. Like refrigeration, security does not generate value; selling a product or service through a "secure" channel does.
So why is "security" really not refrigeration? The enemy of refrigeration is heat. Heat is an aspect of nature. Heat is not intelligent. Heat does not adapt to overcome the refrigeration technology deployed against it. Heat does not choose its targets. One cannot deter or jail or kill heat.
The enemy of "security" is the intruder. The intruder is a threat, meaning a party with the capabilities and intentions to exploit a vulnerability in an asset. Threats are intelligent, they adapt, they persist, they choose, and they react to their environment. In fact, an environment which on Monday seems perfectly "secure" can be absolutely compromised on Wednesday by the release of an exploit in response to Tuesday's Microsoft vulnerability announcements.
Returning to the idea of "enablement" -- honestly, who cares? I'll name some other functions that enable business -- lawyers, human resources, facility staff. The bottom line is that "virtual trust" is an attempt to "align" (great CISO term) security with "business objectives," just as IT is trying to "align" with business objectives. The reason "IT alignment" has a chance to succeed in creating real business value is that IT is becoming, in itself, a vendor of goods and services. Unless a business is actually selling security -- like a MSSP -- security does not generate value.
Why is anyone even bothering to debate this? The answer is money. If your work is viewed as a "cost center," the ultimate goal is to remove your budget and fire you. If you're seen as an "enabler," you're at least seen as being relevant. If you can spin "enablement" into "revenue generation," that's even better! Spend $X on security and get $Y in return on investment! Unfortunately that is not possible.
Finally, I don't think anyone would consider me "anti-security." I'm not arguing that security is irrelevant. In fact, without security a business can be absolutely destroyed. However, you won't find me saying that security makes anyone money. Some argue that spending money on security prevents greater loss down the line, perhaps by containing an intrusion before it avalanches into an immense compromise. That's still loss prevention. Of course security "enables" business, but enablement doesn't generate revenue; it supports a revenue-generating product or service.
This is probably my last word on this in a while. I need to turn back to my own business!
Thoughts from IATF Meeting
Prior to seeing this diagram I had heard a lot about "net-centric warfare" but I had no real grasp of the underlying. It seemed more of a buzzword. Now I understand the idea of getting information from any source to the people who need it, instead of, say Air Force sensors sending data to Air Force decision-makers who feed Air Force assets.
Given the net-centric model, DoD needs to move away from a "System High" model of security to a "Transactional" model. In the System High world, you essentially define a perimeter by classification (e.g., "Secret"), build a network for that classification (e.g., SIPRNET), and let anyone with a Secret clearance see anything on SIPRNET. This is procedure-based security at its best (actually, it's worst).
This figure shows how DoD wants to transition from the existing model to the new model. It's moving away from the current "baseline" in "increments," starting with Increment 1. Completion of Increment 1 is expected with the conclusion of the next five-year DoD plan, lasting 2008-2013 (!).
DoD's experience with coalition warfare in Iraq and Afghanistan is driving these changes. One example involved the need to establish a separate network for every coalition partner. In one so-called "coalition village," DoD had to build 14 separate networks (US-UK, US-Poland, US-Italy, etc.). This is obviously costly and time-consuming. In the new model, these coalition partners will share one network but have access regulated by the transactional security model. Virtualization and Digital Rights Management are going to be key for implementing these ideas.
This figure explains the layers present in the Enterprise Sensor Grid, and the idea that DoD is moving away from a strictly perimeter-based monitoring model to one that reaches all the way to end hosts.
One of the briefers offered a set of metrics that I found interesting.
- % of Red Team simulated attacks that are successful
- % of remote access to DoD information systems and DoD access to the Internet regulated by positive technical controls such as proxy services and screened subnets
- % of DoD systems and applications that conform to the DoD Ports, Protocols, and Service Policy
- % of standardized and approved IA and IA enabled COTS products available to protect DoD sensitive and classified data (vs. GOTS)
- % of NIPRNet Traffic that is encrypted
I found the first metric to be especially interesting because the DoD uses it to measure the number of attacks they are missing. In other words, DoD (wisely) understands that it doesn't detect all attacks. They use Red Team exercises to estimate the number of attacks they don't detect. This is exactly the sort of metric I believe to be useful. DoD also measures (and wants to vastly decrease) the amount of time needed to detect and respond to intrusions. Again, they base their metrics on Red Team exercises.
I left the conference with a few concerns. First, I heard an emphasis on "pushing systems to DMZs." The idea is to remove systems accessible to the public or coalition partners out of internal networks and into DMZs. While I agree that security zones are important, I wondering if DoD is fighting the last war again. Server-side attacks were the predominant model of the 1990s, bleeding somewhat into this decade. For the last three or four years, however, client-side attacks have been all the rage. DoD is moving to persistent and then pervasive monitoring (which includes end hosts), but I hope they don't ignore client-side vulnerabilities. On the other hand, the rise of Web Services might reinvigorate DMZ-focused security.
After hearing one briefer joke about not understanding so-called "honey" technologies (honeypots, etc.) I worried that some of these decision-makers don't understand the attacks facing DoD networks. They of course understand the threat, because those groups change but not as quickly as the tools and techniques they employ. Keeping up with the vulnerabilities and ways to exploit them is extremely challenging, and does not map at all to five-year plans.
A second problem involves the so-called "black core." This is an encrypted network which will eventually dominant the DoD enterprise security model. This is similar to Microsoft's reported internal use of IPSec everywhere.
The black core emphasizes confidentiality, and to a certain degree integrity. It seems to sacrifice visibility. An IATF attendee made this point in a question. If just about everything is encrypted, what's the point of network-based monitoring? One of the speakers replied that flow-based monitoring (i.e., analyzing session data) will still be helpful, but sessions only take you so far. I wonder if DoD might implement some "visibility taps" that decrypt-inspect-encrypt at various points in the black core?
Speaking of encryption, crypto appeared to be a major factor in DoD plans. This isn't surprising, given the IATF's sponsor. Still, most security incidents don't happen because of failed crypto. Intrusions are often the result of improper configuration and operation. I didn't hear much about addressing those problems, yet I heard that DoD is cutting IA personnel and funding!
Third, IPv6 wasn't formally mentioned in any of the presentations. An attendee had to ask about it specifically. An audience member from the Office of the Secretary of Defense said IPv6 would work with DoD's plans, but I think the audience was skeptical.
Finally, DoD is relying heavily on vendors to build the equipment and technology needed to implement its vision. Ideas of "protecting data in transit" (PDIT) and "protecting data at rest" (PDAR) are great concepts, but implementation questions remain. DoD also seemed not interested in data stored outside of its own systems. An attendee questioned how DoD is going to handle that concern, but it appears to have been largely ignored. This is a growing issue as we approach the end of this decade, and I predict it will be a major issue in the next decade.
Incidentally, while driving to the IATF meeting I listened to a story on NPR about Boeing's plans for border security. One of the engineers in the story talked about the false positive problems caused by tumbleweed! Maybe I should consider investigating cross-discipline intrusion detection problems (i.e., digital, financial, homeland security, and so on)?
Thursday, October 05, 2006
Review of Web Application Security Books Posted
The second is Professional Pen Testing for Web Applications by Andres Andreu. Here is a link to the four star review.
Both reviews share the same introduction.
I recently received copies of Hacking Exposed: Web Applications, 2nd Ed (HE:WA2E) by Joel Scambray, Mike Shema, and Caleb Sima, and Professional Pen Testing for Web Applications (PPTFWA) by Andres Andreu. I read HE:WA2E first, then PPTFWA. Both are excellent books, but I expect potential readers want to know which is best for them. I could honestly recommend readers buy either (or both) books. Most people should start by reading HE:WA2E, and then fill in gaps by reading PPTFWA.
Update: A torrrent for the Web App Honeypot is here. You can download the VMware image directly from Wrox here. The root password is Pa55w0rd.
Wednesday, October 04, 2006
Notes on Net Optics Think Tank
The first half of the event consisted of two briefings. The first discussed tap technology. This was supposed to be a basic introduction but I learned quite a bit, especially with regards to fiber optics. Specifically, I learned of some cases where customers reverse cables when plugging in their taps, thereby causing lots of tough-to-troubleshoot problems. Furthermore, as customers move from Gigabit over fiber to 10 Gigabit over fiber, they are encountering cabling issues. Gigabit is much more forgiving than 10 Gig. At 10 Gig, you apparently have to pay close attention to the specifications, such as core size.
I learned that Net Optics is considering ways to "tag" or "label" packets collected by their link aggregator taps. When discussing matrix switches, it occurred to me that those devices are a great way to implement on-demand monitoring while keeping true to the tenets of Visiblel Ops. Rather than monkeying around with a switch SPAN port, risking making a problematic change, you tell the matrix switch which port you want to monitor. The switch is never touched.
The same idea applies to bypass switches. Net Optics (and their customers) basically convinced me that it's a bad idea to ship an appliance with a bypass switch embedded as a NIC in a security appliance. It's far better (if you have the rack space) to have a separate bypass switch. This allows you to completely power down and remove the "inline" security appliance with no effect on the network. This isn't possible with an integrated bypass NIC. The second briefing covered the Net Optics iTap product line, which I covered several months ago. Dennis Carpio (pictured at left) gave that briefing. Basically Net Optics is moving this "intelligent Tap" functionality into all of their products. I told them I would like to see the tap inspect and classify the traffic it sees, namely by doing port independent protocol identification. I would also like to see the iTaps support 802.1X, IPv6, SNMPv3, and a HTTPS Web interface.
The iTap might also support filtering at the monitoring ports. This would reduce the load of a sensor on the tap. For example, you could tell the iTap not to pass ARP or non-IP traffic to the sensor. Besides continuing to add features to taps without adding cost, Net Optics is also reducing their size. They will be able to fit six taps into 1U. They're also moving to replacing fixed ports with SFPs.
During the second half of the day Net Optics shared ideas for future products. I'll keep this to myself, since this was not exactly meant for broadcast on the Internet. Basically, if you have a network traffic access requirement you're trying to meet, get in contact with me. I can put you in touch with the right people at Net Optics and they will be able to meet your demands. I am not getting any kind of referral fee -- I just trust the people at this company to do the right thing.
Expect to see more reporting on their gear as I get demo products to test.
Tell Intel What You Think
As a FreeBSD user, I recognize that drivers for Linux are not going to help me use my wireless cards. This Slashdot comment explains key points as well.
If you want to use Intel NICs with native drivers, send an email like the one Kenneth sent (but not a duplicate -- explain the situation in your own words). I just did.
Thoughts on Virtual Trust
First, I agree with others who say "virtual trust" should not be "virtual" -- it's either "trust" or it's not. That's not a major point though.
Second, the thesis for the paper appears to be the following, as shown in the abstract.
Business is concerned with the creation of new entities and assets that generate cash. Information security, by contrast, is traditionally concerned with protecting these entities and assets. In this paper we examine a perspective which currently exists but is largely dormant in the information security field. We maintain that information security can be actively involved in the creation of business and that the skills required to create commercial activity must be added to the information security professional's intellectual tool set. We also present evidence to demonstrate that the capability of security to create business, which we designate by the term "virtual trust", may become a dominant paradigm for how to think about information security.
The authors provide this example:
Apple' iTunes employed Digital Rights Management (DRM) technologies to create a new product and, hence, a new revenue stream. Over 1 billion songs have been downloaded from iTunes. In the case of iTunes, DRM works by restricting the number of CPUs on which the .mp3 will play. The songs are also stored in a proprietary, encrypted format. These two factors, at minimum, erect a prohibitive barrier and thereby reduce the likelihood that an end user will trade songs. The various security mechanisms used by Apple's iTunes DRM created the Virtual Trust necessary to persuade the music industry that their rights will be protected digitally and be profitable.
I see nothing wrong with this statement. However, security is not making money in this example -- iTunes sales are making money. Imagine a world without DRM. Someone buys a song, then gives it to their friends. Apple and the music companies believe those extra copies are lost sales. What have we returned to? That's right -- a loss prevention model.
"Virtual Trust" is just another name for the Road House security model. Security is not making money for anyone in the bar Patrick Swayze patrols. Alcohol and food sales are making money.
Security may be a necessary condition for sales and a thousand other activities, but it doesn't make any money. Imagine this exchange between executives:
SecGuy: "Hey boss, I have a great idea for enabling business through virtual trust."
Boss: "What is it?"
SecGuy: "I'm going to secure a business initiative that will make millions!"
Boss: "What is the initiative?"
SecGuy: "Hmm, I don't know. But whatever it is I will secure it and enable business through virtual trust!"
Boss: "Sigh."
You can watch one of the authors of this paper post his thoughts on his blog.
Visit to Symantec Security Ops Center
On this trip I learned that Symantec operates two 24x7x365 SOCs (in the USA and the UK), along with one in Europe, one in Japan, and other support centers. They do not collect and store security data at the SOC; instead, they have they data pouring into colocation facilities elsewhere.
Jonah said they see 3000-4000 "potential" incidents per day, of which about 100 are considered "hard kills." I couldn't tell if that meant actual compromise or not, but those 100 events per day prompt calls to customers.
We discussed the nature of their customer base. Symantec provides managed security services to many global 500 companies, some "with security staffs larger than Symantec's." I asked why such a company would bother with MSSP? Jonah responded with these points:
- It's expensive to hire a team of analysts to inspect and react to security events on a 24x7x265 basis. My own experience says that requires hiring 12 people if you want 2 people on shift.
- Analysts watching a single company -- even a very large one -- get bored fast. This is true. If your company cares enough to staff a security operation like this, they are probably not bleeding like a .edu. (Ever notice the best papers come from .edu's and not finance.com's?)
- Symantec's global perspective, combined with local data, gives customers a sense of what is happening on the Internet and their networks. In other words, customers hire Symantec to provide a data feed that those large security staffs can interpret and work. Customers see "everything" that Symantec's analysts see. This is a change from the environment five years ago.
Jonah noted that Symantec undergoes a Statement on Auditing Standards (SAS) No. 70 Type II audit every year. The process takes 2 months out of 12 (ouch). The end result, however, is a document that shows all of the processes Symantec follows, along with a measurement of Symantec's adherence to those processes. This is very valuable for customers, who previously would require Symantec to undergo on-demand audits prior to signing up for MSS. Now, Symantec hands them the SAS 70 Type II audit report and the customer is SOX-satisfied. Symantec also follows ISO 27001 standards.
Overall, I was impressed by what I saw. I was a little concerned by the emphasis on process over outcomes, however. While it's good to be audited for adherence to processes, it would be better to determine if those processes result in improved incident detection and response. I doubt the auditors attack Symantec clients to test the responsiveness of the analyst staff.
This thought came to mind during the visit, and also later when one of my customers called. They're planning to bring their monitoring services back in-house, as they fear their vendor is too malware-focused. This customer wants me to help them build an in-house network security monitoring, incident response, and forensics operation, to be completed by the end of next year. That should be a great project.
I'm considering the value of something like Symantec Early Warning Services for my customers who run their own MSS SOCs. An early warning service can provide indicators that might be absent in an operation focused on a single company.
Thank you to Jonah and the other folks from Symantec and their partners who answered my questions and let us tour their facility.
Chapter 3 from Extrusion Online
This book has been getting some attention because it starts with the premise that your internal network is compromised. Given that assumption, how do you detect, contain, and eradicate intruders on your network? The model applies well to insider and outsider threats.
I consider Extrusion to be a companion volume to Tao, and as such I recommend reading Tao first and then Extrusion. Real Digital Forensics is a book where network security monitoring, network incident response, and network forensics are intergrated with host- and memory-centric security operations.
Bejtlich in Australia in May 2007
I accepted the invitation, and I will probably deliver a short presentation and a longer (half-day or day-long) tutorial. After AusCERT, I plan to teach one or two-day classes in Brisbane and/or Sydney. I will probably teach condensed versions of my training classes Network Security Operations and TCP/IP Weapons School.
As I develop the plans for all of these classes I will post details here and at TaoSecurity.com. If you would like me to keep you informed via email please write me: training [at] taosecurity [dot] com. Thank you.
Chapter 18 from Tao Online
Keep an eye on SearchSecurityChannel.com. I am working with the editor on a plan to contribute regular content for the site.
Recovering from Bad FreeBSD Packages
Yesterday I ran into the following error after I upgraded my packages.
orr:/home/richard$ firefox
/libexec/ld-elf.so.1: /usr/local/lib/libplds4.so.1:
Undefined symbol "gethostbyname_r"
orr:/home/richard$ thunderbird
/libexec/ld-elf.so.1: /usr/local/lib/libplds4.so.1:
Undefined symbol "gethostbyname_r"
Uh oh. Email I can live without, but it's difficult to troubleshoot a problem without a Web browser. I had to turn to another laptop running Windows (for shame) to search for clues. I found one post on a Chinese Website with the same errors, but nothing else.
I found the pkg-plist for the linux-firefox and linux-thunderbird ports contained this entry:
so it appeared the problem was one in the package for Firefox and Thunderbird.
I don't run either app on other computers, so I decided to try recovering by building new packages myself. I built them on another system, poweredge.
poweredge:/usr/ports/www/firefox# make package-recursive BATCH=1
I used "BATCH=1" to accept the defaults, thereby avoiding problems where the build process stops while waiting for me to select various options. I used package-recursive so the end result would include all packages needed for Firefox, in the event I needed to do a wholesale replacement of packages on my primary system.
When done I compared the libraries on the broken and package building systems.
orr:/home/richard$ ls -al /usr/local/lib/libpld*
-rw-r--r-- 1 root wheel 8960 Sep 24 02:59 /usr/local/lib/libplds4.a
lrwxr-xr-x 1 root wheel 13 Sep 24 02:59 /usr/local/lib/libplds4.so
-> libplds4.so.1
-rwxr-xr-x 1 root wheel 184784 Sep 24 02:59 /usr/local/lib/libplds4.so.1
poweredge:/home/richard$ ls -al /usr/local/lib/libpld*
-rw-r--r-- 1 root wheel 8960 Oct 3 17:32 /usr/local/lib/libplds4.a
lrwxr-xr-x 1 root wheel 13 Oct 3 17:32 /usr/local/lib/libplds4.so
-> libplds4.so.1
-rwxr-xr-x 1 root wheel 185062 Oct 3 17:32 /usr/local/lib/libplds4.so.1
The sizes are certainly different -- no need to hash them. I then copied over the 185062 file from poweredge and moved the 184784 version on orr out of the way. Sure enough, I was able to start Firefox and Thunderbird without any problems with the new libplds4.so.1 in place.
Tuesday, October 03, 2006
FreeBSD Update with IPv6
Maybe FreeBSD Update is hosted on an IPv6 dual-stack system?
p200:/root# freebsd-update fetch
Fetching updates signature...
fetch: http://update.daemonology.net/i386/6.1/updates.sig: Network is unreachable
Shoot. Well, I can reach a host (we'll call it "dualstack") that has both IPv4 and IPv6 addresses. dualstack can also reach my Squid proxy on the IPv4 network. I'll use SSH to port forward traffic needed by FreeBSD Update.
p200:/home/richard$ ssh -p 22022 -L 3128:squidproxy:3128 user@dualstack
In a new window I'll set the appropriate proxy environment variable.
p200:/root# setenv HTTP_PROXY http://localhost:3128
Now I run FreeBSD Update.
p200:/root# freebsd-update fetch
Fetching updates signature...
Fetching updates...
Fetching hash list signature...
Fetching hash list...
Examining local system...
Fetching updates...
It works very well. SSH port forwarding is only one solution to this problem, but it worked well enough here.
Essential FreeBSD Ports
- security/freebsd-update: described here as a tool to update a GENERIC kernel and userland, destined to move into FreeBSD 6.2
- sysutils/portupgrade: described here as a tool to keep ports/packages up-to-date
- security/portaudit: described here as a tool to find ports/packages with security vulnerabilities
- sysutils/pkg_cutleaves: described here as a tool to remove packages and their dependencies
- shells/bash: this is a legacy of my time using Linux, where Bash is the default shell
You can read a summary of many of these tools here as well.
Installing Screen Port with Remote FreeBSD Ports Tree
The major problem with this plan involves the sysutils/screen port. No package is created, and you can't build one yourself.
poweredge:/usr/ports/sysutils/screen# make package
===> screen-4.0.2_4 may not be packaged: Tends to loop using 100% CPU when used from
package - perhaps it hard-codes information about the build host.
Is there a way to build Screen without installing the ports tree?
First I tried just NFS mounting /usr/ports and trying to build the port. Here, poweredge is th box with the ports tree and mwmicro needs to run screen.
mwmicro:/root# mount
/dev/ad0s1a on / (ufs, local)
devfs on /dev (devfs, local)
/dev/ad0s1f on /home (ufs, local, soft-updates)
/dev/ad0s1g on /tmp (ufs, local, soft-updates)
/dev/ad0s1d on /usr (ufs, local, soft-updates)
/dev/ad0s1e on /var (ufs, local, soft-updates)
10.1.13.2:/usr/ports on /usr/ports (nfs)
Note that poweredge already installed Screen using the ports tree.
mwmicro:/usr/ports/sysutils/screen# make
mwmicro:/usr/ports/sysutils/screen# make install
mwmicro:/usr/ports/sysutils/screen# which screen
screen: Command not found.
That didn't work. Why? It's because poweredge, the box exporting the ports tree, already installed Screen. There's a "work" directory already built. I can't issue a "make clean" command here.
mwmicro:/usr/ports/sysutils/screen# make clean
===> Cleaning for screen-4.0.2_4
===> /usr/ports/sysutils/screen/work not writable, skipping
Ok, maybe I can issue "make clean" on poweredge and continue?
poweredge:/usr/ports/sysutils/screen# make clean
===> Cleaning for screen-4.0.2_4
Now back to mwmicro:
mwmicro:/usr/ports/sysutils/screen# make
===> Vulnerability check disabled, database not found
===> Extracting for screen-4.0.2_4
=> MD5 Checksum OK for screen-4.0.2.tar.gz.
=> SHA256 Checksum OK for screen-4.0.2.tar.gz.
mkdir: /usr/ports/sysutils/screen/work: Permission denied
*** Error code 1
Stop in /usr/ports/sysutils/screen.
Oh, that's right. /usr/ports is mounting read-only. I probably don't want to overwrite the ports tree anyway by exporting it read-write. Luckily I read FreeBSD Handbook after fzzzt in #freebsd suggested changing the work directory. I found the directive to change the location of the work directory and used it thus:
mwmicro:/usr/ports/sysutils/screen# make WRKDIRPREFIX=/tmp
===> Vulnerability check disabled, database not found
===> Extracting for screen-4.0.2_4
=> MD5 Checksum OK for screen-4.0.2.tar.gz.
=> SHA256 Checksum OK for screen-4.0.2.tar.gz.
===> Patching for screen-4.0.2_4
===> Applying FreeBSD patches for screen-4.0.2_4
===> Configuring for screen-4.0.2_4
configure: WARNING: you should use --build, --host, --target
this is screen version 4.0.2
checking for i386-portbld-freebsd6.1-gcc... cc
checking for C compiler default output... a.out
mwmicro:/usr/ports/sysutils/screen# make install WRKDIRPREFIX=/tmp
===> Installing for screen-4.0.2_4
===> Generating temporary packing list
mwmicro:/usr/ports/sysutils/screen# rehash
mwmicro:/usr/ports/sysutils/screen# which screen
Note that I used WRKDIRPREFIX=/tmp for both make and make install. Using that directive automatically made appropriate directories in /tmp:
mwmicro:/tmp/usr/ports/sysutils/screen/work# ls
.PLIST.flattened .configure_done.screen._usr_local
.PLIST.mktmp .extract_done.screen._usr_local
.PLIST.objdump .install_done.screen._usr_local
.PLIST.setuid .patch_done.screen._usr_local
.PLIST.writable screen-4.0.2
I plan to use this system whenever I need to build an application using the ports tree and cannot make a package to share on other systems.
Update: If you try to build from a remote ports tree but the distfile for the desired port hasn't been downloaded, use 'make fetch' on the NFS server:
poweredge:/usr/ports/sysutils/screen# make fetch
=> screen-4.0.3.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
=> Attempting to fetch from ftp://ftp.uni-erlangen.de/pub/utilities/screen/.
fetch: ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz:
Service not available, closing control connection
=> Attempting to fetch from http://komquats.com/distfiles/.
screen-4.0.3.tar.gz 100% of 820 kB 52 kBps 00m00s
The continue with the steps shown above.


text:
The Appalachian Trail is the longest hiking-only footpath in the world, ranging from Maine to Georgia. Use the interactive map below to explore the Trail, find shelters, locate parking and more.
You can explore hundreds of locations along the trail including vistas, trailhead parking, overnight shelters,
A.T. Communities, and Trail Clubs!
The Appalachian Trail (A.T.) interactive map, built cooperatively by the Appalachian Trail Conservancy (ATC) and National Park Service using ESRI's Arc GIS Online mapping technology. While useful, this map is for general reference purposes only and not intended to replace the more comprehensive and accurate A.T. printed hiking maps, available from the Ultimate Appalachian Trail Store.
Our GIS data sets were developed to provide a digital depiction of the Appalachian National Scenic Trail centerline and several of its trail features in an usable and easily transferable format to assist the A.T. staff, agency partners, and trail-maintaining clubs with land-management duties; to aid local planning agencies, telecommunications companies, and other groups with planning activities, such as siting telecommunication towers or other new developments that could have a substantial impact on the Appalachian Trail; and for scientific and educational use by universities and other groups.

subset: commoncrawl


text:
Random House Group in the U.K. has formed Random House Enterprises, a new unit devoted to extending its content and trademarks, for both children and adults, into consumer products and content platforms including television, live events, and gaming.
The company is bringing on Jo Edwards from Discovery Communications to oversee the new venture as head of licensing, reporting to group commercial director Nigel Waters. At Discovery, she developed the company's international consumer products and live shows and exhibitions businesses.
"There are tremendous opportunities to develop our authors and their IP in new markets," says Waters, "and to unlock these we decided to bring in an expert and to create this unit, which can be a center of excellence for the wider group to plug into, as well as delivering its own projects." The team will represent projects coming out of Random House Children's Screen Entertainment, the company's kids' TV joint venture, and associated licensing opportunities.
The announcement follows Penguin Group's June launch of Penguin Licensing and Consumer Products to handle its licensing and merchandising business across its offices in the U.K., U.S., and Australia.
On the U.S. side of the pond, Random House launched Random House Television last month in partnership with FremantleMedia. It has had a movie business, Random House Films, since 2005, and a team in place to extend its properties into videogames since 2010.


text:
40 mm
District_LX2 Watch
€160.00 €80.00
€160.00 €80.00
Product Actions
Notify me
District_LX2 , 40 mm
Black / Multi
Notify me
Want to be the first to know? Enter your email address below to be notified as soon as it's released
Roger that! We'll notify you as soon as additional inventory arrives. Note: because products are seasonal, some products may come back in-stock but others may not. Your interest will help us determine what to fulfill.
There was a problem adding you to the notification list. Please try again.
Reflecting on past iconic designs, the DISTRICT_LX2 pays homage to a time before while adapting towards the new enduring style of what will come next. Consider this approach past meets present in timeless proper form where less is, in fact, always more.
- Watch Movement JAPANESE QUARTZ MOVEMENT
- Watch Band Premium Horween Leather Strap, 20mm Width
- Watch Dial THE DIAL FEATURES APPLIED ADIDAS LOGO AND HOUR MARKERS, A PRINTED MINUTE TRACK, A SMALL SUBDIAL FOR SECONDS, CUSTOM MOLDED HANDS AND DATE WINDOW AT THREE O'CLOCK
- Watch Case STAINLESS STEEL, WITH HARDENED MINERAL CRYSTAL
- Water Rating 50 METER / 5 ATM


text:
Starbucks is cooling off ... for now.
The Seattle-based coffee chain trimmed its earnings forecast by about 2 cents a share Tuesday, but there's no need to panic. It's not like Starbucks is going to report a loss.
Last year's high coffee prices, Europe's nagging debt problems and the company's baking plans will cut into Starbucks' bottom line this year, said chief financial officer Troy Alstead, at the annual stock conference of brokerage firm William Blair.
"We have suffered from extreme commodity cost pressure," said Alstead. Coffee prices surged about 35% during the first five months of 2011, when prices were largely being locked in for the current fiscal year. And that's led to "$200 million or more of incremental commodity cost headwinds year over year," said Alstead.
"Despite that pressure, we've been able to continually grow earnings," Alstead said.
Starbucks (SBUX) expects earnings per share of $1.80-$1.82 for fiscal year 2012. That's down from its prior forecast in April of $1.81 to $1.84 a share. April was also when Starbucks' stock hit an all-time high above $60.
Last week, Starbucks announced plans to buy San Francisco-based Bay Bread and its La Boulange bakery brand for $100 million, as it moves to expand beyond coffee.
Related: Starbucks: 'We are bakers too'
Starbucks has also teamed up with Green Mountain Coffee Roasters (GMCR) to market Starbucks-branded K-Cups. And Starbucks has its own plans to start selling its own single-serve machine, dubbed the Verismo, later this year.
Green Mountain's stock has taken a hit as competitors nip at its heels.
But rival Dunkin' Donuts owner Dunkin' Brands (DNKN) hit a 52-week high on Monday.
Looking ahead, Starbucks expects fiscal 2013 to be much brighter. With coffee prices down some 30% from January, that's certainly going to help ease some of the pricing pressure.
"It is clear that we have a tailwind coming in fiscal 2013 since we've locked in most of our coffee prices for 2013," said Alstead.
But you can never tell what will hit the coffee producing areas of the world. Bad weather and political strife can quickly cut into crops in Brazil, Colombia, Vietnam and Indonesia, which are among the top 10 coffee producers.
And as other coffee makers vie to knock Starbucks off its perch, the battle could take a toll on Starbucks' profits.
Starbucks is getting into the bread business.
The Seattle-based coffee chain announced plans Monday to buy San Francisco-based Bay Bread and its La Boulange bakery brand for $100 million.
"This is an investment in our core business," said Howard Schultz, Starbucks chief executive, in a conference call with financial analysts. "After more than 40 years, we will be able to say that we are MOREBen Rooney - Jun 4, 2012 5:21 PM ET
Not a member yet?Sign up now for a free account


text:
Vimbai (from Zimbabwe) Deliverance from Spirit Husband
Jan 19th, 2018 by exorcist
Video can be seen at https://vimeo.com/252566891.
Evangelist King, A Female Exorcist
Deliverance Pastor at House Shalom
1. Have you ever been molested?
2. Have you ever been physically raped?
3. Have you ever been raped in your dreams?
4. Do you have sexual lust?
5. Have you had premarital sex?
6. Do you have sex in your dreams?
7. Does it seem like you're being "forced" to remain unmarried and every relationship ends up in disappointment?
8. Do you masturbate?
9. Do you watch pornography?
10. Is there idolatry and/or witchcraft in your family lineage?
IF you answered "Yes" to any of the questions and is a born-again Believer in Christ Jesus and NEVER been delivered from demons living in your mind, will, emotions and body; it means demons are still residing in God's House (your body). Contact me for a video deliverance session and the LORD Jesus Christ through His Holy Spirit will set you TOTALLY free. You just come expecting, believing and receive by faith in the Son of God. Email me at email@example.com and I'll schedule a date and time with you for the session. Remember, this is a video only session. ALL SESSIONS ARE PUBLIC, RECORDED AND SHARED ON ALL OUR PROGRAMS. Shalom †


text:
Ukrainian Village
Chicago's other districts
Latest News
There's something about Mary An elegant newcomer to the low-ABV trend, Mary is a low alcohol, low calorie botanical blend "with a lighter touch on your body, mind and the world".
The true story of the Singapore Sling, Fear and Loathing's most iconic guest star The Singapore Sling is the perfect summer delight. One of Hunter S. Thompson's favorite drinks, this refreshingly fruity concoction is most memorably featured in his famous novel and its cult movie adaptation, Fear and Loathing in Las Vegas. Deceptively sweet, the Singapore Sling actually packs a mighty punch, so we recommend you skip the "mescal on the side" à la Raoul Duke - unless you too like to live dangerously, that is.
Straight from the garden: 5 botanical cocktails you need to try We love to use them for cooking and to infuse them into teas. You've probably got plenty of these plants growing in your backyard or on your kitchen window sill. How about using them to up your cocktail game? Embrace your inner herbalist and try your hand at these botanical drinks for your next cocktail party - we promise you won't be disappointed!
3 simple and refreshing whiskey cocktails that are perfect for the end of summer Who said whiskey was reserved for cold weather? Mixed using the right ingredients and techniques, it can be just as thirst-quenching as its clear spirit counterparts - without sacrificing any of its unique aroma and flavors.


text:
Learn More about us
McGuire's regional network of real estate professionals provides local expertise and insight into more than 500 San Francisco Bay Area neighborhoods and communities – from market trends, to schools, and lifestyles.
McGuire is in an unrivaled position to connect our agents, properties, and clients to a worldwide marketplace, as the exclusive Bay Area international associate of Savills PLC, and a broker member of Luxury Portfolio International® and Leading Real Estate Companies of the World®.
View International Listings
McGuire's Mobile App provided by MyTheo connects you with your agent on the go. Access Multiple MLSs, find upcoming open houses, create a saved search, add property notes, and chat with your agent in the app. Contact your agent today to get set up.
The Weekly Top 10 Properties » 07.24.20
The Weekly Top 10 Properties » 07.16.20
The Weekly Top 10 Properties » 07.09.20
Don't have an account? Create one now.


text:
So Could They Actually Fire Bobby V?
On May 23, 1993, the Cincinnati Reds stunned the baseball world. Just 44 games into a season in which they were only four below .500, they fired first-year manager Tony Perez and replaced him with Davey Johnson.
I'm not claiming this is the definitive record for the fastest blowout of a new skipper but those of us sitting around the press box at CitiField tonight think it is. We knew the Reds' Hall of Famer went out even faster than had poor Les Moss, finally given a shot to manage in the majors after 20 years' apprenticeship as a coach, only to be cashiered by the Tigers in favor of Sparky Anderson on June 11, 1979.
Is it possible? Would anybody – let alone the Red Sox – off a high-profile skipper 40 games into his tenure? Or 30? The question certainly seems increasingly less like science fiction with every passing day. Now we hear Valentine won't put Daniel Bard back in the bullpen because he doesn't want to go.
Man alive, if that's the real reason, there's no need to fire poor Bobby. If third-year ex-set-up men get to dictate their roles on a pitching staff we can expect Valentine to just slowly vanish like the Cheshire Cat.
The Red Sox have done some goofy managerial things, and in recent memory. In mid-August 2001, in second place and just five games out, they fired manager Jimy Williams and made pitching coach Joe Kerrigan the skipper. The Sox proceeded to go 17-26 and end up 13-and-a-half out. As the new ownership group took over, they fired Kerrigan and put in coach Mike Cubbage as a spring training caretaker. When the John Henry gang was given formal control of the franchise, Cubbage was fired without ever managing a regular season game. Were that not bizarre enough, this was all done so they could make the ill-fated Grady Little the skipper.
By the way just to clarify – Perez is not the manager fired fastest. We're limiting this to guys in Valentine's shoes: newly hired to start a season (and in the cases of Moss and Perez, quickly fired). The overall fastest record either belongs to Cubbage or Wally Backman, hired and fired in the same off-season by the Diamondbacks. Or if you'd prefer the quickest in-season exit, that has to be Eddie Stanky. Lured back to the majors after eight years coaching in college, Stanky took the reins of the Rangers on June 22, 1977. Stanky's new team beat the Twins 10-8, whereupon Stanky told the startled media that he'd made a huge mistake – and was resigning.
20 Comments
Only problem is that the only "unemployed" top manager under the age of 60 is… Terry Francona. All the others (Torre,La Russa, even Frank Robinson) are of advanced age.
Listening to Cy Bard say he is okay with going to the pen temporarily made me realize how little power V has right now. C'mon I thought V was hired to stop the BS on this club. Don't fire V, Flog Cherrington.
Long live Keith Olbermann!!! He's the greatest!
I've got a heart for Bobby V. There is something light and free in his presence. When I heard that he picked Tony C. (Conig's) number…I knew that he was a real "valentine". He has been around the block and around the world, even! But kooky things do happen, Keith, and so you are wise to ask this question. If he goes, it will not be because he is "old" nor will it be that they are hiring that lovable Tito (Terry Francona) back. (Watched him last night as he worked with others to understand the Red Sox ways.) It will be because of the cycle of injustice…they can figure out the root of the problem, but don't want to go there. Here is hoping they don't fire him, but since they are looking in all the wrong places, what you suggest is true! And then the Bard (Shout out to Willie Shakespeare on his birthday yesterday!) will be smiling like a Cheshire Cat! Thanks for keeping it real here and seeing into the future. "Coach" Valentine's birthday is coming up…but lately folks are hired and fired in a time shorter than what is required to give birth to something!
Though some scream, "Loyalty!"…most have little respect for or even understanding of what that is.
I have written before about my mixed emotions regarding this man, whom I first got to know some 42 years ago. He was a wunderkind, a gifted ball player, friendly, unassuming, and treated us (grounds crew, clubbies etc) as if we were his equal, albeit a vastly more talented one. Fast forward to 1986, he's managing the Rangers, and another old ball player from my past employer is on his team. As we are chatting about our misspent youths, Bobby V. heads our way, big smile on his face as he has recognized me. My other friend turns towards me, and whispers don't talk to that a–hole, if you do, we are done. So I wonder when and how he turned into this man who appears to know all there is to know; was it the loss of his playing career (horrible injury) or what, I have no clue. Even so, I say let's give him 50-60 games , 1 or 2 players off the Dl, and then re-assess.
This is the sort of vital information I look for. Thanks.
I think Bobby V is safe through at least the All-Star break as long as he doesn't making any more anti-Youkilis type comments. Cherington wants to save face too. Plus two wins against the Twins (twin wins) means the Red Sox maybe hit bottom against the New York Highlanders.
Bobby Valentine is a baseball tragedy in some ways. He had a promising career and an injury cut it short. How much that affected him, I do not know. He is the son-in-law of Ralph Branca, and I have wondered how much Branca's past influences him. If you read or listen to interviews with Branca over the years, methinks he doth protest too much about the Giants cheating in 1951 (they did, but Thomson always had said he didn't that day), not to mention his complaints about Dodger management. I wonder how much of his views influence Valentine.
Now, this I DO know about Valentine. He is Tommy Lasorda's all-time favorite, including that Lasorda wanted him to become manager of the Dodgers. That is enough for me. Lasorda is a marvelous ambassador for baseball, a great salesman, and he outmanaged Davey Johnson and Tony LaRussa in 1988. But I spent 20 years putting up with his strategy, if you could call it that, and as for his personality, he certainly had the habit of being a celebrity-lover and of going after people. One story about the two of them has stuck with me. After Lasorda's heart attack, the Dodgers named him a vice president, but he really didn't have much to do. Valentine suddenly brought up the idea in the media of Lasorda becoming his bench coach with the Mets. The Dodgers GM, Fred Claire, said if Lasorda wanted to pursue that, the Dodgers wouldn't stand in his way, although they always would have a place in the organization for Lasorda. Nothing came of it. Many have said that Lasorda wanted to be GM and might have been if Al Campanis hadn't screwed up one night; who knows? But I felt at that time that Valentine and Lasorda were spewing just so much balloon juice to get Lasorda some more power in LA.
And I will never forget the night Valentine came back into the dugout after being ejected wearing fake glasses. Some thought it was funny. I thought it was childish and destructive. And that's Valentine: he thinks it's smart and funny, so it must be.
Keith, you are a brilliant and informed baseball pundit, and I can't compete with your knowledge or or passion for the game. But you also are a dear and close friend of Terry Francona, as you have written about extensively here. And judging from what you and others have said about him, he's the kind of man to inspire deep loyalty in his friends.
But I do think that this makes you a bit, shall we say, tilted in your writing about the Red Sox and Bobby Valentine. Bobby Valentine didn't contribute to the '11 collapse of the Red Sox; he didn't cause Tito's resignation, and he didn't leak any information to the Boston Globe for that nefarious article. For my part, as a BoSox fan who only has access to what the sportswriters say, I understand him to be a smart baseball man and a good guy. I hope he succeeds, because it's more fun to root for success than failure. Except when it comes to the Yankees.
Can I get out of the box here for a moment? Can we think Big Picture? Okay, work with me here. How can Red Sox right the ship…achieve a P.R. coup…put the Yankees on the back page of the NY Times sports section…and ASSURE themselves of a pennant? The answer, my friends, is hiding in plain sight…
Fire Bobby Valentine….and hire Newt Gingrich.
FIRST…the man is available. Yes, his visionary, once-in-a-millennium fundamentally transformative, destiny-driven campaign for the presidency was rejected by the pathetic sheeple of the United States, thanks to the insidious plotting and unvarnished vitriol of the lamestream media. HOWEVER…this means that Newt is looking for opportunity, and redemption.
So what does Newtie bring to the party? Okay, yes, he knows absolutely nothing about baseball except that the Atlanta team should RIGHTLY be called the "Crackers" instead of the Braves. HOWEVER…consider these benefits to hiring Newt.
1) He'd bring fundamentally transformative lean Six Sigma management principles to the game, including the firing of all those "union" janitors and using BoSox starting pitchers, on their "off" days, to clean the toilets of Fenway.
2) Before each game, he will challenge the opposing manager to a 2 hour Lincoln-Douglas style debate on the designated hitter rule…and destroy him, of course.
3) If things don't work out in Boston, he will move the Red Sox to a colony on the moon.
I know, I know…you're gobsmacked by the incontestable logic of my argument. And no, I'm not just saying this because I find Newt Gingrich the single most entertaining figure in America — the modern master of unintentional subtext.
Good one!
The Red Sox can hit. They do need bullpen help. I don't like Bobby V at all. But I can't say he's to blame for that.
He does have an obnoxious personality and will be scapegoated by management if necessary.
Caught a reference to Lew Burdette and flashbacked to the summer of 1957 in Milwaukee. That "bushleague" town as the New York papers opined. I was 7 and my Dad got standing room only tickets in the right field extension. The Braves were my heroes. I tuned into Earl Gillespie calling the games leading up to the Series. Especially liked his description of the fog rolling into Candlestick Park. Ah, memory. Warren Spahn, Wes Covington, Joe Adcock, Andy Pafko, Danny O'connell, Red Schoendienst, Del Crandall, Johnny Logan, and HANK AARON. A truly diverse group in a town lead by of all things a socialist mayor I discovered in my later years. But then I was a member of the Knot Hole Club waiting for the 5th inning to be let into the bleachers at home games. In those days my Dad would take me around to the locker room door after the games to get autographs and then we would go to the bars where the players hung out. I can still smell the beer and the smoke. It was wonderful. I played Little League Baseball. Baseball was my sport. I wonder if those remarkable days will ever come again somewhere, sometime. I can dream right? This is America lest we forget. Time out now. Have to tell you I have seen many of you TV shows and in my vernacular shouted right on, let 'em have it, too many times to count. Weaving baseball into your commentaries was neat. Congratulations on an excellent career to date and good luck in the future.


text:
Tantra started 8000-10000 years ago, in what we now know as India.
It was part of the culture of the Dravidians, and there is evidence indicating that is society was originally matriarchal. It was first systemised by Sadashiva or Shiva around 7500 years ago and due to recent revelations from various musicians, it is fast becoming a popular interest.
There are numerous ways to perform ritualistic worship according to tantra. However the sense of a tantric ritual remains the same, "to realise a higher reality".
To use Tantra, and its teachings and philosophies everyday would benefit our lives greatly, leaving us feeling content and full of well being.
It would make us generally happy within ourselves and our partnerships, surrounding ourselves and everyone we touch with light and happiness, causing us to enjoy and revel in our life situations, revealing how good we do actually have it.
If you are curious about how The Tantric Massage techniques can help you simply call me on 07928 730520 or contact me online and I'll call you back when it's convenient to you. We can have a chat and I can satisfy any of your curiosities.
It is an ancient system of spirituality and recently, more commonly a way of life. For those who feel passionate about it, can truly enjoy, appreciate and blossom within it!Read more
Angelina is truly gorgeous and made me feel immediately welcome in her studio. (I was a little nervous as I have never done anything like this before)


text:
For the second time in less than a month, Heat forward Michael Beasley is out of the Twitter business, this time, perhaps, for good.
Beasley's latest Twitter account, GorillaBeas, disappeared sometime overnight Saturday.
That was shortly after he self-posted a photo (seen below) of a new "SuperCoolBeas" tattoo on his back, which also happened to be the name of his first Twitter account.
Problem is, some have taken their inspection of the photo to a curious level. Yes, there appear to be two baggies in the background. No, I have no clue what they are, and, frankly, did not initially give it much second thought. You know, just Michael being Michael.
But AOL's respected "Fanhouse" blog noted:
"Take a good look at the bottom right-hand corner of that picture. No, not the 7-Up bottle, that's a good thing. Kid doesn't need any caffeine. No, what's curious, and what drew multiple comments on the TwitPic page and his Twitter account are what appear to be two plastic bags of something on the table. Ruh-roh. Now, it's not like we're looking at a high-res image of 10 bricks or anything. It's completely possible that's the leftover bag that contained the bologna sandwich he had for lunch. Or maybe he just likes to keep things in plastic bags. Maybe it just looks like a rolled up plastic bag, and it's actually just some trash."
Chicago.com also inspected the photo and offered:
"I don't know if he's got bags of weed there on the side like many have speculated, but seriously, "Supercool Beas"?"
And from the Heat-intensive blog Peninsula is Mightier:
"Beasley recently got a new tattoo and decided to take a picture of it and send it out via his TwitPic account. The problem isn't the tattoo; it's what appears to be in the background of the picture."
Before Beasley's Twitter account was closed and erased, these three posts were offered:
"Y do I feel like the whole world is against me!!!!!!! Back on my FTW!!!!! I can't win for losin!!!!!!!!!!" "Feelin like it's not worth livin!!!!!!! I'm done" "not feelin this at all!!!!!" The team has been in contact with Beasley since.
In the wake of Beasley's NBA censure for his behavior and ensuing cover-up at last summer's rookie orientation, this mostly had set up as a quiet summer for the talented forward taken out of Kansas State with the No. 2 pick in the 2008 NBA Draft.
And let's not overstate the innocuous Twitter activity.
But this also is a player whose maturity has stood as an issue with teammate Dwyane Wade, the same Dwyane Wade who can opt out of his contract after this season.
This can't help.
What ultimately will matter most is what happens starting Sept. 28 when training camp opens at AmericanAirlines Arena. If Michael makes the game easier for Dwyane, then no one will give a tweet about August hijinks.
But these are different times. Image matters. And it certainly matters for a franchise that values its players and tries to keep their value high in the event of a trade.
(Also, your Heat questions are answered regularly at Ask Ira! and for Heat updates check out our Twitter feed.)


text:
Reporting Unlawful Activities to the Labor Enforcement Task Force (LETF)
How to report a bad employer
Are you aware of a business or company that is engaging in unlawful activities, or do you have good reason to suspect a business of doing so?
If so, LETF would like to hear from you. Tips and leads that LETF receives from the public frequently result in an investigation.
Learn about what makes a good lead for LETF.
Please read before calling:
If you wish to report a widespread violation of labor law by your employer or a violation affecting multiple employees, please contact LETF via phone, online lead referral form or email:
- Call the LETF Public hotline anytime: 855 297 5322
- Complete the Online Form / Spanish Form
- Email us at firstname.lastname@example.com
However, if you are a current or former employee looking to:
- Claim unpaid wages
- File a retaliation/discrimination complaint on behalf of yourself
- Report a health/safety issue in the workplace


text:
7 Aug
7 Aug
"What good amid these, O me, O life? - Answer: That you are here—that life exists and identity, That the powerful play goes on, and you may contribute a verse." - Walt Whitman
Slow Living & Reading
Navigating with Chronic Illness in a Self Absorbed World
I AM therefore I Write. Official site of Marie A Bailey, writer, knitter, and stray cat magnet.


text:
I love a good joke, especially the kind that evokes a good belly laugh. You know, the side splitting guffaw, tears running and you can't breathe laughter? I feel euphoric after a good laugh and always want more. My sister and I would try to make each other laugh all the time when we were kids, especially in church or other places where it was "inappropriate"! We would get the biggest kick out of making my straitlaced grandparents laugh. Memaw would have to tell Papaw to calm down! My kids knew from an early age, all they had to do was make us laugh and all would be right with our world. My husband says that he asked me out a second time because I laughed at his cheesy pickup line AND I had big boobs. *shrug* Laughter truly is good for the soul!
This is my kind of humor…
It reminds me of the videos of Gramma and Ginga!
I recreated this cartoon on an Easter card. I don't like marshmallow peeps, yuck, but they are a kitschy celebration of spring. I won't eat them, but I'll make art with them!
The new challenge is up at Just for Fun Rubber Stamps and the theme is die cuts. I dusted off my Cuttlebug and cut the background panels using one of STAMPloration's crazy running stitch rectangle dies and trimmed the green panel with Lawn Fawn's stitched hillside borders. I stamped the blue background panel with JFF Rubber Stamps seashore grass silhouette for depth. The marshmallow bunnies were stamped on Club Scrap® card stock (don't you love the patterned paper from the Delft collection?) and trimmed with detail scissors. I added some Diamond stickles for sparkle and a little bowtie that was an embellishment in Club Scrap® 's Trattoria kit. I added a three-part bow to make things a little more festive. (Watch this video to view the steps to create a perfect three-part bow for yourself!)
I created the speech bubbles in Photoshop Elements using digital elements from Club Scrap® 's Comics kit, printed them on white card stock and trimmed with detail scissors.
I like to add dimension with a little foam tape, so I popped up the Happy Easter speech bubble and dapper bunny with a few pieces.
I had a leftover bunny, so I gave him an Easter makeover. May I present…Sir Peepsalot!
My crochet skills came in handy! I chain stitched some gold wired string I had in my ribbon basket and added an over sized egg with some stickles to complete the necklace. My little Easter rapper needed some sunglasses, and the Tim Holtz Crazy Things stamp set had the perfect pair!
Link up on the Just For Fun Rubber Stamps blog with your die cut creation for a chance to win a gift certificate to shop at JFF Stamps! I'll look for you in the gallery!
Life is better when you're laughing! ♥


text:
Download and installation instructions for Unix/Linux
We distribute Scheme 48 as a source release suitable for compilation under various flavors of Unix, including Linux, and Windows.
Here are some simplified download and installation instructions for Unix/Linux
systems. For more detailed installation instructions, see the files
README and
INSTALL in the distribution.
- Click on the following link
Downloadto download. Put the resulting file in
/tmp/scheme48-1.9.tgzor some other location of your choice.
- Log in as root and, at a shell, do
cd /usr/local/src(You do not have to do this as root, but you may have to build the system in a different directory if you don't.)
- Now issue the following incantation to unpack all of the files:
gunzip -c </tmp/scheme48-1.9.tgz | tar xf -
- Next, do
cd scheme48-1.9 ./configure make make installto configure, build, and install the system.
- Then simply use the command
scheme48to run the system. Consult the manual at this point for information on use.


text:
Think design when you think about your own happiness and health. Take steps every day to design your healthy life. A happy and healthy life is about living blissfully, with passion and purpose, and it's about designing your life, a life you love.
The great news is that you don't need a complete overhaul — trust me, you don't. Just like a fresh can of paint can easily make over a room, you can easily make over your life with simple tweaks. Take simple and tiny actions every day to design a life that brings you joy. Tiny actions can have a big impact on your health and well-being.
You can design a healthy lifestyle no matter where we are in your own health journey, whether you're dealing with an illness or recovering from an injury. You can design your life to reflect a happy you, no matter the circumstances. Taking small steps can have a big impact. Here are three simple healthy habits to help you design your happy, healthy life:
1. Have a Positive Lifestyle Vibe
Just the way your living space has a certain vibe, so do you. What's your vibe? Are you a positive force? Do you exude joy and bliss or do you resist? If it's the latter, take steps every day to be a positive force in your work and life. Begin by pushing positive thoughts. Get rid of the negative self-talk.
Don't underestimate the power of positivity and don't become your own worst enemy. Critical self-talk can be destructive. Positive thinking is important for happiness. Surround yourself with positive people and push your own positive thoughts. Thinking positively can be as important as getting enough sleep, eating right, and exercising. According to the Mayo Clinic, "positive thinking just means that you approach the unpleasantness in a more positive and productive way. You think the best is going to happen, not the worst." Some of the health benefits of positive thinking may include:
- Increased life span
- Lower rates of depression
- Lower levels of distress
- Greater resistance to the common cold
- Better psychological and physical well-being
- Reduced risk of death from cardiovascular disease
- Better coping skills during hardships and times of stress
Every day, pay yourself a compliment. Why not? You deserve it. Focus on the moment and on all of the great things you have accomplished in your life. Don't get sucked into gossip and negative talk from others.
2. Savor Sweet Sleep
Sleep is vital for your health and well-being. If you're getting the right amount of sleep that is something to smile about. Lack of sleep is a public health problem that can wreak havoc on your health.
According to the CDC, "An estimated 50-70 million U.S. adults have sleep or wakefulness disorders." Sleep helps your brain work properly. If you're not getting enough sleep you may have difficulty making decisions, trouble controlling your emotions and behavior, and problems coping with change and solving problems. Lack of sleep has also been linked to depression and suicidal thoughts. Sleep can also help repair your heart and blood vessels. According to the National Institutes of Health, "Ongoing sleep deficiency is linked to an increased risk of heart disease, kidney disease, high blood pressure, diabetes, and stroke."
How much sleep is required? For adults, between 7-8 hours is recommended. How many hours of sleep do you get each night?
Simple Healthy Design Actions to Savor Sleep:
- Design your bedroom so it's your sanctuary — it should be calming, relaxing and clutter free. Use soothing colors to help make your room an oasis of calm.
- Keep a sleep journal (write in your sleep journal before you get into bed, and in another room).
- Darken the room.
- Wear a sleep/eye mask.
- Take out the technology (especially the TV). Put your electronic devices, such as phones and tablets, in another room. This way you won't be tempted to use them.
- Avoid large meals before bed.
- Avoid caffeine.
- Avoid alcohol.
- Go to bed the same time each night.
- Have a relaxing bedtime routine each night. Take a warm shower or bath, listen to soft soothing music.
- Lavender oil can be a soothing and pleasant scent.
- Keep your bedroom at a comfortable sleeping temperature. Choose a temperature between 60 and 67 degrees Fahrenheit.
If you're concerned about your sleep habits and you recognize that it's disruptive, talk to your doctor, nurse practitioner, or other health care professional.
3. Be Grateful
Expressing gratitude can boost your happiness and health, according to Harvard Health Publications, and it is associated with increased levels of optimism and energy. "Gratitude helps people feel more positive emotions relish good experiences, improve their health, deal with adversity, and build strong relationships."
It's important to express gratitude. Let the people in your lives know how grateful you are for them and that you appreciate them. Simply say, "I am grateful to have you in my life and I appreciate you." Keeping track of what you are grateful for in a gratitude journal can help you focus on the positive and become more optimistic. I like to call my gratitude journal a bliss journal because by writing down things that I am grateful for, it immediately brings a sense of pleasure, bliss. But whatever you call it, it's something very easy to do, so why not give it a try?
Taking tiny steps every day can help you design a life that brings you joy. You can design your healthy life.
The post 3 Ways to Design a Happy and Healthy Life appeared first on The Oz Blog.
from top stories http://ift.tt/1X4cC7c
from WordPress http://ift.tt/1UWYTyN


text:
It's a roller coaster ride of emotions for Battlestar Galactica fans today. Earlier we saw a truly fantastic trailer for the long-in-the-works prequel series Battlestar Galactica: Blood & Chrome cut to Karen O's cover of "Immigrant Song" that was so expertly used in the Dragon Tattoo trailer. Fans have been waiting in vain for some kind of sign that the series still exists since the two-hour pilot was greenlit in 2010. Soon after the wave of excitement over the trailer peaked, Syfy decided to crush our dreams and announce that they won't be moving forward with the series after all. Hit the jump for more.
Battlestar Galactica: Blood & Chrome takes place during the 10th year of the first Cylon war and centers on a young William Adama (played by Luke Pasqualino). The show was initially envisioned as a web series and Syfy greenlighted the two-hour TV pilot in late 2010. The project hasn't exactly been sitting on the shelf since then, as the network didn't receive the finished pilot until last November due to a lengthy, visual effects-laden post-production process. Now that the network has gotten a look at the pilot, Deadline reports that they've decided to pass on the project as a regular series. There is light at the end of the tunnel, however, as Syfy apparently hopes to move forward with the show as a digital web series (as was the original intention). Syfy president of original programming Mark Stern had this to say:
"Though the vision for "Battlestar Galactica: Blood & Chrome" has evolved over the course of the past year, our enthusiasm for this ambitious project has not waned. We are actively pursuing it as was originally intended: a groundbreaking digital series that will launch to audiences beyond the scope of a television screen. The 90-minute pilot movie will air on Syfy in its entirety at a future date."
Apparently the trailer that hit earlier today was an unofficial demo reel that wasn't intended for the public. It was shown at WonderCon last weekend, but NBCUniversal has since removed all vestiges of it from YouTube. While I'm disappointed that Blood & Chrome won't be moving forward on television, I guess a web series is better than nothing. Still, the budget will presumably be miniscule compared to that of a series meant for cable. The project can still be shopped to other networks, but I seriously doubt any majors will bite. The prequel series Caprica was a ratings disappointment and was swiftly cancelled after just one season.


text:
Calling everyone interested in watercare!
We have full time roles available with a reputable company in the civil and watercare industry. With huge opportunities to upskill and gain qualifications, this is an amazing opportunity to get into the booming New Zealand civil and watercare industry. We are looking for people who have had previous experience in the watercare industry, hold current WTR tickets, or have the drive and desire and want to move into the civil industry.
What's in it for you?
- Competitive pay rates and weekly pay
- Permanent opportunities
- Career development and training provided
- Onsite parking
- Full time 50+ hours per week
- Be a part of an awesome team
- $20+ per hour
What do you need?
- Reliable transport to and from work
- Full class 1 license
- The legal right to work in New Zealand
- To be drug and alcohol free
- Desire to succeed in a booming industry
- Traffic control level 1 ticket advantageous
If you want to be a part of the leading recruitment agency in New Zealand, please apply now! Alternatively you can email a CV to Mel at email@example.com, or call on 021798944 for a confidential discussion.
Keywords: Civil , Civil construction , Watercare , Infrastructure , Upskill , Development , Career , Entry level , Trade , qualifications , get qualified