text:
Servicios Personalizados
Links relacionados
- Citado por Google
- Similares en Google
Water SA
versión On-line ISSN 1816-7950
versión impresa ISSN 0378-4738
Water SA vol.35 no.3 Pretoria abr. 2009
Treatment of swine wastewater with subsurface-flow constructed wetlands in Yucatán, Mexico: influence of plant species and contact time
Fedro Tapia GonzálezI; Germán Gíacoman VallejosII; Jorge Herrera SilveiraI; Carlos Quintal FrancoII; Joan GarcíaIII; Jaume PuigagutIII, IV, V, *
IDepartamento de Recursos del Mar, CINVESTAV-IPN, Unidad Mérida, Carretera Antigua a Progreso km. 6, Mérida, Yucatán, C.P. 97310, México
IIFacultad de Ingeniería, UADY, Investigador Académico de Ingeniería Ambiental, Av. Industrias No Contaminantes por Anillo Periférico Norte, Mérida, Yucatán, Apdo. Postal 150, México
IIISecció d'Enginyeria Sanitària i Ambiental; Departament d'Enginyeria Hidràulica, Marítima i Ambiental; Universitat Politècnica de Catalunya; c/Jordi Girona 1-3, Modul D-1, 08034 Barcelona, Spain
IVDépartement CGM (des génies civil, géologique et des mines) École Polytechnique de Montréal Case postale 6079, succursale Centre-ville (2900 boul. Edouard-Montpetit) Montréal (Québec), Canada, H3C 3A7
VInstitut de Rércherche en Biologie Vététale (IRBV); 4101 Sherbrooke Est, Montréal (Quebec), Canada, QC H1X 2B2
This study evaluates the capability of horizontal subsurface-flow constructed wetlands (SSF CWs) for treating pretreated swine wastewater as a function of contact time (CT) and type of macrophyte under the local conditions of Yucatán, Mexico. Experiments were conducted from July 2004 to November 2005 on a swine-fattening farm. The study had three stages: first, macrophytes were located and collected; second, plants were acclimatised; and third, a pilot plant with 6 wetlands was set up, operated and evaluated. The effectiveness of the wetlands was intensively tested over 2 periods (April and November 2005). The results indicate that treatment efficiency significantly improved with increased CT for most of the analysed contaminants. The highest removal rates were recorded at a CT of 3 d and ranged between 64 and 78% for total suspended solids, 52 and 78% for COD, 57 and 74% for BOD5, 57 and 79% for total nitrogen, 63 and 75% for ammonium nitrogen, 70 and 81% for nitrate, 0 and 28% for total phosphorus and 3.3 and 4.2 log-units for total coliforms. Results also suggest that the macrophyte species used did not significantly differ on their contribution to overall treatment efficiency. However, vegetated beds slightly improved water quality when compared to unplanted systems. Horizontal SSF CWs are a suitable technology for treating swine wastewater under the local conditions of Yucatán. Contact time should be given special attention in the design of future full-scale facilities.
Keywords: reed beds, swine wastewater, contact time, plant species
|subsurface-flow constructed wetlands
|septic tank
|drum screen
|sedimentation pond
|contact time
|contact time of one day
|contact time of two days
|contact time of three days
|organic loading rate
|hydraulic loading rate
|total suspended solids
|chemical oxygen demand
|biochemical oxygen demand
|total nitrogen
|total phosphorus
|total coliforms
In Mexico, the pig-farming sector requires suitable and integrated technological solutions to control pollution caused by the pig-farming cycle, mainly for 2 reasons: first, the national and state environmental authorities have increased pressure on industrial activities in the form of fines, and second, the Mexican Government has announced that farmers who do not treat their animal waste properly would lose their certificates? licences? Author to check allowing them to export pork.
Mexico is the 2nd largest swine producer in Latin America (>18 million pigs in 2004) and the 18th largest worldwide. Almost 70% of Mexico's swine production is located in 6 states: Jalisco, Sonora, Guanajuato, Puebla, Michoacán and Yucatán (Franco, 2006). Yucatán's pig-farming registry for the year 2001 showed a pig population of about 1 750 000 (INEGI, 2005). Each pig generates around 36 ℓ·d-1 of pig waste (Taiganides et al., 1996) which leads to a total of approximately 63 000 m3·d-1. Nitrogen and phosphorus concentrations are generally very high in the raw waste, about 2 500 and 600 mg·ℓ-1, respectively (Costa et al., 2000). If these nutrient-rich wastes are applied to agricultural soil at a higher rate than crop uptake ability, soil fixation and processing, the excess nutrients may reach surface and groundwater due to runoff and leaching (Stone et al., 1998).
In Yucatán, pig farmers commonly dump the primary-treated swine waste directly onto agricultural land because there are no environmental regulations pertaining to the discharge of wastewater that infiltrates into the ground. In fact, the only environmental regulations on water quality in Mexico refer to surface water (NOM-001-ECOL-1996). The common practices of local farmers have therefore raised special concern in the region, since the widespread presence of karst soils facilitates a rapid percolation of contaminants from agricultural soil to aquifers. Groundwater contamination is of special concern in the region because aquifers are the main source of drinking water. In a study by Pérez and Pacheco (2004) conducted in 106 municipalities in the region, 21 municipalities were found to exceed the upper limit of 45 mg·ℓ-1NO3- in supply water. Therefore, despite the lack of environmental regulation on wastewater that infiltrates into the ground, it is clearly of capital interest in both environmental and public-health terms to reduce the nutrient load to the Yucatán environment. Alternative or additional swine-waste treatment systems need to be implemented in order to reduce the potential environmental and health problems related to swine waste.
Constructed wetlands are biological wastewater treatment systems in which contaminants are removed by means of various mechanisms such as sedimentation, filtration, microbial degradation and plant uptake (Ciria et al., 2005). They are normally used to treat settled effluent from rural housing, but are now being considered for treating farm-produced wastewater (McGechan et al., 2005). Constructed wetlands appear to be a suitable technology for treating swine wastewater in the Yucatán region since they can easily be managed by non-specialised staff and have low maintenance and operation costs (Reddy et al., 2001). Moreover, studies have shown that constructed wetlands have successfully treated animal wastewater in other regions (Payne et al., 1992; Hunt et al., 1994). The type of constructed wetland most commonly used to treat swine wastewater is the surface-flow constructed wetland (SF CW) (Hunt and Poach, 2001), but there have also been a few successful experiences with subsurface-flow systems (Kantawanichkul et al., 1999 and 2001; Lee et al. (2004); Sezerino et al., 2003). Little is known, however, about the suitability of SSF CWs for treating farm wastes with a high nitrogen load.
The main objective of this study, therefore, was to test the capability of horizontal SSF CWs for treating pretreated swine wastewater (under the local conditions of Yucatán) as a function of contact time (CT) and type of macrophyte.
Background to the experimental studies
Experiments were conducted over a period of 16 months (July 2004 to November 2005) on a swine-fattening farm located in the town of Conkal, in the north of Yucatán, southern Mexico. The farm's 3 000 animals produce about 90 m3·d-1 of wastewater. Different activities were carried out in each of the study's 3 stages. In the 1st stage, which lasted 1 month (July 2004), the macrophytes used for the experiments were located and collected. In the 2nd stage, which lasted 5 months (August-December 2004), the macrophytes were acclimatised. In the 3rd stage, which lasted 11 months (January-November 2005), 6 pilot horizontal SSF CWs were set up and operated. The macrophytes that had proved to be the most resistant during the acclimatisation period (Typha latifolia and Eleocharis interstincta) were used in the 3rd stage. During this final stage, the effectiveness of the wetlands was tested twice: Once in April 2005 in the dry season that lasts from March to June, when rainfall is less than 100 mm and temperatures are high (daily maximum temperatures of 36 to 40˚C); and then in November 2005, in the 'nortes' season that lasts from November to February, when rainfall is very low at less than 50 mm and temperatures are cool (daily maximum temperatures of 20 to 23˚C)
Location, collection and acclimatisation of macrophyte species
During the 1st stage of the study, emergent aquatic macrophytes growing in the natural ecosystems of Yucatán were collected and cultivated. The purpose was to select those species which were best adapted to growing under the severe conditions created by swine wastewater. A total of 5 species (Fimbristylis spadicea, Typha latifolia, Eleocharis interstincta, Arundinella berteroniana and Cladium jamaicensis) were collected and cultivated in 5 plastic tanks (length 1.1 m, width 0.7 m and depth 0.6 m). Each plastic tank was filled to a height of 0.3 m with gravel (diameter 10 to 30 mm), followed by an 0.15 m thick top layer of sand, to simulate the conditions in which macrophytes would grow in horizontal wetlands. These tanks were fed with 50 ℓ of pretreated swine wastewater each day throughout the 5 months of the 2nd stage.
Physico-chemical characterisation of swine wastewater
On the farm, the wastewater generated during the fattening cycle is discharged to a septic tank (ST), from which it is pumped to a drum screen (DS) before being diverted to the receiving environment. Solids derived from this treatment are disposed of on agricultural lands without additional treatment. In this study, 3 m3 of the DS effluent were transferred every day to 3 parallel pilot sedimentation ponds (Ps). From there, the wastewater was pumped to a storage tank that fed the horizontal wetlands (Fig. 1). As additional treatment, sedimentation ponds were used to remove solids, thereby reducing the organic loading rate (OLR) applied to the wetlands. The physico-chemical properties of the Ps effluents were analysed in April 2005. A total of 12 samples were collected on 4 consecutive days from each pretreatment effluent, prior to the first wetland sampling campaign. The physico-chemical parameters analysed were pH, total suspended solids (TSS), chemical oxygen demand (COD), biochemical oxygen demand (BOD5), total nitrogen (TN), ammonium nitrogen (NH4+-N), nitrate nitrogen (NO3--N), total phosphorus (TP) and total coliforms (TCF). All of these parameters were analysed according to Standard Methods (2001) and are summarised in Table 1. NH4+-N was analysed by means of a prior distillation step in the Kjeldahl method.
Horizontal SSF CWs
The pilot plant was fed with pretreated wastewater from the Ps (i.e. wastewater that had been stored in a tank). The plant consisted of 6 identical parallel beds (wetlands), of which 2 were planted in February 2005 with Typha latifolia (T), 2 were planted with Eleocharis interstincta (E), and 2 remained unplanted as controls (C). Plants were established at a density of 15 shoots.m-2 and allowed to grow to densities of approximately 65 shoots·m-2 at the start of the experiment. These 2 species were selected from among all of the cultivated macrophytes because they had the best appearance and development during the acclimatisation period. Each system consisted of 6 identical beds made of PVC with length, width and depth of 1.1 m, 0.7 m and 0.45 m respectively. Furthermore, each bed was filled to a height of 0.3 m with gravel with a diameter ranging from 10 to 30 mm (D10= 32 mm), followed by a 0.15 m thick top layer of sand (D10= 2 mm). The initial porosity was 40% and 32% for the gravel and sand media, respectively. The nominal pore space of each bed was 50 ℓ (experimentally measured at the beginning of the sampling period). During the experimental phase the water level in each bed was kept constant at about 0.05 m below the surface of the sand.
Wetlands monitoring and data analysis
The performance of the wetlands was monitored over 2 periods, in the dry and "nortes" seasons, over 9 consecutive days of intensive sampling of the effluent of each bed. Note that, although the sampling was conducted in a short period of time, fixed biomass reactors (as the constructed wetlands) are generally less affected by changes in environmental and/or operational conditions (Brix and Schierup, 1989). On the other hand, in order to evaluate the effect of CT on treatment efficiency, the systems were operated at three different CTs for these 9 d. For the testing of each different CT pretreated wastewater was supplied in quantities of 50 ℓ depending on the desired contact time, with excess water being displaced from the toe of the bed. Specifically, contact times were 1 d (CT1), 2 d (CT2) and 3 d (CT3). For each contact time water was removed from the toe of the bed at 4 h intervals over a period of 12 h during the day of sampling and the samples were mixed to obtain a composite sample. Thus for CT1, water was removed after 24, 28, 32 and 36 h, for CT2 it was removed after 48, 52, 56 and 60 h, and for CT3 it was removed after 72, 76, 80 and 84 h. Following each experimental run, the water in the bed was removed and replaced with fresh pretreated wastewater. After runs of CT1, CT2 and CT3, another 3 d experimental run was undertaken, and samples were taken as for CT1, CT2 and CT3 without replacing the water each time. Table 2 summarises the operational conditions of each wetland by CT.
Statistical analyses were carried out using the Statgraphics Plus 4.1 statistical software package. One- and two-way ANOVA methods were used to check the influence of each factor considered (presence/absence of macrophytes and CT) for each water-quality parameter and to evaluate the interactions between factors. For each ANOVA test, it was checked whether the variables were normally distributed; if not, they were log-transformed. To discriminate among the means, Fisher's least significant difference (LSD) procedure was used.
Results and discussion
Organic matter and TSS removal in the wetlands
In our study, effluent TSS, COD and BOD5 concentrations clearly decreased as the CT increased in all cases tested. Planted wetlands produced effluents whose quality was 5 to 15% better than those of the unplanted controls (Tables 3 and 4). In general terms, the organic matter removal results suggest that CT influences wetlands performance more than the type of macrophyte.
TSS removal efficiencies ranged from 35 to 76% in the dry season and from 44 to 78% in the "nortes" season. The organic matter removal results showed a pattern similar to that of TSS. Specifically, in the dry season, efficiencies ranged from 36 to 68% and from 28 to 69% for COD and BOD5, respectively; in the "nortes" season, they ranged from 40 to 78% and from 49 to 74% for COD and BOD5, respectively. The literature on this topic reports a wide range of TSS and organic matter removal efficiencies in constructed wetlands treating swine wastewater, as discussed below.
Kantawanichkul et al. (2001) reported a COD removal efficiency of 98% in a pilot combined wetland system (a vertical SSF CW followed by a horizontal SSF CW) treating raw swine waste and operated with an OLR of 105 g COD m-2·d-1 and a hydraulic loading rate (HLR) of 37 mm·d-1. Sezerino et al. (2003) observed lower COD removal efficiencies, ranging from 25 to 54%, for a vertical SSF CW treating swine waste and operated with an OLR ranging from 12 to 23 g COD m-2·d-1 and an HLR of 30 mm·d-1. Lee et al. (2004) reported removal efficiencies of 99% for TSS, 77% for COD and 86% for BOD5 for a horizontal subsurface SSF CW fed with pretreated swine waste and operated with an OLR of 130 g COD m-2·d-1 and a HLR of 120 mm·d-1. In our study, we found that the highest removal efficiencies of TSS and organic matter (COD and BOD5) were observed for CT 3 when the OLR was 95 g COD m-2·d-1 and the HLR was 21.6 mm·d-1; in this case, the removal efficiencies ranged from 64 to 78% for TSS, 52 to 78% for COD and 57 to 74% for BOD5. The organic matter and TSS removal efficiencies observed in our study were therefore generally lower than those reported by Lee et al. (2004) and Kantawanichkul et al. (2001) and higher than those reported by Sezerino et al. (2003). The wide range of efficiencies in TSS and organic matter removal found in different studies is probably related to the great variation of pig-waste composition, which is, in turn, highly dependent on farm management and storage conditions (Boursier et al., 2005).
According to our statistical analysis, CT caused significant statistical differences in the average effluent concentration of TSS, COD and BOD5 in all bed types (i.e. with or without macrophytes) and in both campaigns (Table 5). The test used to discriminate among the means indicated that all pairs of means were different for BOD5 and COD. For TSS, most of the differences were between CT 1 and the 2 other CTs.
The ANOVA test revealed significant interactions between the two factors (presence/absence of macrophytes and CT) for TSS in the "nortes" season and for COD and BOD5 in both campaigns. These interactions were due to the fact that effluent concentrations were clearly lower in CT 3 than in CT 1 and CT 2, and that the planted beds had lower concentrations than the unplanted beds.
Nutrient removal in the wetlands
The effluent TN and NH4+ concentrations clearly decreased as CT increased, regardless of the type of macrophyte (Tables 6 and 7). These results contrast with those found for ammonium in the study of Lee et al. (2004), who observed that the lowest removal rates occurred at the greatest hydraulic retention time. The planted wetlands generally produced effluents whose quality was between 2 and 5% better than that of the unplanted beds for TN and NH4+ (Tables 6 and 7). In the case of NO3-, there was no clear relationship between effluent concentration and CT, since during the dry season the lowest concentrations were observed for CT 2, whereas in the "nortes" season the results varied with the type of treatment.
The TN removal efficiencies ranged from 47 to 66% in the dry season and from 59 to 79% in the "nortes" season, whereas the NH4+ removal efficiencies ranged from 53 to 67% in the dry season and from 50 to 75% in the "nortes" season. The NO3- removal efficiencies ranged from 69 to 84% in the dry season and from 60 to 75% in the 'nortes' season. The planted beds had the best NO3- removal performance (Tables 6 and 7, next page).
The literature generally reports lower nitrogen removal efficiencies than those found in this study. For example, Lee et al. (2004) reported removal efficiencies for TN, NH4+ and NO3- ranging from 1 to 22%. The higher efficiencies observed in our study may be linked to our intermittent feeding strategy. Intermittent feeding may have enhanced re-aeration of the granular medium, which in turn would have increased biochemical aerobic routes. In fact, the removal efficiencies observed in this study are very similar to those reported for vertical SSF CWs by Sezerino et al. (2003) (2 to 68%) and by Kantawanichkul et al. (1999) (80 to 90%). The rather high removal rates observed in the experiments of Kantawanichkul et al. (1999) may be related to the fact that the authors used diluted swine wastewater.
Based on statistical analyses conducted on nitrogen species, we can conclude that CT caused significant statistical differences in terms of the average effluent concentrations of TN, NH4+ and NO3- in all treatments in both campaigns (Table 5). The test used to discriminate among the means indicated that all of the pairs of means were statistically different for the three nitrogen species. The greatest average differences were observed between CT 1 and CT 3 regardless of the type of macrophyte.
The ANOVA test revealed significant interactions between the 2 factors (presence/absence of macrophytes and CT) for TN, NH4+ and NO3- in the dry season campaign. These interactions were due to the fact that the planted beds had significantly lower concentrations than the unplanted beds during the dry season.
The TP removal efficiencies were generally lower than those of the other contaminants. TP removal ranged from 0 to 12% in the dry season and from 6 to 28% in the 'nortes' season (Tables 6 and 7). According to the statistical tests, CT seemed not to have a significant effect on TP removal (Table 5). On the contrary, as has been previously described by Vymazal (2003), the presence of macrophytes had a significant effect on the performance of the systems. The TP removal efficiencies obtained in this study were, however, lower than those reported by Lee et al. (2004) (47 to 59%).
Microbial removal in the wetlands
The TCF removal was generally not high enough to produce effluents with low concentrations. Effluent TFC concentrations ranged from 10.8 to 10.1 log-units·100 mℓ-11 in the dry season and from 9.1 to 8.5 log-units·100 mℓ-1in the 'nortes' season for CT 1, from 9.8 to 9.6 log-units·100 mℓ-1 in the dry season and from 8.0 to 7.1 log-units·100 mℓ-1in the 'nortes' season for CT 2, and from 8.6 to 8.3 log-units·100 mℓ-1in the dry season and from 7.8 to 7.0 log-units·100 mℓ-1in the 'nortes' season for CT 3. Removal efficiencies ranged from 3.3 log-units in the dry season to 4.2 log-units in the 'nortes' season. These removal efficiencies agree with those reported by Kantawanichkul et al. (1999) (approximately 4 log-units). The ANOVA test indicated that there were no statistical differences in the average effluent TFC values between the various types of beds within the same CT (Table 5). On the contrary, CT caused significant differences in TFC concentrations. The test used to discriminate among the means indicated that all pairs of means were different.
Summary of all results
CT caused clear differences in removal efficiency for most of the evaluated contaminants. Therefore, it may be considered as a key parameter in the performance of horizontal SSF CWs treating swine wastewater. In contrast, the differences between planted and unplanted systems were not clear or were very low, especially in the dry season. This contrasts with the studies of Brison et al. (2006) and Ciria et al. (2005), which reported a clear contribution by plants on contaminants removal. It is likely that the high concentrations of contaminants treated in this study masked the macrophytes' contribution to overall treatment efficiency (Brix, 1997). Only in the case of BOD5 planted wetlands clearly showed superior treatment efficiency, with removal efficiencies of 68% in planted wetlands (Typha latifolia) and 59% in unplanted beds for both periods.
The wetlands had slightly better removal efficiencies in the 'nortes' campaign than in the dry campaign. Specifically, during the 'nortes' season, the wetlands had 2 to 10%, 4 to 10%, 6 to 21%, 13 to 14% and 3 to 8% higher removal efficiency for TSS, COD, BOD5, TN and NH4+-N, respectively. This trend seems to be linked to the higher evapotranspiration rates in the dry season, which would increase the contaminant concentrations in the wetlands. Unfortunately, evapotranspiration was not directly quantified at the time of the experiments; in the dry season, however, temperatures and wind speed are higher and humidity is lower, so we may reasonably assume that the evapotranspiration rates would have been higher. It is common for treatment efficiency in many constructed wetlands to decrease in dry periods due to high rates of evapotranspiration (Kadlec and Knight, 1996).
Care should be taken when applying the results of this study, since they were obtained from small pilot wetlands and during a short evaluation period. Nevertheless, these results provide a starting point for the use of horizontal SSF CWs in Yucatán and gives insight of the potential application of this technology for an environmental concern in the region.
The results of this study clearly indicate that CT is a key factor in the removal of a wide variety of contaminants (COD, BOD5, TN, NH4+, NO3- and micro-organisms) in horizontal SSF CWs treating swine wastewater.
According to the results of this study Typha latifolia and Eleocharis interstincta are the most suitable macrophyte species to be used for the treatment of piggery wastewater under Yucatan's local conditions. In spite of the fact that high contaminant concentrations in wastewater may have masked the macrophytes' contribution to the overall treatment efficiency, vegetated beds usually provide better effluent quality than unplanted beds.
The best contaminant removal efficiencies were for a CT of 3 d. In such conditions, removal efficiencies ranged between 64 and 78% for TSS, between 52 and 78% for COD, between 57 and 74% for BOD5, between 57 and 79% for TN, between 63 and 75% for NH4+, between 70 and 81% for NO3-, from 0 to 28% for TP and between 3.3 and 4.2 log-units for TCF.
In general terms, the results of this study suggest that horizontal SSF CWs could be a suitable technology for treating swine wastewater in Yucatán. Furthermore, CT clearly deserves special attention in the future design of full-scale facilities.
This work forms part of the Ph.D. thesis of Fedro Tapia at the Mérida Unit of CINVESTAV-IPN and the Engineering School of UADY. We acknowledge Javier Ramírez, José Ramírez, Roberto Pat, Javier Frías, Víctor Coronado and Olga Briceño for their assistance with sample collection and physico-chemical analysis, and for their experience in the study area. We also thank CONACyT and Fondos Mixtos Campeche.
BOURSIER H, BÉLINE F and PAUL E (2005) Piggery wastewater characterisation for biological nitrogen removal process design. Bioresour. Technol. (96) 351-358. [ Links ]
BRISSON J, CHAZARENC F and BISAILLON L (2006) Maximizing pollutant removal in subsurface constructed wetlands: should we pay more attention to macrophyte species selection? Proc. 10th Int. Conf. on Wetland System for Water Pollution Control. Volume II, 909-917. [ Links ]
BRIX H (1997) Do macrophytes play a role in constructed treatment wetlands? Water Sci. Technol. 35 (5) 11-17. [ Links ]
BRIX H and SCHIERUP H (1989) The use of macrophytes in water pollution control. Ambio 18 100. [ Links ]
CIRIA MP, SOLANO ML and SORIANOP (2005) Role of macrophyte Typha latifolia in a constructed wetland for wastewater treatment and assessment of its potential as a biomass fuel. Biosyst. Eng. 92 (4) 535-544. [ Links ]
COSTA RHR and MEDRI W (2000) High-rate pond for treatment of piggery wastes. Water Sci. Technol. 42 (10-11) 357-362. [ Links ]
FRANCO M (2006) Methane to markets: Mexico program overview. Technical Report by PA Consulting Group, Mexico. [ Links ]
HERRERA-SILVEIRA JA (1994) Spatial heterogeneity and seasonal patterns in a tropical coastal lagoon. J. Coastal Resour. 10 (3) 738-746. [ Links ]
HUNT P G and POACH M E (2001) State of the art for animal wastewater treatment in constructed wetlands. Water Sci. Technol. 44 19-25. [ Links ]
HUNT PG, HUMENIK FJ, SZOGI AA, RICE JM, STONE KC and SADLER EJ (1994) Swine wastewater treatment in constructed wetlands. In: Proc. of the 2nd Conference on Environmentally Sound Agriculture, University of Florida. 268-275. [ Links ]
INEGI (2005) Instituto Nacional de Estadistica, Geografía e Informática. El sector alimentario en México. 314 pp. [ Links ]
KADLEC RH and KNIGHT RL (1996) Treatment Wetlands. Lewis, CRC Press. Boca Raton, Fl., USA. 893 pp. [ Links ]
KANTAWANICHKUL S and NEAMKAM P (2001) Nitrogen removal in a combined system: vertical vegetated bed over horizontal flow sand bed. Water Sci. Technol. 44 (11-12) 137-142. [ Links ]
KANTAWANICHKUL S and PILAILA S (1999) Wastewater treatment by tropical plants in vertical-flow constructed wetlands. Water Sci. Technol. 40 (3) 173-178. [ Links ]
LEE C-Y, LEE C-C, LEE F-Y, TSENG S-K and LIAO C-J (2004) Performance of subsurface flow constructed wetland taking pretreated swine effluent under heavy loads. Bioresour. Technol. 92 173-179. [ Links ]
McGECHAN MB, MOIR SE, SYM G and CASTLE K (2005) Estimating inorganic and organic nitrogen transformation rates in a model of a constructed wetland purification system for dilute farm effluents. Biosyst. Eng. 91 (1) 61-75. [ Links ]
McGECHAN MB, MOIR SE, CASTLE K and SMIT IP (2005) Modelling oxygen transport in a reedbed-constructed wetland purification system for dilute effluents. Biosyst. Eng. 91 (2) 191-200. [ Links ]
PAYNE VWE, McCASKY TA and EASON JT (1992) Constructed wetlands for treating swine lagoon effluent. Proc. ASAE. 32 pp. [ Links ]
PÉREZ CR and PACHECO AJ (2004) Vulnerabilidad del agua subterránea a la contaminación de nitratos en el estado de Yucatán. Ingeniería 8 (1) 33-42. [ Links ]
REDDY G B and HUNT P G (2001) Treatment of swine wastewater in marsh-pond-marsh constructed wetlands. Water Sci. Technol. 44 545-550. [ Links ]
SEZERINO PH and REGINATTO V (2003) Nutrient removal from piggery effluent using vertical flow constructed wetlands in southern Brazil. Water Sci. Technol. 2 129-135. [ Links ]
STANDARD METHODS (2001) Standard Methods for the Examination of Water and Wastewater (20th edn.). APHA-AWWA-WEF American Public Health Association, Washington DC. [ Links ]
STONE KC and HUNT PG (1998) Impact of swine waste application on ground and stream water quality in an eastern coastal plain watershed. Trans. ASAE 40 (6) 1665-1670. [ Links ]
TAIGANIDES PE, PÉREZ R and GIRÓN E (1996) Manual para el manejo y control de aguas residuales y excretas porcinas en México. Instituto de Investigaciones Económicas. UNAM. Mexico. [ Links ]
VYMAZAL J (2003) Removal mechanisms in constructed wetlands. In: Dias V and Vymazal J (eds.) The Use of Aquatic Macrophytes for Wastewater Treatment in Constructed Wetlands. Articles of the 1st International Seminar. May 8-10, Lisbon, Portugal. Fundação Calouste Gulbenkian, Lisbon. 219-264. [ Links ]
Received 20 October 2008; accepted in revised form 22 January 2009.
* To whom all correspondence should be addressed.
+00 514 872 84 89; fax: +00 1 514 872 94 06;
e-mail: firstname.lastname@example.com


text:
Printable Coach Factory Coupon 2011: Enjoy an additional 30% off coupon at your local Coach Factory Store. Coupon valid now through Sunday, November 13, 2011. PRINTABLE COACH OUTLET COUPON
Please follow our website. Be the first to hear about our deals and add us on Facebook by clicking here. We're also on twitter. Click here to find us on Twitter It's free!!! Tell your friends about us and save money together. Thanks!!!

subset: commoncrawl


text:
Apr 2014
Dancing Across the Universe
Eventually, everyone ends up back at their old pirouetting grounds.
Riyo Mori, who held the Miss Universe title in 2007, stopped by the Quinte Ballet School of Canada Monday to teach a workshop for the current professional students.
Mori attended QBSC from 2004 to 2006 and, as one of four international students at the time, split her focus into three parts: academic school, ballet school and a dance teacher course.
"Being an international student, you need to fully understand your purpose [at the school]," said Mori. "Coming from that far away, you have to work for your goals. You have to work hard."
The workshop, both ballet and jazz focused, was meant to help students hone their skills and give them a taste of what Mori has been up to for the past eight years. Read the full article
Other News
- See Olivia Culpo in "The Other Woman"
- Miss Universe Gabriela Isler Presents at the 25th Annual Billboard Latin Music Awards
- River Center getting million dollar makeover for Miss USA
- Venus, Shamcey, Ariella share financial tips
- 10 Of The Most Influential Latinos In The World
- Miss USA contestants arrive in Baton Rouge this weekend


text:
Arcadia has adjusted its Center program dates to be no more than 89 days. As a result, any student with a US Passport will not need to obtain a visa prior to going abroad. Any non-US nationals should be certain to speak with their Program Manager about obtaining proper documentation.
If you are studying in Greece for more than 90 days, you will need to apply for a Long Stay visa or a National visa. This may seem daunting but don't worry – your program manager will walk you through every step, and send you a complete Visa Pack with full instructions and details of everything you will need. If you are traveling internationally in the months leading up to your program start date, please let your program manager know.
Two of the most time-consuming parts of the student visa process are applying and obtaining a U.S. passport and obtaining an FBI background check. Begin these two tasks immediately!
The visa process for Greece is administered in the U.S. by Greek Consulate offices located throughout the country. You must apply for your student visa at the Consulate office in the area of your permanent residence, not where your homeschool is located. The Embassy of Greece, Washington D.C. provides a list of Greek Consulates in the U.S. Each consulate office administers student visas in a slightly different way, so please pay special attention to the specific requirements at your Consulate. Most consulates require that you appear in person to submit your application. However, there are some exceptions. Be prepared for to travel a great distance to apply. Please refer to the instructions listed on the consulate webpage to determine whether you must submit your application in person.
The Consulate requires an FBI Certificate (full criminal background report); however, due to delays in regular FBI processing, it is highly recommended that you utilize an FBI-Approved Channeler, such as Fieldprint, Inc.
Passport: Be sure you have a valid, signed passport that will be good for at least six months following the completion of the program.
Passport Copy: Submit a photocopy of the photo page of your passport to Arcadia University – The College of Global Studies. This can be scanned and emailed, faxed, or sent by regular mail.
Medical Certificate: You must submit a medical certificate completed by your physician. The form can be found on the Greek Consulate website.
Greek Consulate of Jurisdiction: Based on your permanent place of residence, determine which Greek Consulate you must apply to for your visa. Example, if you go to school in Chicago, IL, but your home address is in suburban Philadelphia, you should use the New York Consulate and not the Chicago Consulate.
Be certain to contact your Greek Consulate before going to understand their specific requirements for the visa application process as each Consulate follows slightly different rules. These rules may change without notice and it is your responsibility to know exactly what is expected of you at your particular Consulate.
The Arcadia Athens Center in Greece will apply for the necessary visa documentation from the immigration authorities in Athens. Arcadia MUST have a copy of your passport in order to request the appropriate documentation.
Once the immigration documents have been received by the Arcadia Athens Center, The College of Global Studies will send you, via UPS, the following documents:
Contact your Greek Consulate Office to double check the visa application process. Do you need an appointment? Is the visa department open on the day you plan to visit? (Greek Consulates observe Greek national holidays) What are the hours of the visa section? How much is the visa, since the price can fluctuate? Does the Consulate require payment? If so, what forms of payment do they accept? (Money order or cash?)
Application Documentation: Collect all the documents to be submitted with your application. See the Visa Requirements for Studies in Greece section.
Complete the "Application for a Long Stay Visa" form using the directions provided.
Do not visit the Consulate without this application and the other requirements (above) as the Consulate will not accept your application and you will have to make a new appointment which will delay the process.
Your passports must be left at the Consulate for processing. Processing time varies depending on the Consulate, but please allow a minimum of 30 days for processing. Please confirm with your Consulate how they will return your passport and visa to you prior to visiting. Many times you must provide a business-sized, self-addressed US Postal Service Express envelope with appropriate postage and completed air bill for your passport to be returned to you. Some Consulates, however, requires visas to be picked up in person.
Once all of the above steps are complete, you will receive a Greek document stating that you have followed all regulations correctly and can now legally stay in Greece. This document must be photocopied by the Arcadia Athens Center and kept with your passport. When you depart Greece for the U.S. at the end of the program, you will show this document at passport control.


text:
Bollywood superstar Shah Rukh Khan, who has been blessed with a third child through surrogacy, has said the much-publicised issue was a "personal and confidential" matter for him.
"It is a personal and confidential matter...it is a mix of happiness and sadness. I request the authorities concerned to continue to enthusiastically investigate about my baby," he told reporters at the music launch of his upcoming film 'Chennai Express' here tonight.
Earlier in the day, civic officials confirmed having received birth report of Shah Rukh and Gauri Khan's baby boy, born with the help of a surrogate mother.
As per the report, the baby was born on May 27 at the Masrani Hospital for Women in suburban Andheri. The celebrity couple has two kids - son Aryan and daughter Suhana.
"Get over it. Get on the train baby, and not my baby. Will talk about all this later," he told reporters who asked a volley of questions about the new member of his family.
Asked how does it feel to become father for the third time, the 47-year-old King Khan shot back in his typical style: "Ask your health reporter."
It is mandatory for nursing homes and hospitals to register every birth in the city. The civic body issues birth certificates to parents on the basis of a report received from the health facility concerned.
Earlier, following a complaint based on media reports that a pre-natal sex determination test had been conducted on the child, the BMC sent a team to Khan's residence last month to ascertain the facts. The team, however, was turned away.
Gender testing is banned under the Pre-Conception and Pre-Natal Diagnostic Technique (PCPNDT) Act.
A BMC officer has said a team would be sent to Khan's residence in suburban Bandra to find out from him if a sex determination test was conducted on the foetus.


text:
Not Available For Sale
Nature's Way EFAGold Mega-DHA is the highest quality source of DHA - guaranteed to contain 50% Docosahexaenoic acid (DHA) and 20% Eicosapentaenoic acid (EPA) from premium molecularly distilled/ PCB free fish oil.
Mega-DHA is a super concentrated 50% DHA fish oil in a convenient 1,000 mg softgel. Each softgel provides 500 mg of DHA, 200 mg EPA, and 10 IU of Vitamin E.
DHA is an essential Omega-3 fatty acid for healthy mental and visual function. Mega-DHA is ideal as a prenatal and nursing supplement. DHA is also essential to proper eye and brain development within infants (before and after birth) and is an important component of human breast milk. Mega-DHA can replenish DHA in the mother or can be used to support healthy skin, eyes, joints and brain function.* Studies indicate the average Western diet is low in Omega-3 fatty acids, including DHA.


text:
Thursday, November 30, 2006
Thoughts on Vista
Tuesday, November 28, 2006
FreeBSD 7.0 Snapshot with SCTP
Rather than update a FreeBSD 6.x system to 7.0, I decided to look for the latest FreeBSD snapshot. Sure enough, I found the latest 7.0 snapshot was dated 6 Nov 06. I downloaded the first .iso and installed it into a VMware Server VM. The kernel was compiled on 5 Nov 06:
$ uname -a
FreeBSD freebsd70snap.taosecurity.com 7.0-CURRENT-200611
FreeBSD 7.0-CURRENT-200611 #0: Sun Nov 5 19:31:17 UTC 2006
email@example.com:/usr/obj/usr/src/sys/GENERIC i386
I found the SCTP files I was looking for, too.
$ cd /usr/src/sys/netinet
$ ls -al *sctp*
-rw-r--r-- 1 root wheel 11869 Nov 3 10:23 sctp.h
-rw-r--r-- 1 root wheel 83862 Nov 3 14:48 sctp_asconf.c
-rw-r--r-- 1 root wheel 2884 Nov 3 10:23 sctp_asconf.h
-rw-r--r-- 1 root wheel 62791 Nov 3 10:23 sctp_auth.c
-rw-r--r-- 1 root wheel 9440 Nov 3 10:23 sctp_auth.h
-rw-r--r-- 1 root wheel 58467 Nov 3 10:23 sctp_bsd_addr.c
-rw-r--r-- 1 root wheel 2370 Nov 3 10:23 sctp_bsd_addr.h
-rw-r--r-- 1 root wheel 30071 Nov 3 10:23 sctp_constants.h
-rw-r--r-- 1 root wheel 39292 Nov 4 03:45 sctp_crc32.c
-rw-r--r-- 1 root wheel 2149 Nov 3 10:23 sctp_crc32.h
-rw-r--r-- 1 root wheel 14856 Nov 3 10:23 sctp_header.h
-rw-r--r-- 1 root wheel 163684 Nov 3 10:23 sctp_indata.c
-rw-r--r-- 1 root wheel 3965 Nov 3 10:23 sctp_indata.h
-rw-r--r-- 1 root wheel 140398 Nov 4 03:19 sctp_input.c
-rw-r--r-- 1 root wheel 2301 Nov 3 10:23 sctp_input.h
-rw-r--r-- 1 root wheel 12179 Nov 3 12:21 sctp_lock_bsd.h
-rw-r--r-- 1 root wheel 2474 Nov 3 12:21 sctp_os.h
-rw-r--r-- 1 root wheel 2882 Nov 3 12:21 sctp_os_bsd.h
-rw-r--r-- 1 root wheel 261210 Nov 3 10:23 sctp_output.c
-rw-r--r-- 1 root wheel 5216 Nov 3 10:23 sctp_output.h
-rw-r--r-- 1 root wheel 149450 Nov 4 00:39 sctp_pcb.c
-rw-r--r-- 1 root wheel 15352 Nov 3 10:23 sctp_pcb.h
-rw-r--r-- 1 root wheel 7221 Nov 3 10:23 sctp_peeloff.c
-rw-r--r-- 1 root wheel 2158 Nov 3 10:23 sctp_peeloff.h
-rw-r--r-- 1 root wheel 28138 Nov 3 10:23 sctp_structs.h
-rw-r--r-- 1 root wheel 48751 Nov 4 03:19 sctp_timer.c
-rw-r--r-- 1 root wheel 3311 Nov 3 10:23 sctp_timer.h
-rw-r--r-- 1 root wheel 25951 Nov 3 10:23 sctp_uio.h
-rw-r--r-- 1 root wheel 128287 Nov 3 18:04 sctp_usrreq.c
-rw-r--r-- 1 root wheel 15869 Nov 3 10:23 sctp_var.h
-rw-r--r-- 1 root wheel 146141 Nov 3 18:04 sctputil.c
-rw-r--r-- 1 root wheel 9301 Nov 3 10:23 sctputil.h
However, the GENERIC kernel does not contain support for SCTP. It must be compiled in, which I did using the following method (based on my earlier post).
freebsd70snap# pwd
freebsd70snap# cat SCTP
include GENERIC
options SCTP
freebsd70snap# cd /usr/src
freebsd70snap# make buildkernel KERNCONF=SCTP INSTKERNNAME=SCTP
freebsd70snap# make installkernel KERNCONF=SCTP INSTKERNNAME=SCTP
freebsd70snap# echo "kernel=SCTP" > /boot/loader.conf
freebsd70snap# cat /boot/loader.conf
freebsd70snap# reboot
After reboot the new kernel was running.
$ uname -a
FreeBSD freebsd70snap.taosecurity.com 7.0-CURRENT-200611
FreeBSD 7.0-CURRENT-200611 #0: Tue Nov 28 22:09:44 EST 2006
firstname.lastname@example.com:/usr/obj/usr/src/sys/SCTP i386
The next step is to try to get something working with SCTP. More on that later, hopefully!
Friday, November 24, 2006
Digital Security Lessons from Ice Hockey
It occurred to me today that we are witnessing the sort of change that happened to the National Hockey League in the late 1960s and early 1970s. During that time the player pictured at left, Bobby Orr, changed the game of ice hockey forever. For those of you unfamiliar with hockey, teams field six players: one goalie, who guards the net; two defensemen, who try to stop opposing players; and three forwards (one center and two wings), who try to score goals.
Prior to Orr, defensemen almost never took offensive roles. (Forwards didn't pay much attention to defense, either. Only in 1978 did the Selke Trophy, for best defensive forward, start being awarded.) When Orr began playing, he wasn't satisfied to control the puck in his defensive end and then hand it off to one of his forwards. He jumped into the play, sometimes carrying the puck end-to-end, finishing by scoring himself. Twice in his ten year career he even lead the league in scoring -- scoring more goals than forwards. He didn't neglect his defensive duties, either. He was named league best defensement eight years straight.
What does this mean for digital security? It's easy to identify the forwards in our game. They discover and write exploits. Some of them can play defense, while others cannot. Many of us are traditional defensemen. We know how to impede the opposing team, and we know enough offense to understand how the enemy forwards operate. A few of us are goalies. Aside from clearing the zone or maybe making a solid pass to a forward, goalies have near-zero ability to score goals. (Yes, I remember Ron Hextall.) That's the nature of their position -- they can't skate to the other end of the ice!
Anyone who plays a sport will probably recognize the term "well-rounded." Being well-rounded means knowledge and capability in offense and defense. I think it applies very well to ice hockey and basketball, less so to soccer, somewhat well to baseball, and not at all to football. I see well-roundedness as the proper trait for the general security practitioner, i.e., the sort of person who expects to work in a variety of roles during a career. This is the ice hockey model.
I do not recommend following what might be called the [American] football model. Football players are exceptionally specialized and usually ineffective when told to play out of position. (Could you imagine the kicker playing on the defensive line, or the center as a wide receiver?)
Returning to the hockey model, remember that there are three positions, with varying degrees of offensive and defensive responsibilities. Goalies focus almost exclusively on defense, but they try to make smart plays that lead to break-outs. Defensemen concentrate on defense but should contribute offensively where possible. Forwards concentrate on offense, but help the defensemen as well. How does this model apply to my position in digital security? I consider myself a defenseman, but I'm trying to develop my offensive skills. (At the very least, better knowledge of offensive tools and techniques helps me better defend against them.) I have no interest in being a goalie. Being a forward would be exciting, but I'm not sure I'll have an opportunity or job responsibility to fully develop those skills.
I suppose it's even possible to become a coach or trainer (like skating guru Laura Stamm). You don't have to actually play the game, but you quickly become irrelevant if you lose touch with the game.
Does the extreme specialization of the football model apply? I think it may for large consultancies (or perhaps for the security market as a whole). In a large consultancy, you can be the "Web app guy" or the "incident response gal" and make a living. Outside of that environment, perhaps at a general security job for a company, you're expected to be good at almost everything.
I've written before that it's unreasonable to be good at everything, despite the unrealistic desire of CIOs to hire so-called "multitalented specialists." I recommend choosing to be a goalie, defenseman, forward, or coach/trainer. Be solid in your core responsibilities, but remember Bobby Orr's example.
How do you fit into my hockey model?
Another Prereview
Books on how to break software in order to make it better seem to be the hottest titles on the market. This is exactly the sort of book I would expect most vendors to dislike, although titles like Hunting Security Bugs, published by shows some vendors realize that if they don't test their software first, some attacker in Bucharest will do it for them.
Wednesday, November 22, 2006
Three Seven-Book Lists for Novice, Intermediate, Advanced Readers
For the civilians out there, that's novice, intermediate, and advanced. :) I listed seven books for each category to keep things manageable. One of the problems I encountered with the advanced list, especially, is that coding becomes a big part of the equation when one starts to consider "advanced" topics. I tried including "placeholder" books to give you the idea that you need coding background to make good use of a book like Unix Network Programming, Volume 1: The Sockets Networking API, 3rd Ed.
Please let me know if you find these lists helpful. Please remember that reading these 21 books in order will not take you from newbie to guru. Rather, these are books I think will help at each stage of your progression. I am also not claiming to be a guru by having selected seven advanced books. For example, I need to get more acquainted with coding in order to branch out into other areas of digital security.
Pre-reviews and Comments
The Linux book describes Red Hat Enterprise, Fedora Core, SuSE, Debian, and Ubuntu. If the book covered Slackware and Gentoo instead of SuSE, I think it would have been perfect. I'm guessing RHEL is close enough to Fedora, and Debian to Ubuntu, to allow extra coverage of more diverging distros like Slackware and Gentoo? I plan to use this book as a reference, but I don't plan to read and review it. I suggest you buy it if you're looking for a comprehensive Linux reference that doesn't waste time with installation screenshots or descriptions of how to use KDE and Gnome. Another book I like but which I don't plan to read is Network Security Tools by Nitesh Dhanjani and Justin Clarke. This is an older book (April 2005), but I only recently rediscovered it. This book reminds me of
Building Open Source Network Security Tools by Mike Schiffman, which I liked. NST describes how to write Nessus and Nikto plug-ins, dissectors and plug-ins for Ettercap, and how to extend Hydra and Nmap. There's a chapter on Metasploit, but it is somewhat overtaken by events because the 3.x framework uses Ruby instead of Perl. NST also explains how to extend PMD, how to build your own Web, SQL, and exploit scanner, and how to write tools with Libpcap (0.8.3) and Libnet (184.108.40.206).
NST is a great book, but it requires a good knowledge of C and a desire to work with these tools in a development capability. I don't possess the requisite coding skills, but I may turn to this book in the future if I want to learn more about extending these tools. Next is Network Security Hacks, 2nd Ed by Andrew Lockhart. I liked the 1st Ed which I read and reviewed in June 2004. Since I see my review of the 1st Ed on the Amazon.com page for the 2nd Ed, I won't be able to submit a review for this book. The 2nd Ed looks about 50% longer than the 1st Ed.
I was also pleased to see the discussion of Sguil had been updated for Sguil 0.6.1. However, Sguil's integration of SANCP for session data collection was ignored. After being a Sguil advocate for almost four years, writing books and articles (some of which are freely available), I am puzzled that some people who choose to write about Sguil still don't grasp the significance of the data we collect. This recent Daily Dave thread was depressing. People really collect full content data in production on busy networks? Shocking! The first book in this post that I plan to read and review is The Art of Software Security Testing: Identifying Software Security Flaws by Chris Wysopal, Lucas Nelson, Dino Dai Zovi, and Elfriede Dustin. This book is less than 300 pages but it looks very interesting. I plan to review it with a set of books on finding bugs and vulnerabilities. It's encouraging to see these sorts of titles appearing, written for software developers and not for hacker wanna-bees. The next book is WarDriving and Wireless Penetration Testing by Chris Hurley and friends. This is another team-written book, which tend to scare me when published by Syngress. I wasn't too impressed by the earlier WarDriving book (reviewed here), but I plan to give this new one a try. I'm really looking forward to Wi-Foo II next year. The last book is Network Security Assessment by Steve Manzuik and friends. This is another "team book," but it looks good. I'm surprised anyone is talking about vulnerability management these days. That's so 2002! (Please recognize I'm joking.)
Remember, you can see books that I'm waiting to acquire by checking my Amazon.com Wish List. If you're a publisher, please keep in mind I restrict my reading to books on that list. Under extraordinary circumstances I might read something else, but I generally focus on books that address a specific interest. Thank you.
Tuesday, November 21, 2006
No Shortcuts to Security Knowledge
I cannot afford nor have the time to take a full collage course on the topic of network security but I would like to be as knowlageable about it as yourself and be able to protect my computer and others regarding this matter. If I was willing to pay you would you take the time to teach me what you know and/or point me in the direction I would need to learn what you know about network security? Please advise what course I would need to take to accomplish your skill of network security?
In my opinion, it seems like this question seeks to learn some sort of "hidden truth" that I might possess, and acquire it in record time. The reality is that there are really no shortcuts to learning as complex a topic as digital security. I have been professionally involved with this topic for almost ten years, yet I consider myself halfway to the level of skill and proficiency I would prefer to possess. In another ten years I'll probably still be halfway there, since the threats and vulnerabilities and assets will have continued to evolve!
If you want to "know what I know," a good place to start is by reading one or more of my books. I recommend starting with Tao, then continuing with Extrusion and finishing with Forensics. Chapter 13 from Tao explicitly addresses the issue of security analyst training and development.
My company research page lists over a dozen documents I've written, and this blog is a record of almost four years of thoughts on digital security.
For books outside of my own, my top ten books of the last ten years contains some of the best books on digital security. My reading page shows books I recommend in five categories. I also show the books waiting to be read on my shelf, but I wouldn't consider an appearance there to be an endorsement unless I offer a favorable Amazon.com review. Please note my recommended lists do not include books from 2006 (and maybe 2005), but I plan to write a "best of" list at the end of this year. I'll update the recommendations lists if I have time.
In addition to reading, I highly recommend becoming familiar with the majority of the security tools listed by Fyodor. It also helps to specialize (at least in the beginning) in one of the five categories I show on my reading page.
I tend to split my time between Weapons and Tactics and Telecommunications, although I plan to continue developing my Scripting and Programming skills. I do some System Administration by building and operating network sensors and supporting systems (like databases), but I am not the sort of sys admin who supports users. I try to stay out of devoted Management and Policy work, although I try not to be ignorant.
I could probably say a lot more on this topic, but the bottom line is that there are no shortcuts to security knowledge. I hope this free post has been helpful.
Monday, November 20, 2006
Security, A Human Problem
This comment in the accompanying Slashdot post explains that it's possible for a rogue user to exploit vulnerabilities in Second Life and introduce code that peforms a sort of denial of service attack on the game. The attack occurs when game participants decide to interact with the gold rings shown in the thumbnail from this site. It's similar to human penetration testers leaving USB tokens or CD-ROMs at a physical world place of business and waiting for unsuspecting employees to see what's on them.
This story illustrates two points. First, it demonstrates that client-side attacks remain a human problem and less of a technical problem. Second, I expect at some point these virtual worlds will need security consultants, just like the physical world. I wonder if someone could write a countermeasure at the individual player level for these sorts of attacks?
Update: Here's a YouTube video.
Friday, November 17, 2006
Further Thoughts on SANS Top 20
One comment I'm hearing is that the latest Top 20 isn't "just opinion." Let's blast that idea out of the water. Sorry if my "cranky hat" is on and I sound like Marcus Ranum today, but Marcus would probably agree with me.
First, I had no idea the latest "Top 20" was going to be called the "SANS Top-20 Internet Security Attack Targets" until I saw it posted on the Web. If that isn't a sign that the entire process was arbitrary, I don't know what is. How can anyone decide what to include in a document if the focus of the document isn't determined until the end?
Second, I love this comment:
Worse still, Richard misses the forest completely when he says that "… it's called an 'attack targets' document, since there's nothing inherently 'vulnerable' about …". It doesn't really matter if it's a weakness, action item, vulnerability or attack. If it's something you should know about, it belongs in there. Like phishing, like webappsec, and so on. Don't play semantics when people are at risk. That's the job of cigarette and oil companies.
This shows me the latest Top 20 is just a "bad stuff" document. I can generate my own bad stuff list.
Top 5 Bad Things You Should Worry About
- Global warming
- Lung cancer
- Terrorists
- Not wearing seat belts
- Fair skin on sunny days
I'm not trying to make a point using a silly case. There's a real thought here. How many of these are threats? How many are vulnerabilities? (Is the difference explicit?) How many can you influence? How many are outside your control? How did they end up on this list? Does the ranking make any difference? Can we compare this list in 2006 with a future list in 2007?
Consider the last point for a minute. If the SANS Top 20 were metric-based, and consisted of a consistent class of items (say vulnerabilities), it might be possible to compare the lists from year to year. You might be able to delve deeper and learn that a class of vulnerabilities has slipped or disappeared from the list because developers are producing better code, or admins are configuring products better, or perhaps threats are exploiting other vectors.
With these insights, we could shift effort and resources away from ineffective methods and focus our attention on tools or techniques that work. Instead, we're given a list of 20 categories of "something you should know about." How is that actionable? Is anyone going to make any decisions based on what's in the Top 20? I doubt it.
Third, I'm sure many of you will contact me to say "don't complain, do something better." Well, people already are. If you want to read something valuable, pay attention to the Symantec Internet Threat Report. I am hardly a Symantec stooge; I like their approach.
I will point out that OWASP is trying to work in the right direction, but their single category ("Web Applications") is one of 20 items on the SANS list.
I realize everyone is trying to do something for the good of the community. Everyone is a volunteer. My issue is that the proper focus and rigor would result in a document with far more value.
Thursday, November 16, 2006
Another Reason for Privileged User Monitoring
Stevan Hoffacker, formerly director of IT and VP of technology for Source Media, was arrested at his home yesterday on charges of breaking into the email system that he once managed.
According to the FBI and the U.S. Attorney for the Southern District of New York, Hoffacker hacked into his former company's messaging server, eavesdropped on top executives' emails about employees' job status, and then warned the employees that they were about to lose their positions.
I doubt there's any real "hacking" involved here. Hoffacker probably retained access or leveraged knowledge of configuration errors to access these systems.
The FBI did not say exactly how Hoffacker broke into the mail system, but it noted that the former IT exec had access to the passwords for the email accounts of other Source Media employees.
Of course, if Hoffacker was an "ex-IT chief," he wasn't a "true insider." He was an "ex-insider," who should have had all of the (hopefully) nonexistent access granted to an outsider. True, he had knowledge of the systems not possessed by the typical outsider, but just because I created systems for previous employers doesn't mean I can waltz onto their networks now.
Although I am bringing up the "inside threat" again, please don't forget that you probably have external intruders from all over the globe inside your organization now. While privileged user monitoring and insider threat deterrence, detection, and ejection are important, keep in mind the parties who are already abusing your corporate assets.
Bejtlich on Tenable Webinar Friday 10 AM EST
Bejtlich Amazon Book Review RSS Feed
I have a stack of books about exploit development and security tools that I hope to review as a group before the end of the year. I'm currently at 52 books reviewed for the year, and adding those 7 would make 59. I have several books on miscellaneous topics waiting as well, so we might see 60 reviews or more by year's end.
Now it would be cool to see Amazon.com publish RSS feeds for reviews of specific books, so I could keep track of customer feedback on titles of interest.
Update: It looks like you can also subscribe to lists like my Wish List, which is cool.
Common Security Mistakes
- Failure to maintain a complete physical asset inventory
- Failure to maintain a complete logical connectivity and data flow diagram
- Failure to maintain a complete digital asset/intellectual property inventory
- Failure to maintain digital situational awareness
- Failure to prepare for incidents
The first three items revolve around knowing your environment. If you don't know what houses your data (item 1), how that data is transported (item 2), and what data you are trying to protect (item 3), you have little chance of success.
Once you know your environment, you should learn who is trying to exploit your vulnerabilities to steal, corrupt, or deny access to your data (item 4). Security incidents will occur, so you should have policies, tools, techniques, and trained and exercised personnel ready to respond (item 5).
Wednesday, November 15, 2006
Five Blog Posts You Should Read
- Playing for Keeps Across the Board
- Andre Durand -- Firewall This
- Information Security Must Evolve
- Data Protection -- It's More Than A + B + C
- Team Evil: Incident 2
The first four are more conceptual, dealing with the need to collapse security measures around data instead of hosts. The fifth is a report of an incident with some decent details.
Comments on SANS Top 20
First let me say that project lead Rohit Dhamankar did a good job considering the nature of the task. He even made a last-minute effort to solicit my feedback, and some of my comments altered the categories you now see in the Top 20. I thank him for that.
As far as the nature of the list goes, it's important to realize that it's based on a bunch of people's opinions. There is no analysis of past vulnerability trends or conclusions based on real data, like the Vulnerability Type Distribution I mentioned earlier. At the point where I realized people were just going to write up their thoughts on various problems (Internet Explorer, Mac OS X, etc.) I left the project. Rohit emailed me early this week, but I was formally done in early October.
If you think a bunch of people's opinions is worthwhile, then you may find the Top 20 useful. I think the majority of the Top 20's utility, such as it is, derives from name recognition. If that can help influence your organization's management, then I guess it is helpful.
At the very least, the newest Top 20 is a very informative document with plenty of references. I would expect most security practitioners to understand or at least recognize everything on the list. I don't think the list is as "actionable" as the original Top 10, which listed specific vulnerabilities (e.g., "RDS security hole in IIS," CVE-1999-1011) that you needed to patch now.
The latest Top 20 has hundreds of CVE entries, and as such is more of a meta-description of Internet targets. In that respect I like the fact it's called an "attack targets" document, since there's nothing inherently "vulnerable" about, say, Mac OS X. Instead, Mac OS X is being attacked.
What do you think of the new list?
Friday, November 10, 2006
SCTP and OpenBSM in FreeBSD
Second, Federico Biancuzzi conducted an excellent interview with Robert Watson regarding OpenBSM and FreeBSD. This is incorporated into the upcoming FreeBSD 6.2, which I expect to see in early December.
Thursday, November 09, 2006
Gvinum on FreeBSD
I wanted to take two separate partitions, /nsm1 on one disk and /nsm2 on a second disk, and make them look like a single /nsm partition. I had already been using /nsm1, but I was prepared to lose that data since it was only for test purposes thus far. This is what the df command produced.
cel433:/root# df -m
Filesystem 1M-blocks Used Avail Capacity Mounted on
/dev/ad0s1a 495 36 419 8% /
devfs 0 0 0 100% /dev
/dev/ad0s1f 989 0 910 0% /home
/dev/ad0s1h 10553 8655 1053 89% /nsm1
/dev/ad1s1d 18491 0 17012 0% /nsm2
/dev/ad0s1g 989 25 884 3% /tmp
/dev/ad0s1d 1978 328 1492 18% /usr
/dev/ad0s1e 2973 25 2710 1% /var
Here's bsdlabel output.
cel433:/root# bsdlabel /dev/ad0s1
# /dev/ad0s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
a: 1048576 0 4.2BSD 2048 16384 8
b: 1048576 1048576 swap
c: 39102273 0 unused 0 0 # "raw" part, don't edit
d: 4194304 2097152 4.2BSD 2048 16384 28552
e: 6291456 6291456 4.2BSD 2048 16384 28552
f: 2097152 12582912 4.2BSD 2048 16384 28552
g: 2097152 14680064 4.2BSD 2048 16384 28552
h: 22325057 16777216 4.2BSD 2048 16384 28552
cel433:/root# bsdlabel /dev/ad1s1
# /dev/ad1s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
c: 39102273 0 unused 0 0 # "raw" part, don't edit
d: 39102273 0 4.2BSD 2048 16384 28552
So, I need to combine /dev/ad0s1h and /dev/ad1s1d into one bigger virtual disk.
First I unmounted both /nsm1 and /nsm2 were not mounted. Next I edited the bsdlabel using 'bsdlabel -e'. These were the results.
cel433:/root# bsdlabel /dev/ad0s1
# /dev/ad0s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
a: 1048576 0 4.2BSD 2048 16384 8
b: 1048576 1048576 swap
c: 39102273 0 unused 0 0 # "raw" part, don't edit
d: 4194304 2097152 4.2BSD 2048 16384 28552
e: 6291456 6291456 4.2BSD 2048 16384 28552
f: 2097152 12582912 4.2BSD 2048 16384 28552
g: 2097152 14680064 4.2BSD 2048 16384 28552
h: 22325057 16777216 vinum
cel433:/root# bsdlabel /dev/ad1s1
# /dev/ad1s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
c: 39102273 0 unused 0 0 # "raw" part, don't edit
d: 39102273 0 vinum
That's an example where you use the term 'vinum' even though the implementation is Gvinum.
Then I created /etc/gvinum.conf which described that I wanted to create one big /nsm drive. I used the drive size numbers from the df -m command showed earlier.
cel433:/root# cat /etc/gvinum.conf
drive drive1 device /dev/ad0s1h
drive drive2 device /dev/ad1s1d
volume nsm
plex org concat
sd length 10553m drive drive1
sd length 18491m drive drive2
Now I loaded the Gvinum kernel module and invoked gvinum:
cel433:/root# kldload geom_vinum
cel433:/root# kldstat
Id Refs Address Size Name
1 4 0xc0400000 691a48 kernel
2 1 0xc0a92000 58554 acpi.ko
3 1 0xc1d2c000 10000 geom_vinum.ko
cel433:/root# gvinum create /etc/gvinum.conf
2 drives:
D drive2 State: up /dev/ad1s1 A: 601/19092 MB (3%)
D drive1 State: up /dev/ad0s1h A: 347/10900 MB (3%)
1 volume:
V nsm State: up Plexes: 1 Size: 28 GB
1 plex:
P nsm.p0 C State: up Subdisks: 2 Size: 28 GB
2 subdisks:
S nsm.p0.s1 State: up D: drive2 Size: 18 GB
S nsm.p0.s0 State: up D: drive1 Size: 10 GB
That's good news. Time to prepare /dev/gvinum/nsm for data.
cel433:/root# newfs /dev/gvinum/nsm
/dev/gvinum/nsm: 29044.0MB (59482112 sectors) block size 16384, fragment size 2048
using 159 cylinder groups of 183.77MB, 11761 blks, 23552 inodes.
super-block backups (for fsck -b #) at:
160, 376512, 752864, 1129216, 1505568, 1881920, 2258272, 2634624, 3010976,
3387328, 3763680, 4140032, 4516384, 4892736, 5269088, 5645440, 6021792,
6398144, 6774496, 7150848, 7527200, 7903552, 8279904, 8656256, 9032608,
9408960, 9785312, 10161664, 10538016, 10914368, 11290720, 11667072, 12043424,
Finally I created a /nsm mount point and mounted the new drive.
cel433:/root# mkdir /nsm
cel433:/root# mount /dev/gvinum/nsm /nsm
cel433:/root# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 496M 36M 420M 8% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/ad0s1f 989M 74K 910M 0% /home
/dev/ad0s1g 989M 26M 885M 3% /tmp
/dev/ad0s1d 1.9G 328M 1.5G 18% /usr
/dev/ad0s1e 2.9G 25M 2.6G 1% /var
/dev/gvinum/nsm 27G 4.0K 25G 0% /nsm
To enable Gvinum at boot, I added the following to /boot/loader.conf:
I also added this entry to /etc/fstab:
/dev/gvinum/nsm /nsm ufs rw 2 2
Unfortunately, after a reboot, I had problems with the new /nsm:
Nov 9 15:52:38 cel433 kernel: GEOM_VINUM: subdisk nsm.p0.s1 state change: down
-> stale
Nov 9 15:52:38 cel433 kernel: GEOM_VINUM: subdisk nsm.p0.s0 state change: down
-> stale
Nov 9 15:52:47 cel433 kernel: g_vfs_done():gvinum/nsm[READ(offset=65536, length
=8192)]error = 6
Nov 9 15:52:56 cel433 kernel: g_vfs_done():gvinum/nsm[READ(offset=65536, length
=8192)]error = 6
When I tried to mount /nsm I got this error:
mount: /dev/gvinum/nsm: Device not configured
Gvinum didn't look happy:
cel433:/root# gvinum list
2 drives:
D drive1 State: up /dev/ad0s1h A: 347/10900 MB (3%)
D drive2 State: up /dev/ad1s1 A: 601/19092 MB (3%)
1 volume:
V nsm State: down Plexes: 1 Size: 28 GB
1 plex:
P nsm.p0 C State: down Subdisks: 2 Size: 28 GB
2 subdisks:
S nsm.p0.s0 State: stale D: drive1 Size: 10 GB
S nsm.p0.s1 State: stale D: drive2 Size: 18 GB
Thankfully I found this post which solved the problem.
cel433:/root# gvinum start nsm
2 drives:
D drive1 State: up /dev/ad0s1h A: 347/10900 MB (3%)
D drive2 State: up /dev/ad1s1 A: 601/19092 MB (3%)
1 volume:
V nsm State: up Plexes: 1 Size: 28 GB
1 plex:
P nsm.p0 C State: up Subdisks: 2 Size: 28 GB
2 subdisks:
S nsm.p0.s0 State: up D: drive1 Size: 10 GB
S nsm.p0.s1 State: up D: drive2 Size: 18 GB
Then I was able to access /nsm:
cel433:/root# mount /nsm
cel433:/root# ls -al /nsm
total 6
drwxr-xr-x 3 root wheel 512 Nov 9 15:28 .
drwxr-xr-x 23 root wheel 512 Nov 9 15:29 ..
drwxrwxr-x 2 root operator 512 Nov 9 15:28 .snap
cel433:/root# df -h /nsm
Filesystem Size Used Avail Capacity Mounted on
/dev/gvinum/nsm 27G 4.0K 25G 0% /nsm
This process survived a reboot, so I am all set now.
Tuesday, November 07, 2006
ISSA NoVA Meeting Next Thursday
Unfortunately a new NoVA Snort Users Group decided to ignore this meeting of 100+ security practitioners by scheduling their first meeting at exactly the same time. Hopefully future NoVA SUG meetings will take a look at their surroundings before scheduling future events or at least respond to posts about their group.
Who Needs CISSP for Ethics?
The primary goal of the Information Systems Security Association, Inc. (ISSA) is to promote practices that will ensure the confidentiality, integrity, and availability of organizational information resources. To achieve this goal, members of the Association must reflect the highest standards of ethical conduct. Therefore, ISSA has established the following Code of Ethics and requires its observance as a prerequisite for continued membership and affiliation with the Association.
As an applicant for membership and as a member of ISSA, I have in the past and will in the future:
* Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;
* Promote generally accepted information security current best practices and standards;
* Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;
* Discharge professional responsibilities with diligence and honesty;
* Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and
* Not intentionally injure or impugn the professional reputation of practice of colleagues, clients, or employers.
Please check the box indicating you have read the above statement and agree to its principles:
It looks to me like ISSA has the ethics bases covered. If I agree to that statement, I get as much value as being a CISSP as far as ethics goes.
Unfortunately, misdirected efforts like DoD 8570.1 attach significance to the CISSP out of all proportion to its worth.
Registration Deadlines for TaoSecurity Training
- For Enterprise Network Instrumentation at SANS CDI East 2006 on 14-15 Dec 06 in Washington, DC, the discounted registration ends tomorrow, 8 Nov 06.
- For Network Security Monitoring with Open Source Tools at USENIX LISA 2006, on 8 Dec 06, discounted registration ends Friday 10 Nov 06.
- For TCP/IP Weapons School days one and two at USENIX LISA 2006, on 3-4 Dec 06, discounted registration ends Friday 10 Nov 06.
- For TCP/IP Weapons School days three and four, on 9-10 Dec 06, held at the same hotel as USENIX LISA but conducted separately by me, return this form (.pdf) by Friday 10 Nov 06 for discounted rates. This flyer (.pdf) explains the course as well.
Thank you. If you have any questions email training [at] taosecurity [dot] com.
Bejtlich Cited in Sourcefire IPO Story
The infrastructure to support Snort isn't cheap and Sourcefire isn't flush with cash, said Richard Bejtlich, founder of the Washington, D.C.-based consultancy Tao Security. "The money to keep Snort thriving has to come from somewhere, and an IPO could give Snort more legs," he said.
I based this thought on the following from Sourcefire's S-1, listed under Risks Related to Our Business:
We have incurred operating losses each year since our inception in 2001. Our net loss was approximately $10.5 million for the year ended December 31, 2004, $5.5 million for the year ended December 31, 2005 and $2.9 million for the nine months ended September 30, 2006. Our accumulated deficit as of September 30, 2006 is approximately $40.3 million.
It looks like Sourcefire's losses are narrowing, which points to future profitability. My point is that development of Snort and associated software (RNA, etc.) takes significant resources. While it might not be that difficult to fork Snort and maintain its code base, adding significant features and developing complex rules would be extremely tough for a noncommercial enterprise to sustain.
When Laws Aren't Enough
Complacency, it seems, abounds. A large proportion of security execs admitted they're not in compliance with regulations that specifically dictate security measures their organization must undertake or risk stiff sanctions, up to and including prison time for executives. Some of these regulations—such as California's security breach law, the Health Insurance Portability and Accountability Act (HIPAA), and non-U.S. laws such as the European Union Data Privacy Directive—have been around for years. ..
The information security discipline still suffers from the fundamental problem of making a business value case for security. Security is still viewed and calculated as a cost, not as something that could add strategic value and therefore translate into revenue or even savings. (emphasis added)
No one spends money on insurance because it "adds strategic value." At best security spending can produce "savings," i.e. avoid losses.
Perhaps the problem is ignorant management?
From 2003 to 2005, the percentage of survey respondents saying they had fewer than 10 negative information security incidents in the past year remained steady. But this year, we included the option to answer that you do not know how many negative security incidents occurred. This year, nearly one-third of respondents admitted that they do not know how many breaches or unauthorized access events occurred within their organizations.
To a certain extent, that's understandable. Attacks can be hard to identify, and networks can be extensive. What's less comprehensible is that a significant portion of respondents said they have not installed some of the most rudimentary network safeguards. Only one-third of respondents have put in place patch management tools or monitor user activity. Less than half use intrusion detection software or monitor log files (the two best methods organizations can employ to detect breaches) and even fewer use intrusion prevention tools. Surprisingly, more than 20 percent of respondents don't even have a network firewall.
Let's assume these managers are not being brutally honest, i.e., they are not recognizing that it can be impossible to know of every incident. Instead, I assume they are admitting they just don't have the tools and tactices to measure incidents. That's disappointing.
There is some hope in certain industries.
Companies in the financial services sector—banks, insurance companies, investment firms—are more likely to employ a CSO than other industries. Security budgets in the financial sector are typically a bigger slice of the IT budget as a whole and increase at a faster rate than in other sectors. That may be because financial services companies are more likely to link security policies and spending to business processes. These companies are proactive, instituting formal information security processes such as log file monitoring and periodic penetration tests. More of their employees follow company security policies. Not surprising, financial services companies also have deployed more information security technology gadgets, such as intrusion detection and encryption tools, and identity management solutions.
It's obvious, therefore, that financial services organizations are far more likely—almost twice as likely, in fact—to have an overall strategic security plan in place. Consequently, they reported fewer financial losses, less network downtime and fewer incidents of stolen private information than any other vertical.
The reason for all this is also obvious. The product in the financial services industry is money, and money is the prime target of cybercriminals, including organized crime, insiders and even terrorists. Protecting the money is the industry's most critical concern. The past few years have seen a sharp increase in cybercrime (phishing, identity theft, extortion and spyware, to name a few). Anytime a security executive can demonstrate to top executives that investing in security can protect and increase shareholder value, he will be more likely to convince the boardroom to make that investment and make security a strategic part of the organization.
Financial services companies are more likely than enterprises in other industries to use ROI to measure the effectiveness of security investments (29 percent versus an average of 25 percent), and they also are more likely to use potential impact on revenue to justify investments (36 percent versus an average of 27 percent). These arguments work. More financial services companies saw a double-digit increase in their 2006 security budgets than those in any other sector.
Regulation plays a part too. The financial industry must adhere to the most stringent information security laws, and therefore it leads other industries in following proven, strategic information security practices.
I'd like to provide a slightly different interpretation. Financial services companies are used to dealing with threats as well as protecting assets. Everyone has assets to protect, but not until recently has everyone been within the reach of threats. Your risk is zero if you face no threats, no matter how vulnerable you are or how important your assets.
Sunday, November 05, 2006
Review of Hack the Stack
I teach a course called "TCP/IP Weapons School" that involves walking students up the OSI model. We look at network traces generated by tools and techniques to defeat security measures. When I saw "Hack the Stack" (HTS) I thought it might make a good resource for my class, since HTS seemed to advocate a similar approach. Unfortunately, technical errors, shoddy production, internal repetition and poor organization, and a lack of original material make me question the value of HTS...
Overall, I think there is room for a book like HTS. It's too bad this one did not deliver what I was expecting. I do appreciate the authors citing my network security monitoring methodology on p 232.
Friday, November 03, 2006
Real Insider Threats
Roles should be narrowly defined so that a single role does not have permission for many different functions, at least not without secure traceability.
The CTO of a Fortune 100 financial services company once bragged to me over dinner that if he wanted to, he had the ability to secretly divert a billion dollars from his firm, erase all traces of his actions, and disappear before it was discovered.
Clearly, the principles of separation of duties and compartmentalization were not being practiced within his organization.
Now I read the following in VARBusiness:
Federal law enforcement officials Tuesday arrested the well-known CEO of White Plains, N.Y.-based MSP provider Compulinx on charges of stealing the identities of his employees in order to secure fraudulent loans, lines of credit and credit cards, according to an eight-count indictment unsealed by the U.S. Attorney's office in White Plains.
Terrence D. Chalk, 44, of White Plains was arraigned in federal court in White Plains, along with his nephew, Damon T. Chalk, 35, after an FBI investigation turned up the curious lending and spending habits. The pair are charged with submitting some $1 million worth of credit applications using the names and personal information -- names, addresses and social security numbers -- of some of Compulinx's 50 employees...
Terrence Chalk is also charged with racking up more than $100,000 in unauthorized credit card charges. If convicted, he faces 165 years in prison and $5.5 million in fines, prosecutors say. Damon faces a maximum sentence of 35 years imprisonment and $1.25 million in fines.
These are exactly the problems I mentioned earlier. Both cases make me sick. In the former, the Fortune 100 CEO knew his organization was broken but he thought it was a joke. In the latter, someone in a position of authority abused his access and ruined the financials lives of his employees.
This is a great example of the need to implement proper corporate governance by not centralizing the roles of CEO, President, and Chairman of the Board in a single person. Furthermore, none of those people should have access to the data abused by Mr Chalk. That level of access should stop at the VP for Human Resources.
Obviously the smallest of companies (mine included) can't separate certain duties because there are too many roles for too few people! However, organizations with 100 or more employees should certainly be taking steps to limit the access all employees have -- including the CEO.
This includes system and security administrators. According to surveys like those conducted by Dark Reading, a certain percentage of those with privileged access are abusing their power.
I often hear that system administrators should be responsible for securing their systems. I believe that sys admins should configure their systems as securely as possible, but outside parties (auditors, independent security staffs) should be responsible for auditing system activity and ensuring operation in compliance with security policies.
At some point we will also be able to remove the ability of system administrators to access sensitive data, perhaps using role-based access control (RBAC). There is no need for a sys admin who maintains a platform housing Social Security numbers and the like to be able to read those records. It will not be popular for current sys admins to relinquish their "godlike" powers, but it will result in more secure operations. Sys admins are data custodians; they are not data owners.
Thursday, November 02, 2006
Air Force Cyberspace Command
It also appears the Air Force is centralizing control of network operations and security centers, according to this article:
All Air Force network operations security centers, which were previously decentralized among the major commands, will consolidate under the 67th with the stand-up of two integrated network operations and security centers, or I-NOSCs, located at Langley AFB, Va., and at Peterson AFB, Colo.
Apparently the former AFCERT, now the Air Force Network Operations and Security Center Network Security Division (AFNOSC NSD) in San Antonio, TX, is adding 191 MacAulay-Brown contractors.
For some higher level insights into these changes, the latest version of AFI 33-115v1: Network Operations (.pdf) might be interesting.
Returning to the creation of the new Cyberspace Command -- remember the Air Force was once part of the United States Army. I see no reason why the United States should maintain independent services that fight on land, sea, air, and space, but have cyber forces scattered throughout the other services. (You might make the counter-argument that each service maintains its own "air forces," but these support their parent service.)
I think within my lifetime we will see an independent Cyber Force to centralize information warfare capabilities alongside the Army, Navy, Air Force, and Marines. If it happens within the next 10 years, I think Col Greg Rattray might be in charge. (Yes, I'm assuming he continues to be promoted!) Before that happens, I'd like to see the new Cyberspace Command sponsor a new Air Force Specialty Code (AFSC) for information warriors. The current Intel or Comm paradigm isn't suitable.
Reviews of Six Software Security Books
Amazon.com just posted my six new reviews on books about software security. The first is Software Security by Gary McGraw. This was my favorite of the six because it was the most logically organized. Here is a link to the five star review.
The second is Security Development Lifecycle by Microsoft's Michael Howard and Steve Lipner. I thought it was neat to read about Microsoft's software development practices with respect to security. Just don't expect the CD-ROM training videos to keep you awake. Here is a link to the four star review.
The third is Writing Secure Code, 2nd Ed by Microsoft's Michael Howard and David LeBlanc. This is probably the definitive book on writing secure code for Windows, although the terminology gives me pains. Here is a link to the four star review.
The fourth is 19 Deadly Sins of Software Security by Michael Howard, David LeBlanc, and John Viega. This book is a stripped down version of other secure coding books, but it has some cool insights on topics like SSL. Here is a link to the four star review.
The fifth is High-Assurance Design by Cliff Berg. Java and object-oriented developers will like the second half of this book; I preferred the first half. Here is a link to the four star review.
The last book is Security Patterns by Markus Schumacher, et al. This book presents a framework that we might see more of in the future. Here is a link to the four star review.
All six reviews share this common introduction, since I read and reviewed them as a set:
I read six books on software security recently, namely "Writing Secure Code, 2nd Ed" by Michael Howard and David LeBlanc; "19 Deadly Sins of Software Security" by Michael Howard, David LeBlanc, and John Viega; "Software Security" by Gary McGraw; "The Security Development Lifecycle" by Michael Howard and Steve Lipner; "High-Assurance Design" by Cliff Berg; and "Security Patterns" by Markus Schumacher, et al. Each book takes a different approach to the software security problem, although the first two focus on coding bugs and flaws; the second two examine development processes; and the last two discuss practices or patterns for improved design and implementation. My favorite of the six is Gary McGraw's, thanks to his clear thinking and logical analysis. The other five are still noteworthy books. All six will contribute to the production of more security software.
Sometime this month I plan to review a set of books about vulnerability discovery and writing exploits. You'll see those titles on my reading list.


text:
REDMOND, WA – In their final road match of a five-game stretch away from home, Vancouver Whitecaps FC U-23 (4W-4L-1D) fell 2-0 in defeat to Washington Crossfire (2W-3L-1D) on Wednesday night in Redmond, Washington.
Midway through the first half, the first goal of the match came for the home side as a corner kick found Crossfire midfielder James Moberg. The University of Washington player made no mistake, slotting the ball past 'Caps goalkeeper Simon Thomas to give the American club a 1-0 lead.
Uncharacteristically, Whitecaps FC U-23 made several first half turnovers that led to chances for the Crossfire, but still the visiting 'Caps managed to stay in the match and head into the break down only a single goal.
Following a tough first half, the 'Caps came out hungry to find an equalizer and end their tough road stretch with a positive result. The second half showed a Vancouver side that were calm on the ball, with many passes connecting between them.
The improved possession from the Blue and White unfortunately did not lead to an equalizer though, and any momentum gained was lost when the 'Caps had a goal disallowed in the middle of the second half. On the play, Crossfire goalkeeper Spencer Richey was challenged and dropped the ball, allowing 'Caps striker Niall Cousens to fire a shot into the back of the net, but a foul was called on the play, preserving the advantage for the home team.
With less than 10 minutes to go, Washington sealed the win when a Justin Amundsen cross found midfielder Benjamin Fisk (not to be confused with Whitecaps FC U-23 player and Charleston Battery loanee Ben Fisk), who volleyed the ball past Thomas to make the score 2-0 in favour of the home side.
In the end, the Crossfire were able to hold onto their 2-0 lead to earn just their second win of the season - the other coming against first-place Portland Timbers U-23s.
After the match, head of high performance Stuart Neely expressed disappointment with his team's play.
"We couldn't string passes together and we weren't really ready," commented Neely to whitecapsfc.com. "Too many mistakes cost us and at the end of the day, we lost 2-0 in an important match."
Next up, the Whitecaps FC U-23 host Cascadia rivals Seattle Sounders FC U-23 on Friday, June 21 at UBC Thunderbird Stadium. Kickoff is set for 7 p.m. PT and admission is free to the public.
Scoring Summary:
22' - WAS – James Moberg
83' - WAS – Benjamin Fisk (Justin Amundsen)


text:
Since the development of the first chipper chains more than 50 years ago, OREGON® has been at the forefront of cutting systems technology. OREGON® has constantly brought new innovative products to the market incorporating the latest developments in cutting performance and safety, notably cutting chains featuring low kickback energies, reduced vibration, narrow kerf and enhanced lubrication features. OREGON® is truly a worldwide operation with plants in Portland, Oregon USA, Guelph, Ontario, Canada and Curitiba nr. São Paolo in Brazil and Distribution Centers in Tokyo-Japan, Moscow-Russia, Tewkesbury-United Kingdom, Tübingen-Germany, Lyon-France, Varberg-Sweden and Mont-Saint-Guibert/Courcelles-Belgium.
The company and its 2,000 employees are fully committed to total quality. The application of strategic product development and statistical process control coupled with advanced manufacturing and management techniques lies at the heart of our business. This ensures that one can have complete confidence in the products Oregon manufactures, knowing that their quality and reliability will exceed expectations and that they are quite simply the best that money can buy. Oregon is proud of the positive contribution to the world's forestry industry since those first trailblazing days in the 1940s. The company is committed to producing efficient, productive, innovative products as well as promoting sound environmental practices.


text:
En Kanmani 10-09-2019 – Polimer TV SerialCategory: Kanmani, Polimer TV Serials, Tamil TV Serials,
En Kanmani 10-09-2019 Polimer TV En Kanmani 10.09.2019 Tamil Serial Online | En Kanmani 10/09/2019 Polimer TV Serial 10th September 2019
Watch Polimer Tv En Kanmani 10.09.19 Serial En Kanmani 10/09/19 Latest Today Episode Online
Enkanmani 10-09-2019 – Polimer tv Serial | Polimer tv Enkanmani 10-09-19 | Polimer tv Serial 10th September 2019
Source 1
Source 2
En Kanmani, Polimer tv Serial
Polimer TV En Kanmani 10th September 2019 Episode Review/Discussion:
Synopsis: En Kanmani story revolves in and around the Kalpana (Kalpi) Jadhav (Rachana Parulkar) and Raghav Singhania (Aashish Chaudhary)and how their path crosses with each other in their journey of achieving their goals.
The simple lives and struggles of Kamala, who is expecting her second child, her husband, Vijay who is unemployed and their son, Prakash. Will their lives change for the better?
Directed By : Hemant Prabhu, Abhimanyu Chauhan
Produced By : Tony Singh, Deeya Singh
Written by : Damini Kanwal Shetty, Shilpa Choubey, Sushil Choubey, Dheeraj Sarna.
Editor(s) : Santosh Singh, Pradeep Singh
Cast : Asha Negi, Kunal Varma, Shilpa Shirodkar, Aashish Chaudhary, Rachana Parulkar, Mohit Dagga.


text:
Master's Programme in Decision Support and Risk Analysis - Programme Outline 50% study pace
You will find detailed course information, list of course literature, schedule and start date at Courses and timetables. Select semester in the drop-down menu and search by course name.
1st Semester
Mandatory courses 2 x 7,5 credits
Decision Support Methods 7,5 credits
The course aims to provide basic knowledge on decision support methods and decision analysis, ability to structure and evaluate decision problems and to analyse and evaluate different solutions.
Decision Theory 7,5 credits
In this course, the basic ingredients of a decision-theoretic approach to decision problems are presented. Moreover, the concepts of classical decision theory are introduced in some detail and various modern attempts at modifying the classical theory are discussed at some length. Here special emphasis is on presenting Super Soft Decision Theory which by and large has been developed at DSV.
2nd Semester
Mandatory courses 2 x 7,5 credits
Analysis of Bases for Decisions 7,5 credits
In this course some useful tools from the Theory of Argumentation are presented but the main focus is on applying these tools and the ones introduced in previous courses in detailed examinations of the bases for decisions made by political assemblies and authorities. The student here has the opportunity of selecting decisions that is of particular interest to her.
Logic 7,5 credits
Formal analysis can compensate for the usual ambiguity of normal human reasoning and uncertainties of the human cognition. Furthermore, it can increase the understanding of human communication and assist in avoiding many misunderstandings and misconceptions in real life situations and facilitate the analysis of argumentation and decision-making. This course is an introduction to the principles of correct reasoning as they are manifested in various uses of languages. The course focuses on formal logic and practical applications thereof with the purpose of getting a better capacity to understand many fallacies in reasoning and to practice deductive thinking. To be able to do this, some knowledge of formal languages and rules of deduction is inevitable.
3rd Semester
Mandatory courses 2 x 7,5 credits
Risk Management 7,5 credits
In this course probabilistic as well as non-probabilistic approaches to risk management are presented, and the rationale behind various types of risk analyses are discussed in some detail. The main focus, however, is on examining how the authorities of a modern society copes with risks within their domains. Here special emphasis is placed on financial risks and physical hazards.
Scientific Communication and Research Methodology 7,5 credits
Computing as a discipline combines three academic traditions: the theoretical tradition, the scientific (experimental) tradition, and the engineering tradition. Due to that combination, there is no clear methodological tradition in computer science. This course introduces computer science students to the principles of scientific research: how to design, implement, and report a research study. The main focus of this course is in research design and reporting: students will learn how to align problem statement, aims, objectives, research questions, data collection and analysis, and reporting into a coherent and logically flowing whole.
4th Semester
Mandatory courses 2 x 7,5 credits
Risk and Decision Analysis: Special Problems 7,5 credits
The course focuses on applications of risk and decision analytic methods in business and society. Formal risk analysis, uncertainty analysis, and the risk analytic aspects of decision-making under risk and multi-attribute utility theory are central parts of the course.
Business Analytics 7,5 credits
This course develops modelling skills for management contexts, e.g., finance, logistics, workforce scheduling, marketing, IT infrastructure and energy. Appropriate quantitative methods will be introduced with spreadsheet applications and case studies. The methods include linear and integer programming, network models, multi-period models, goal programming, simulation and project management.
5th Semester
Mandatory course 1 x 15 credits
Methodology of Decision Analysis with Advanced Applications 15 credits
The course focuses on a specific application of a decision support methodology in a domain selected by each student. During the course, the student will apply a modern method on a non-trivial decision problem and evaluate strengths, weaknesses and potential for further development of the method or how it can be applied.
6th Semester
Elective courses 2 x 7,5 credits from Eligible courses spring
You can take any of the courses from the course pool where you meet the eligibility requirements.
The following courses are recommended:
Decision Making and Business Intelligence 7,5 credits
Security and Privacy in e-Government: Systems, IT, Laws and Ethics 7,5 credits
7th Semester
Master Thesis in Computer and Systems Sciences 30 credits
8th Semester
Continuing Master Thesis in Computer and Systems Sciences 30 credits
Last updated:
September 24, 2019
Source: Administration of studies