text:
Name: Lilla
Gender: Female
Age: 27
Location: Evansville, IN
My BF and I have been together for a three years. We have a great sex life together…or we did. Recently he asked me if I would be interested in some anal play — me inserting something in his butt. I thought ok; lets give it a try. After some fumbling around the first time, (I was very self-conscious) I really got into it. It was very empowering. I never imagined how different it is inserting a dildo into someone as opposed to being inserted into, if ya know what I mean.
We were both having such a good time and I could see that he was totally turned on by the play.
After one of these very fun sessions I made an off-handed comment that all the butt play was going to make him gay. This innocent remark had an immediate and devastating effect on him. It was as if I had slapped him in the face. He stormed out of the room and sulked all the rest of the day. I told him I was just a joking. But he didn't believe me and now there's no butt play at all. In fact, there's not much sex between us anymore.
I really screwed up, I know. I had no idea he would react this way. Is there anything I can do to redeem myself? I feel absolutely dreadful.
Wow, touchy little bugger, isn't he? What we have here is some unresolved masculinity issues on the part of your novice butt-pirate BF. Too bad he's cutting his nose off to spite his face instead of dealing with his issues in an up front way.
And just to put your mind to rest, Lilla, this implosion was bound to happen sooner or later. I know you feel bad about triggering it, but it's not really your fault.
In his defense, we can chalk up your BF's regrettable response to you poking (no pun intended) fun as the result of a lifetime of homophobic conditioning. One can only guess at the virulent anti-gay messages he's received throughout his lifetime there in one of the reddest of red states. I think we can all agree that Evansville, Indiana is no San Francisco, California.
All us men, including all us gay men, have some vestiges of homophobia inside us. And some have a whole lot. It's regrettable, but that don't make it any less true. This fear we all carry around inside of us can turn us inside out. It can get in the way of us accepting and loving ourselves for who we are, if we are indeed gay. And this fear can lead us to all kinds of destructive antisocial behavior against others if we are straight.
I'd be willing to guess your BF is the kind of guy that tells fag jokes and laughs loudest when he hears the same. I'd be willing to guess your BF is the kind of guy that raises an eyebrow (and possibly even a fist) when he encounters an effeminate man. I'd be willing to guess your BF is the kind of guy that over-compensates for even the slightest perceived feminine tendency within himself. I'd be willing to guess your BF is the kind of guy that has a very structured and uniform notion of what a woman's place in society should be.
I added this last one, because I'm convinced that the root of all homophobia is actually a fear and hatred of women. In the worldview of most men, masculinity is privileged, making it superior femininity. To these men, it's an affront to their world order to see any another man behave in a less than masculine way, even if that behavior is in the privacy of his own bedroom. This strict sex-role stereotyping has them in a strangle hold, choking all the joy and pleasure from their lives.
One can only imagine the massive internal conflict your BF must have struggled with before he asked you to bugger him. Imagine his chagrin when the only person in the whole wild world he's ever opened up to about this mortifying desire of his; turned around and make a joke about it…and a fag joke on top of it.
I know, I know, you didn't mean it to be a fag joke, but it was one nonetheless; at least in his mind. Your harmless little comment went to the heart of his insecurities. He had been found out, as it were, and the tables turned on him. And all he was left with was his shame. How enormously sad!
Can I tell you a story? Early in my therapeutic career I had a couple come to see me for marriage counseling. They were a pretty conservative heterosexual couple with two preteen children. They were both prim and proper and neither one had so much as a hair out of place. Can you say: buttoned down?
When I got around to asking them to tell me what was wrong, the wife broke into sobs. She couldn't talk. I thought to myself, "this is gonna be juicy." The husband hung his head in shame and began to spill the beans. After 10 years of marriage he finally got up the courage to ask the little woman for some oral sex. Apparently she was mortified at the suggestion. Good girls don't do that! It took another two years of supplication before she finally relented and gave him his one and only blowjob.
I was spellbound as he recounted the fateful night that he finally got his wish. His wife, on the other hand, was completely beside herself, holding her face in her hands. With a little prompting from me, the husband continued his story. The blowjob started out very tentatively. The little woman was doing all she could to suppress her natural inclination not to gag as she got closer to his johnson. But then she finally relented. And, after all those years of patiently waiting and fantasizing about this moment, she took a deep breath and wrapped her lips around the head of his dick.
He was so overjoyed and completely lost in the moment when somehow he let pass from his lips, the unfortunate word — cocksucker — in reference to the mother of his children down there between his legs smokin' his pole. Where this word came from; he couldn't say. It wasn't a word he could ever remember consciously using before in his life. But there it was on that night of nights. And that, dear Lilla, was all she wrote. Before the husband knew what was happening, his wife spat out his boner with a yelp and fled to the bathroom to wash out her mouth with soap.
From that night to weeks later when they found themselves in my company, not only were there no more blowjobs, but no nookie whatsoever.
It took us weeks and weeks to uncover the root of the wife's aversion to oral sex — giving or receiving. An unhappy childhood, an abusive father, catholic guilt, countless messages about sex being dirty, low self-esteem and her being pre-orgasmic all fueled her disconnect with sex in general and oral sex in particular. This coupled with the unfortunate and untimely exclamation by the husband was the straw that broke the camel's back.
Isn't it amazing how one word can short-circuit the whole shebang?
I suppose you see where I'm going with this, huh Lilla? Your little comment triggered a landslide in your BF's psyche. The delicate house of cards he was able to assemble to hold on to his homophobia and still take it up the ass, was simply not strong enough to withstand the word "gay," joking or not.
Clearly your BF has issues. But I'm probably telling you something you already know. I can't really say if there's a possibility for the two of you to overcome this on your own. Is there any chance your BF would acquiesce to some counseling? If yes, that would be the way to go. He needs to do a bunch of reprogramming on himself, don't cha know.
If counseling isn't in the cards all I can suggest you do is stroke his masculinity as much as you can. There will be a price to pay for this, but maybe you'll be able to address that later. You can tell him that you've been reading all over online about how much straight men are getting into ass play these days. How they are throwing off the yoke of their ass-phobia and enjoying all the god-given sensations their backdoor has to offer. You might even offer up your pucker by way of example.
If he ever does relent and allow you to touch him "down there" again that would signal that the crisis is over, but you won't be out of the woods quite yet. If the ass play does resume, you could chat him up sometime (not in the bedroom though) as to why he had such a virulent response to your joking. If he is honest with you, he will tell you what you already know from reading my response here. And I'd be willing to bet my last dollar on that.
Good luck


text:
You know your mom is cheap when...
you have to share your own birthday cake. With a boy.
(Yeah, I'm taking Ashley's side. Why? Because a) she likes Disney stuff, b) she's enduring what I'm assuming must be a sports logo on her birthday cake, and c) she's a girl. But mostly the Disney thing.)
I like the unintentional irony of having Eeyore on the cake, though. A glum donkey for a glum-ass cake - it's quite appropriate. Still, I have a few questions:
1) Since the "Eagles" logo is blue, why is the icing green?
2) Can anyone see the colors green & purple together and NOT think of either Mardi Gras or the Joker?
3) How come Glen gets his name capitalized, but not Ashley?
4) Did anyone else first read this as "Happy ashley Birthday Glen"?
5) Doesn't Glen's side look bigger? Hey, I think it IS bigger. Mo-oooommm!!!

subset: commoncrawl


text:
Add sparkle and shine to your lace! Laura Nelkin shows you how easy and rewarding it is to incorporate beads into your knitting projects.
Beads add color and flair to knitted garments, accessories and jewelry. Laura Nelkin's here to show you how easy and rewarding it is to incorporate beads into any knitted project. Begin with a simple cuff, then progress to Laura's Accola shawl. You'll learn how to select the right beads and add them to any design. She demonstrates on her popular Clarus shawl pattern. Along the way, you'll learn how to create nupps, place beads in different locations on or between stitches, and work in both lace-weight and fingering-weight yarn. The two shawl patterns included free with this class can be worked in either type of yarn, and in small or large versions.
If you're not delighted with your Bluprint experience, we'll make it right or give you a full refund.


text:
Well, I'm Stumped
There is a tradition of making wedding cakes that look like tree stumps. Why? Beats me. And since many of them have little shotgun shells decoratively sprinkled around the edges, I'll let one of you ask.
Here's an example of a stump wedding cake, and also what bride Zsofia asked her baker to make for her wedding:
As you can see, it is remarkably stumpy. Now, again, you may be questioning the reasoning behind celebrating a new life of love together with a murdered tree. To this I say: It's not like it's a real tree, so let it go already. Besides, that's not the point.
So what IS the point?
The point, my dear Wreckies, is that Zsofia got THIS for her wedding cake:
See? Betcha don't give a poo-streaked muck pile why people order stump cakes now. Now you just want a better view of this poo-streaked muck pile.
Happy to oblige, my friends, happy to oblige:
Now don't get me wrong: the green shredded coconut adds a festive touch to those 15 cent cardboard rounds, and the fake bird is totally workin' it. Still, the bride suspects (and from this photo, I think with good reason) that the cake may have fallen over a few times en route, since in addition to looking - well, like this - it was an hour late to the reception.
Happily, though, Zsofia reports that by the time the cake arrived most of the guests were too drunk to care what the cake looked like, anyway.
[sniffle] Aw, I just love happy endings, don't you?
- Related Wreckage: Inspiration vs Perspiration


text:
Windows 8 Security Overview
Applies To: Windows 8
The Windows 8 operating system was built to protect against emerging security threats. The improvements fall into three broad categories:
Groundbreaking malware resistance. Windows 8 can eliminate bootkits and rootkits and drastically reduce the impact of user-level malware such as viruses, worms, Trojan horses, and spyware.
Modern access control for flexible work styles. Security is nothing without usability. Windows 8 gives you instant and automatic connectivity so your users can work flexibly while still meeting your access control requirements.
Pervasive device encryption. Windows 8 protects your data by using a suite of new and improved features to authorize, audit, and encrypt data without inconveniencing users or systems administrators.
With an unprecedented level of investment across each category, Microsoft has been able to deliver malware resistance capacities that literally start from the moment users turn on their PC and continue to protect the device and software until they turn it off. Microsoft has leveraged the Windows 8 device certification process as a tool to drive important changes in devices, such as requiring all certified PCs to support new hardware technologies like UEFI, and has worked with industry to help put security technologies like TPM on a course to become standard equipment in the future. With these investments and Windows technologies such as Trusted Boot, ELAM, and Measured Boot, Windows 8 has made it possible to virtually eliminate the possibility of bootkits and rootkits from starting. Improvements to the Windows core and Internet Explorer reduce the risk of a variety of attacks that malware has used to gain elevated privileges and attack the system and data. It's now much more difficult to exploit and compromise Windows.
Windows 8 offers several critical improvements to BitLocker, Microsoft's hard drive encryption technology, to improve data protection. Used Disk Space Only encryption and BitLocker preprovisioning now reduce encryption time for new drives to seconds. If you're looking for the benefits of an on-drive encryption solution, Windows 8 supports encrypted hard drives that can do all of the heavy lifting while freeing up the system CPU for the user. BitLocker is more convenient for users, too: Network Unlock now allows PCs protected with a PIN at startup to start automatically when physically connected to the internal network, and users can change their own PIN or password with standard user privileges.
As work styles change, security must keep up. Passwords simply are not the right solution for many mobile tablet PC users, so Microsoft introduced picture passwords to provide a high level of security with touch-friendly convenience. The latest-generation lightweight tablets and Ultrabook devices simply are not large enough to have a built-in smart card reader, and external readers are cumbersome. So, Windows 8 introduces virtual smart cards, which provide multifactor authentication with nothing extra for the user to carry. Brute force protection uses BitLocker's complex, 48-character recovery key as an additional layer of security when a brute force password-guessing attack is detected. Combined with a Windows Server 2012 infrastructure, Windows 8 also supports DirectAccess to keep users constantly connected and up to date with the latest security policies and updates, and Dynamic Access Control provides flexible policies that define file authorization and auditing in a way that can keep up with a constantly changing organization.
This document provides a detailed description of the most important security improvements in Windows 8, along with links to more detailed articles about specific features.
In this document:
Malware resistance
Data protection
Access control
Malware resistance
In movies, security threats always seem to be initiated by a malicious user sitting in front of a monitor with green text scrolling across it. In the real world, the vast majority of security threats occur without any human interaction at all. Just as software has automated so much of our lives, malware has automated attacks on our PCs. Those attacks are relentless. Malware is constantly changing, and once it infects a PC, in some cases it can be almost impossible detect and remove.
Prevention is the best bet, and Windows 8 provides strong malware resistance by taking advantage of secure hardware, securing the boot process, securing the core operating system architecture, and securing the desktop.
The following table lists specific malware threats and compares the mitigations that the Windows 7 operating system and Windows 8 provide.
Table 1. Malware threats and Windows 8 and Windows 7 mitigations
|Windows 7 mitigation
|Windows 8 mitigation
Firmware rootkits replace the firmware with malware.
A small subset of PCs supports Unified Extensible Firmware Interface (UEFI).
All certified PCs must support UEFI.
Bootkits start malware before Windows starts.
Some protection when BitLocker Drive Encryption was implemented with a Trusted Platform Module (TPM).
Secure Boot verifies bootloader integrity, and Measured Boot makes information available that a remote server could use to verify integrity.
Driver rootkits start kernel-level malware while Windows is starting, before antimalware can start.
Windows verifies Microsoft-signed drivers but not non-Microsoft drivers.
Trusted Boot verifies Microsoft drivers, Early Launch Anti-Malware (ELAM) verifies non-Microsoft drivers, and Measured Boot allows a remote server to verify integrity and detect untrusted boot components.
User-level malware exploits a vulnerability in the system or an application and owns the device.
There is some support for Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).
Improvements to ASLR, DEP, the heap architecture, and memory-management algorithms reduce the likelihood of vulnerabilities enabling successful exploits.
Users download dangerous software (for example, seemingly legitimate application with an embedded Trojan horse) and run it without knowledge of the risk.
Internet Explorer's SmartScreen Application Reputation feature warns users or blocks the download when they contact potentially malicious software.
The SmartScreen Application Reputation feature has been moved into the core operating system and either warns users or blocks the download when they use any browser to download potentially malicious software.
Malware exploits a vulnerability in a browser add-on.
ASLR and Internet Explorer Protected Mode help to reduce the risk of the attack.
The Windows Store version of Internet Explorer does not run add-ons, eliminating this risk.
A website with malicious code exploits a vulnerability in Internet Explorer to run malware on the client PC.
ASLR and Internet Explorer Protected Mode help to reduce the risk of the attack.
Enhanced Protected Mode (enabled by default in the Windows Store version of Internet Explorer) and improved memory protection further reduce the risk of these attacks.
The following sections describe these improvements in more detail:
Secure hardware
Securing Windows startup
Securing the desktop
Secure hardware
Windows 8 is designed to run on almost any hardware capable of running the Windows 7, Windows Vista, or Windows XP operating system. However, Windows 8 is also designed to take advantage of modern advancements in hardware security, including UEFI firmware, TPM security chips, and Secure Boot technology. Although many PCs designed for older versions of the Windows operating system support these features, all PCs certified for Windows 8 support them, allowing IT to better maintain the integrity of their devices' operating systems and applications and virtually eliminating the risk of some of the most dangerous threats, such as bootkits and rootkits.
UEFI is a standards-based solution that offers a modern-day replacement for the BIOS that provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, PCs start UEFI before any other software, and UEFI then starts the operating system's bootloader.
Recent implementations of UEFI are able to run internal integrity checks that verify the firmware's digital signature before running it. Because only the PC's hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware rootkits. Thus, UEFI is the first link in the chain of trust.
UEFI is required for Secure Boot and Measured Boot, described later in this document.
A TPM is a tamper-resistant security processor capable of storing cryptographic keys and hashes. Besides storing data, a TPM can digitally sign data using a private key that software cannot access. Among other functions, Windows uses the TPM for cryptographic calculations and to store the keys for BitLocker volumes, virtual smart cards, and other public key certificates.
Basically, the TPM is a secure storage place that both UEFI and the operating system can use to store hashes (which verify that a file has not been changed) and keys (which verify that a digital signature is genuine).
Secure Boot
When a PC starts, it starts the process of loading the operating system by locating the bootloader on the PC's hard drive. If a PC doesn't support Secure Boot (as is the case with most PCs released prior to Windows 8), the PC simply hands control over to the bootloader, without even determining whether it is a trusted operating system or malware.
When a PC with UEFI and Secure Boot starts, the firmware starts the bootloader only if the bootloader's signature has maintained integrity and if one of the following conditions is true:
The bootloader was signed by a trusted authority that is registered in the UEFI database. In the case of PCs certified for Windows 8, Microsoft's signature is trusted.
The user has added the bootloader's digital signature to the UEFI database. This allows the user to load non-Microsoft operating systems.
All x86-based Certified For Windows 8 PCs must meet several requirements related to Secure Boot:
They must have Secure Boot enabled by default.
They must trust Microsoft's certification authority (CA; and thus any bootloader Microsoft has signed).
They must allow the user to add signatures and hashes to the UEFI database.
They must allow the user to completely disable Secure Boot.
Secure Boot does not limit the choice of operating system. In fact, users have three options for running non-Microsoft operating systems:
Use an operating system with a Microsoft-signed bootloader Because all Certified For Windows 8 PCs must trust Microsoft's CA, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 8 PCs. Several different non-Microsoft operating systems, including several varieties of Linux, have certified bootloaders.
Configure UEFI to trust a non–Microsoft-signed bootloader or hashes All Certified For Windows 8 PCs allow users to add non-certified bootloaders by adding a signature or hashes to the UEFI database, allowing them to run any operating system without acquiring a certificate, including homemade operating systems.
Turn off Secure Boot All Certified For Windows 8 PCs allow users to turn off Secure Boot so they can run any software. This behavior is identical to PCs with BIOS: The PC simply runs the bootloader without any verification. Turning off Secure Boot does not help protect against bootkits, and Microsoft recommends that Secure Boot be enabled whenever the device starts Windows.
Malware cannot change these options: The UEFI firmware does not allow software to make changes. Instead, users must manually configure the firmware settings to trust a non-certified bootloader, or they must turn off Secure Boot. For more information about Secure Boot, read Protecting the pre-operating system environment with UEFI.
Like most mobile devices, ARM-based Certified For Windows 8 devices, such as the Microsoft Surface RT device, are designed to run only Windows 8. Therefore, Secure Boot cannot be turned off, and users cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems.
Securing Windows startup
Secure Boot uses hardware technologies to help protect users from rootkits. Secure Boot can only guarantee the integrity of the bootloader, however. After the bootloader launches, users must rely on the operating system to provide the security they need.
Windows 8 includes a series of new features that have the potential to completely eliminate these types of threats. With Windows 8, users can finally trust their PCs.
Trusted Boot
Secure Boot verifies that the bootloader is trusted, and then Trusted Boot protects the rest of the boot process by verifying that all Windows boot components have integrity and can be trusted. The bootloader verifies the digital signature of the Windows 8 kernel before loading it. The Windows 8 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and the ELAM component.
If a file has been modified (for example, if malware has modified the file to launch malicious code), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay.
Early Launch Anti-Malware
Malware on previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows boot process. The malicious driver would then use its kernel-level privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later starts.
ELAM starts before the all non-Microsoft drivers and checks their integrity to determine whether the driver is trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot driver, ELAM will detect the change and Windows will not load it, thus blocking driver-based bootkits.
The design is simple but effective. ELAM does not replace a full-featured antimalware solution: That starts later in the boot process. Indeed, ELAM is only used for a few seconds each time a PC starts. Windows Defender in Windows 8 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps.
If you're interested in learning how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\Administrative Templates\System\Early Launch Antimalware, and enable the Boot-Start Driver Initialization Policy setting. Now, you can select which driver classifications ELAM loads. Selecting Good Only provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting (see Figure 1).
Figure 1. Select which drivers ELAM loads.
Measured Boot
The biggest challenge with rootkits and bootkits on earlier versions of Windows is that they can be undetectable to the client. Because they start before antimalware and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, PCs infected with rootkits appear to be healthy, even with antimalware running.
If rootkits and bootkits can hide themselves so effectively, how can IT ever be sure that the PCs in the organization are not infected? Without Windows 8, IT cannot be sure.
Windows 8 adds the Measured Boot feature, which uses the TPM hardware component built into newer PCs to securely record a measurements of every boot-related component, including firmware, Windows, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, the log of all measured components remains out of the reach of any malware.
Remote Attestation
Measured Boot itself does not prevent malware from loading during the startup process: That is the job of Secure Boot, Trusted Boot, and ELAM. Instead, Measured Boot provides a secure audit log that allows a trusted remote attestation server on the network to evaluate the PC's startup components. If the remote attestation server detects that the PC loaded an untrusted component, the server could potentially block the PC's access to network resources or even the network itself. A remote attestation service can even be implemented to initiate the quarantine and remediation processes to fix an infected PC. Measured Boot uses the following process:
The PC uses the TPM to store measurements of the boot loader, boot drivers, and ELAM driver. The TPM prevents the log from being tampered with, so even if malware is successfully loaded, it will not be able to modify the log.
When the remote attestation client starts, it can contact a remote attestation server. The server provides it with a unique key. The key is different every time, preventing the client from simply sending back a previously recorded health report.
The remote attestation client submits the key to the TPM, and the TPM itself digitally signs the log. Because the TPM hardware has signed the log, malware cannot modify it without being detected.
The remote attestation client sends the signed log back to the attestation server, which can verify that the PC loaded only trusted software.
Because the attestation server requires non-Microsoft software, the software vendor and the administrator's configuration choices determine the exact process. However, depending on the implementation and configuration, the server can now determine whether the client is healthy and grant the client access to either a limited quarantine network or to the full network. Individual network resources, such as servers, could also grant or deny access based on whether the remote attestation client was able to retrieve a valid health certification from the remote attestation server.
Figure 2 illustrates the Measured Boot and remote attestation process.
Figure 2. The Measured Boot process proves the PC's health to a remote server.
Windows 8 includes the application programming interfaces to support Measured Boot, but administrators will need non-Microsoft tools to implement a remote attestation client and server to take advantage of it. For an example of such a tool, download the TPM Platform Crypto-Provider Toolkit from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin's Measured Boot Tool. Measured Boot uses the power of TPM and Windows 8 to give IT a way to confidently assess the trustworthiness of a client PC across the network.
Securing the core
Although applications built for Windows are designed to be secure and free of defects, the reality is that as long as human beings are writing code, we're likely to see vulnerabilities discovered in the future. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hopes that a successful exploit can be bootstrapped.
To mitigate these risks, Windows 8 includes core improvements to make it more difficult for malware to perform buffer overflow and other low-level attacks. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes a detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level.
Microsoft security development life cycle
Windows 8 is the culmination of many years of effort from Microsoft. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. Those days are largely past, and we see evidence of this in Kaspersky's third-quarter 2012 IT Threat Evolution report where, for the first time, Microsoft software avoided being named on the top-10 vulnerability list. This achievement is particularly interesting when you compare the total surface area and complexity of the code in products like Windows and Microsoft Office compared to others on the list.
Attackers have discovered vulnerabilities in previous version of Windows, and there is no doubt they will discover more in the future. Microsoft acknowledges this and has designed the Windows 8 architecture to have multiple levels of protection against vulnerabilities. Even if an attacker discovers a vulnerability and creates a successful exploit, the defense-in-depth design of Windows 8 security can still mitigate the risks by eliminating or at least limiting the damage that can be done.
Address space layout randomization
One of the most common techniques used to gain access to the system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, this could be done by any malware that could write directly to the system memory; the malware would simply overwrite system memory within well-known and predictable locations.
Address space layout randomization (ASLR) makes that type of attack much more difficult by randomizing how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates this by showing how the locations of different critical Windows components can change in memory between restarts.
Figure 3. ASLR randomizes the location of critical components.
Although the ASLR implementation in Windows 7 was effective, it wasn't applied holistically across the Windows system, and the level of entropy (cryptographic randomization) wasn't always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed, Microsoft applied ASLR holistically across the system and increased the level of entropy many times.
The ASLR implementation in Windows 8 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, making it even more difficult for malware to predict where Windows 8 stores vital data. When used on systems with TPMs, ASLR memory randomization will be increasingly unique across devices, making it even more difficult for a successful exploit that works on one system to work reliably on another.
Data execution prevention
Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR is going to make that much more difficult. Wouldn't it be great if we could make sure that malware could be prevented from running if it writes to an area that has been allocated solely for the storage of information?
Data execution prevention (DEP) does exactly that and substantially reduces the range of memory that malicious code can use for its benefit. DEP uses the No eXecute (NX) bit on modern CPUs to mark blocks of memory as data that should never be executed as code. Therefore, even if an attacker succeeds in loading the malware code into memory, they will not be able to execute it.
Because of the importance of DEP, Windows 8 is the first version of Windows that requires a processor that includes hardware-based DEP support. Users cannot install Windows 8 on a computer that does not have DEP enabled. Fortunately, most processors released since the mid-2000s support DEP.
In addition, Windows 8 makes using DEP easier for developers, so more apps can take advantage of the security benefits. If you're interested in seeing which apps use DEP, complete these steps:
Open Task Manager by pressing Ctrl+Alt+Esc or by searching the Start screen.
Click More Details (if necessary), and then click the Details tab.
Right-click any column heading, and then click Select Columns.
In the Select Columns dialog box, select the last Data Execution Prevention check box.
Click OK.
Now, you can see which processes have DEP enabled. Figure 4 shows the processes running on a Windows 8 PC with a single process that does not support DEP.
Figure 4. DEP helps reduce the risk of successful attacks against an app.
Windows heap
The heap is a location in memory that Windows uses to store dynamic application data. Windows 8 improves on the Windows 7 heap design by mitigating the risk of heap exploits that could be used as part of an attack to successfully compromise Windows 7.
Windows 8 has several important improvements to the heap, including:
Internal data structures used by the heap are now better protected against memory corruption.
Heap memory allocations now have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 8 adds a random offset to the address of a newly allocated heap, making the allocation much less predictable.
Windows 8 adds "guard pages" before and after blocks of memory. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 8 responds by instantly terminating the app
Windows 8 resolves known heap attacks that could be used to compromise a PC running Windows Vista or Windows 7.Windows 8 resolves known heap attacks that could be used to compromise a PC running Windows Vista or Windows 7.
Memory reservations
The lowest 64 KB of process memory is now reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory.
Securing the desktop
Windows 8 includes critical improvements to user-level malware protection. The familiar desktop environment is now more resistant to malware, thanks to improvements to Windows Defender, Internet Explorer, and SmartScreen. The new Windows Store has the potential to further reduce the likelihood that malware will infect devices through the careful review of all Windows Store app submissions. Even if malware managed to slip past the review process, Windows mitigates the risks and impact by running all Windows Store apps a tightly restricted operating environment.
The sections that follow describe Windows 8 improvements to application security in more detail.
Windows Defender
In Windows 8, Windows Defender has been upgraded from antispyware to a full-featured antimalware solution capable of detecting and stopping a wider range of potentially malicious software, including viruses. Windows 8 users no longer need Microsoft Security Essentials, because Windows Defender is now just as powerful. Windows Defender supports Windows 8's ELAM feature, which makes it capable of detecting rootkits that infect non-Microsoft drivers. If Windows Defender detects an infected driver, it will prevent the driver from starting.
Windows Defender is primarily intended for consumer and unmanaged PCs scenarios, and thus most large organizations will want an enterprise antimalware solution such as System Center 2012 Endpoint Protection, which can offer advanced centralized management capabilities such as monitoring and reporting. Like Windows Defender, System Center 2012 Endpoint Protection includes support for ELAM. Regardless, with more and more people using unmanaged personal PCs for work, it is good to know that Windows 8 includes powerful and free antimalware that is enabled by default.
For more information about Windows Defender, visit Protect your PC.
The SmartScreen filter
Recent versions of Windows have many effective techniques for preventing malware from installing itself without the user's knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a game or a utility, but it carries an additional, malicious payload.
Starting with Windows Internet Explorer 8, SmartScreen has helped protect users from both malicious applications and websites by using SmartScreen's application and URL reputation services. SmartScreen in Internet Explorer would check URLs and newly downloaded apps against a list that Microsoft maintained. If the app or URL was not known to be safe, SmartScreen would warn the user or even block the app or URL, depending on how systems administrators had configured Group Policy settings.
In Windows 8, SmartScreen is integrated into the operating system, allowing SmartScreen's application reputation services to protect users regardless of the web browser they are using. The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, SmartScreen checks the reputation of the application using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, SmartScreen warns the user (as shown in Figure 5) or blocks execution entirely, depending on how the administrator has configured Group Policy.
Figure 5. SmartScreen can warn users before allowing them to run potentially malicious apps, regardless of how they download the app.
By default, users have the option of bypassing SmartScreen protection, so it will never prevent a user from running a legitimate app. You can use Group Policy settings to disable SmartScreen or to completely prevent users from running apps that SmartScreen does not recognize.
For more information about SmartScreen, see SmartScreen Application Reputation.
If you're interested in trying out SmartScreen, use Windows 7 or an earlier version of Windows to download this simulated (but not dangerous) malware file: freevideo.exe. Save it to your computer, and then run it from Windows Explorer. As shown in Figure 6, Windows runs the app without much warning. In Windows 7, you might get a warning about the app not having a certificate, but it is easily bypassed.
Figure 6. Earlier versions of Windows do little to warn users before allowing them to run unknown apps.
Now, repeat the test on Windows 8 by copying the file to a Windows 8 PC or by re-downloading it and saving the file to your local computer. Run the file directly from File Explorer, and SmartScreen will warn you before allowing it to run. For many users, that extra warning will be enough to save them from a malware infection.
Internet Explorer 10
Internet Explorer 10 on Windows 8 includes two experiences: a full-screen, touch-friendly browser interface (launched from the Start screen) and the traditional desktop browser (launched from the desktop). Both experiences of Internet Explorer 10 use the same iexplore.exe process and include numerous security improvements, such as:
Enhanced Protected Mode. The improved version of this feature enhances security in several ways. On 64-bit versions of Windows 8, Internet Explorer 10 now randomly allocates the entire address space—about a terabyte of addressable space—making heap spray attacks that malicious code on a website might use to elevate privileges impractical. Internet Explorer 10 now uses a broker process when users access files (for example, when uploading an attachment to a browser-based email app such as Hotmail). The brokering happens automatically when the user clicks Open in the file upload dialog box, increasing security without inconveniencing the user. Enhanced Protected Mode also prevents tabs accessing the public Internet from accessing the user's domain credentials, acting as a local web server (reducing the risk that malicious website code could impersonate an intranet site) and connecting to intranet servers. Enhanced Protected Mode is enabled by default in the Windows Store version of Internet Explorer 10 but is disabled by default in the desktop version, because some add-ons are not yet compatible. For more information, read the Internet Explorer blog entry, Enhanced Protected Mode.
Improved memory protection. In the past, it has been possible for a website with malicious code embedded within it to exploit a vulnerability in a web browser to run malware on a client PC. Often, the user simply visited a trusted website that had been compromised, and the malware installed itself without the user's permission or knowledge. Internet Explorer 10 offers improved protection against these types of attacks, drastically reducing the likelihood that an exploit can elevate privileges to run code, even if a vulnerability in Internet Explorer 10 is discovered. Of particular note, Internet Explorer 10 randomizes the location of all modules, making them more difficult to attack. For more information, read the Internet Explorer blog entry, Enhanced Memory Protections in IE10.
Improved cross-site scripting (XSS) filter. XSS attacks can add malicious content to a trusted website without the user's knowledge. Internet Explorer 10 includes an XSS filter to help protect users from such attacks.
In addition, the Windows Store version of Internet Explorer 10 includes a drastic security improvement: It does not run add-ons. Gone are the days of annoying toolbars and plug-ins that slow performance. Internet Explorer 10 does, however, include increased support for modern standards like HTML5 and CSS3, allowing it to display the latest generation of rich and interactive websites (without the security risks and annoyances of unnecessary add-ons).
As the Web continues to evolve, Microsoft expects that website owners will create versions of their websites that do not rely on potentially dangerous plug-ins, and Internet Explorer users can enjoy the Web without these associated risks.
Note that the Windows Store version of Internet Explorer 10 does support Adobe Flash for a limited number of trusted websites.
Windows Store apps
SmartScreen helps to reduce the risk of users downloading malware from the Internet, but the reality is that the Internet offers such tremendous freedom of choice that there is always some risk. In the past, even websites that users trust have been attacked and distributed malware without the knowledge of the website administrators and users. When downloading apps from the Internet, users simply can never be sure whether an app contains malware.
The good news is that downloading and using apps from the Windows Store will dramatically reduce the likelihood that you will encounter malware to your PC, as all apps go through a careful screening process before being made available in the store. Windows Store apps built by organizations and distributed through sideloading processes will need to be reviewed internally to help ensure they meet organizational security requirements.
Regardless of how Windows Store apps are acquired, users can use them with increased confidence. Unlike desktop apps that can run with elevated privileges and have potentially sweeping access to the system and data, Windows Store apps run in an AppContainer sandbox that runs the application with limited privileges and capabilities. For example, Windows Store apps have no system-level access, have tightly controlled interactions between other apps, and have no access to data unless the user explicitly grants the application permission.
In addition, all Windows Store apps follow the security principal of least privilege. Apps receive only the minimal privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact permissions that the app requires, along with the app's age rating and publisher, as shown in Figure 7.
Figure 7. The Windows Store's architecture reduces the risk of malware and provides detailed and trustworthy information about the app's permissions and rating.
In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 8 will dramatically reduce the likelihood that users will encounter malicious apps on the system.
As with earlier versions of Windows, Windows 8 supports AppLocker to give you complete and centralized control over the apps users are allowed to run. With AppLocker and Group Policy settings in an Active Directory Domain Services (AD DS) environment, you can create a list of every app users can run, specify which publishers they trust, or simply block apps that might not help the company's productivity, like Solitaire.
Windows 8 extends AppLocker support to Windows Store apps and simplifies AppLocker rules, making them easier to implement and more reliable. AppLocker rules for Windows Store apps automatically apply to the app installer and all files included with the app. Because all Windows Store apps are signed by the publisher, administrators create only simple publisher rules and never need to use error-prone hash- or path-based rules. In addition, a single AppLocker rule can contain rule collections for both desktop apps and Windows Store apps, making it easy to manage new packaged apps alongside existing apps.
Although AppLocker was primarily designed to give IT tight control over the non-malicious applications that their users may choose to use, that same functionality also can be used to reduce malware risks within your organization. Many organizations use it solely with that purpose in mind.
If you are interested trying an AppLocker configuration on Windows 8, complete these steps:
On a test PC running Windows 8, launch the Local Group Policy Editor by running gpedit.msc.
Right-click the Computer Configuration\Windows Settings\Security Settings\Application Control Policies\AppLocker\Packaged App Rules node, and then click Automatically Generate Rules.
Follow the prompts that appear, and accept the default settings.
This procedure automatically creates AppLocker rules that allow users to run all the currently installed apps as well as any future versions of the same apps. Follow this same procedure in an AD DS domain to apply the same rules to every Windows 8 PC in your organization. With just a few clicks, you can also create a default rule that prevents users from running other packaged apps, instantly giving you complete control over the packaged apps users in the organization can run.
Figure 8 shows the extremely simple publisher rule for allowing a packaged app to run. In contrast, creating rules for desktop apps could be extremely complex, requiring you to configure a combination of hashes, file paths, and digital signatures. Because the configuration was so complex, it was also error-prone, often resulting in inconvenienced users (when legitimate apps were accidentally blocked) or potential security vulnerability (when unwanted apps were not blocked).
Figure 8. AppLocker apps for Windows 8 are straightforward and reliable.
For more information about AppLocker improvements, visit AppLocker Technical Overview.
Data protection
Where users travel, so does their organization's confidential data. Since Windows Vista, BitLocker has provided full drive encryption capable of protecting both confidential data and system integrity. Windows 8 improves BitLocker by making it easy and faster to deploy, more convenient, and more manageable.
Table 2 lists specific data-protection challenges in Windows 7 and the Windows 8 solution.
Table 2. Windows 8 solutions to Windows 7 data-protection challenges
|Windows 7 challenge
|Windows 8 challenge
When BitLocker is used with a PIN to protect startup, PCs such as servers and kiosks cannot be restarted remotely.
Network Unlock allows PCs to start automatically when connected to the internal network.
Users must contact IT to change their BitLocker PIN or password.
Windows 8 allows users with standard privileges to change their BitLocker PIN or password.
Enabling BitLocker can make the provisioning process take several hours.
BitLocker preprovisioning and Used Space Only encryption allow BitLocker to be quickly enabled on new computers.
No support for using BitLocker with Self-Encrypting Drives (SEDs).
BitLocker supports offloading encryption to encrypted hard drives.
Administrators have to use separate tools to manage encrypted hard drives.
BitLocker supports encrypted hard drives with onboard encryption hardware built in, allowing administrators to use the familiar BitLocker administrative tools to manage them.
Encrypting a new flash drive can take more than 20 minutes.
BitLocker To Go's Used Space Only encryption allows users to encrypt drives in seconds.
BitLocker could require users to enter a recovery key when system configuration changes occur.
BitLocker requires the user to enter a recovery key only when disk corruption occurs or when the user loses their PIN or password.
The sections that follow describe these improvements in more detail.
TPM preprovisioning
In Windows 7, preparing the TPM for use offered a couple of challenges:
The TPM can be turned off in BIOS, requiring someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows.
Enabling the TPM may require one or more restarts.
Basically, it was a big hassle. If IT is provisioning new PCs, they can handle all of this, but if you want to add BitLocker to devices that are already in users' hands, they will probably struggle with the technical challenges and either call IT for support or simply leave BitLocker disabled.
With Windows 8, Microsoft has added instrumentation that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated.
BitLocker preprovisioning
BitLocker is capable of encrypting entire hard drives, including both system and data drives. Although Windows 7 and Windows Vista both supported BitLocker, Windows 8 adds several key improvements.
BitLocker preprovisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 8, administrators can now turn on BitLocker and the TPM from within the Windows Preinstallation Environment before installing Windows, without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), enabling BitLocker takes only a few seconds.
With earlier versions of Windows, administrators had to enable BitLocker after Windows was installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on the drive size and performance, significantly delaying deployment.
Used Disk Space Only encryption
BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused.
But why encrypt a new drive when you can simply encrypt the data as it's being written? To reduce encryption time, BitLocker in Windows 8 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this can reduce encryption time by more than 99 percent.
If you're interested in running your own tests to compare Used Disk Space Only encryption and full disk encryption, read Try It Out: Encrypt Used Space Only.
Encrypted hard drive support
SEDs have been available for years. However, Microsoft couldn't support the use of SEDs with Windows 7, because they lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker in Windows 8 supports the next-generation encrypted hard drives. These drives provide onboard cryptographic capabilities to encrypt data on drives, thus offloading cryptographic calculations from the PC's processor to the drive itself and instantly encrypting the drive.
Standard user PIN and password change
When BitLocker is enabled on a system drive and the PC has a TPM, administrators can choose to require the user to type a PIN before BitLocker will unlocks the drive. Requiring a PIN can prevent an attacker with physical access to a PC from even getting to the Windows login, making it virtually impossible for the attacker to access or modify user data and system files.
Requiring a PIN at startup is a tremendously useful security feature, but it comes with some costs. One of the most significant is the need to change the PIN regularly. In enterprises using BitLocker with Windows 7 and Windows Vista, users must contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis.
With Windows 8, users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this reduce support costs, but it could improve security, too, by enabling users to change their PINs and passwords more often.
Network Unlock
Requiring a user to type a PIN to start a BitLocker-protected PC helps ensure that the PC is in the hands of an authorized user. However, it prevents PCs from restarting automatically, which is a problem when installing apps and updates after hours, because PCs restart automatically but wait for a user to type a PIN before starting Windows. This makes the PIN option a non-starter for protecting volumes on servers and shared devices such as kiosks and problematic for desktops that may need to be accessible remotely.
Network Unlock solves this problem by allowing BitLocker-protected PCs to start automatically when connected to a wired corporate network that has a Windows Deployment Server present. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive. For more information, see BitLocker: How to enable Network Unlock.
Network Unlock requires the following infrastructure:
Client PCs must have UEFI firmware that supports a Dynamic Host Configuration Protocol (DHCP) driver
A server running Windows Server 2012 with the optional BitLocker Network Unlock feature
A separate server running Windows Server 2012 with the Windows Deployment Services role
A separate DHCP server
Microsoft BitLocker Administration and Monitoring 2.0
Part of the Microsoft Desktop Optimization Pack, Microsoft BitLocker Administration and Monitoring (MBAM) makes it simple to manage and support BitLocker and BitLocker To Go. MBAM 2.0 adds several features that address top feedback from the previous release and includes features like self-service key recovery for users, better compliance management, integration of MBAM with existing management tools such as Microsoft System Center Configuration Manager, and of course support for Windows 8 and Windows to Go. For more information about MBAM, see Microsoft BitLocker Administration and Monitoring.
Access control
Pervasive Internet access and the latest generation of lightweight tablets and Ultrabook devices have changed the way users work. They are not sitting at a desk with a mouse and keyboard anymore; they are using touch interfaces, travelling around the world, and working from untrusted networks. Let's explore the different ways Windows 8 meets these modern work styles.
Besides providing new defenses, Windows 8 refines many Windows 7 defenses, reducing their cost and improving usability. For organizations that had not deployed the features in Windows 7, these refinements will make deployment more practical. For organizations that had deployed the Windows 7 feature, Windows 8 will reduce the associated costs.
Table 3 lists specific access control challenges in Windows 7 and the Windows 8 solution.
Table 3. Windows 8 solutions to Windows 7 access control challenges
|Windows 7 challenge
|Windows 8 challenge
Organizations must purchase and manage smart card readers, smart cards, and management software. Mobile users must carry a smart card reader and smart card for authentication. Mailing smart cards to remote offices could delay productivity by several days.
Virtual smart cards store the smart card in the PC itself.
Tablet users must type their password on a touch screen, which is error prone and less efficient than a keyboard.
Picture passwords provide convenient and intuitive authentication for touch interfaces.
IT must purchase and manage non-Microsoft tools to meet regulatory requirements for access control and auditing.
Combined with the Windows Server 2012 operating system, Dynamic Access Control provides flexible access control and auditing designed to meet many government security and regulatory requirements.
Configuring Microsoft DirectAccess is complex and often requires additional infrastructure.
Combined with Windows Server 2012, you can configure DirectAccess with as few as three clicks, providing users with automatic and continuous access to internal resources.
Users hate typing their passwords.
Single sign-on allows Windows Store apps to automatically authenticate the user with shared credentials.
Creating AppLocker rules to control which apps users can run is complex and error-prone.
AppLocker rules for Windows Store apps are straightforward and simple for administrators to configure.
Administrators have to use separate tools to manage encrypted hard drives.
BitLocker supports encrypted hard drives with onboard encryption hardware built in, allowing administrators to use the familiar BitLocker administrative tools to manage them.
Windows adds increasing delays between login attempts and can lock out a user account when brute force attacks are detected.
When BitLocker is enabled on the system drive and brute force protection is enabled, Windows can restart the PC after a specified number of incorrect password entries, lock access to the hard drive, and require the user to type the 48-character BitLocker recovery key to start the device and access the disk.
The sections that follow describe these improvements in more detail.
Picture Passwords
Security must be convenient for it to be effective. For a user with a keyboard, a password is extremely convenient to type; therefore, passwords have remained an effective form of authentication for decades.
Although passwords remain as the most frequently used mean to sign in to a device, they are simply not convenient for tablet users, because typing is less precise. To address these challenges, Windows 8 introduces picture passwords to allow users to authenticate themselves using a series of touch gestures instead of a traditional password. After selecting their user name at Windows sign-in, the user draws a combination of three gestures on a picture of their choosing. The gestures can be any of the following:
A tap
A small clockwise circle
A large clockwise circle
A small counterclockwise circle
A large counterclockwise circle
That might sound too simple to be effective, but a picture with 10 points of interest has 2,744,000 possible combinations of gestures. By default, Windows 8 locks out attackers after five incorrect guesses, meaning that on average, an attacker would need about a quarter of a million separate attempts (without repeating gestures) to guess a password.
If users forget their picture password, they can always type their conventional password to log on to their PC. Of course, if picture passwords do not meet security requirements, you can use Group Policy settings to disable their use in the organization. See the blog post, Signing in with a picture password, to learn more about picture passwords.
If you're interested in trying out picture passwords, from PC Settings on a computer running Windows 8, select the Users page, and then click Create A Picture Password. As shown in Figure 9, Windows 8 prompts you to set up three gestures for your favorite picture. Next, log in a few times to be sure you remember your gestures. If you are concerned about security, show friends how picture passwords work, and ask them to try and guess your picture password.
Figure 9. Picture passwords provide great convenience with excellent security.
Brute force protection
A brute force attack is the process used to break into a device by simply guessing a user's password over and over until the attacker gets it right. Windows 7 and previous versions defended against brute force attacks in a straightforward way—by slowing or preventing additional guesses after multiple mistakes. For example, Windows 8 limits the number of times a user can attempt a picture password or PIN authentication. When using a full password to log in, Windows forces the user to wait several seconds between attempts if they type their password incorrectly multiple times. You can even choose to have Windows lock out an account for a period of time when a brute force attack is detected.
Windows 8 adds an even more powerful—but optional—form of brute force protection. If a brute force attack is detected against any authentication method and BitLocker is used to protect the system drive, Windows 8 will automatically restart the device and put it in BitLocker recovery mode unless a recovery key password is entered. This password is a virtually unguessable 48-character recovery code that must be used before Windows will be able to start normally.
If you're interested in learning how to configure brute force protection, use a test Windows 8 PC with BitLocker protection enabled for the system drive, and print out the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running gpedit.msc and go to Computer Configuration\Windows Settings\Security Settings\Security Options. Open the policy Interactive Login: Machine Account Lockout Threshold, and set the value to 5, as shown in Figure 10.
Figure 10. Brute force protection uses BitLocker security to make it almost mathematically impossible to guess most passwords.
Now, your PC is configured with brute force protection. Restart your PC. When prompted to log in, mistype your password until the PC restarts. Now, try to guess the 48-character recovery key. You will probably be glad you printed it out beforehand.
Virtual smart cards
For many enterprises, a user name and password, which offer single-factor authentication, are increasingly not good enough to secure organization networks, resources, and data. Smart cards have become one of the most common methods of providing multifactor authentication. In the case of smart cards, users need to provide the card itself (something they have) and a PIN (something they know). This prevents an attacker who guesses a user's password from successfully impersonating that user; they'll need to steal their smart card, as well.
Smart cards are not particularly convenient for users, especially mobile users. Imagine an employee travelling on business with their Windows 8 tablet who wants to check their email while waiting for their flight at a crowded terminal. First, they need to start their Windows 8 tablet, which is easy enough. Next, they would need to connect an external USB smart card reader (most tablet PCs do not have internal smart card readers). Then, they would need to dig through their bag to find their smart card, insert it into the smart card reader, and log in—all with other waiting passengers pushing past them to find a seat.
The fact is, if it is that difficult to check their email, most employees simply will not bother. Instead, they will stay out of touch, or they will choose a less secure means of communication that does not require a smart card login, such as personal email, defeating the purpose of the smart card.
Virtual smart cards offer multifactor authentication and compatibility with many smart card infrastructures. Most importantly, virtual smart cards offer users the convenience of not having to carry anything extra, making users more likely to follow their organization's security guidelines rather than working around them.
With virtual smart cards, Windows 8 stores the smart card's certificate in the PC, and then protects it using the device's tamper-proof TPM security chip. In this way, the PC actually becomes the smart card. The user can only access the virtual smart card from PCs that their administrators configure, fulfilling the "something they have" requirement. The user still needs to type a PIN, fulfilling the "something they know" requirement. However, users no longer need to physically connect a smart card or carry a smart card reader, meaning that they can now check their internal email while standing in line waiting to check in—without digging through their bag for a smart card reader. There is also one less item for users to lose or forget, reducing the lost productivity associated with damaged and lost cards.
Of course, enterprises need an efficient way to manage hundreds or thousands of virtual smart cards. Although Microsoft expects several non-Microsoft vendors to offer virtual smart card management solutions, the first available is Intercede's MyID. For more information about MyID, visit Intercede's website. For more information about virtual smart cards, see Understanding and Evaluating Virtual Smart Cards.
If you currently use smart cards, you might choose to use virtual smart cards for specific scenarios. For example, you could allow multifactor authentication using virtual smart cards when connecting remotely to your network but still require a physical smart card to access classified file servers. If you haven't used multifactor authentication before, virtual smart cards are an easy and inexpensive way to get started.
DirectAccess transparently establishes connections between corporate networks and users any time their PC has an Internet connection. What users will notice is they can access internal resources anytime they have Internet access, without a special login and without starting a virtual private network (VPN) connection. If a user with mobile broadband checks their email and clicks a link to a document on the internal network, the link simply works. If a travelling user connected to an airport Wi-Fi hotspot wants to update internal customer data with information from their latest meeting, it works exactly like it does when the user is sitting at their own desk.
As shown in Figure 11, DirectAccess provides automatic, transparent, encrypted, and authenticated connectivity to the internal network. In some ways, DirectAccess works like a VPN, although DirectAccess does not require the user to log in. Figure 11 shows DirectAccess being used in split tunneling mode, which is just one configuration option.
Figure 11. DirectAccess keeps users constantly and automatically connected.
DirectAccess was introduced in the Windows 7 and Windows Server 2008 R2 operating systems but has been improved for Windows 8 and Windows Server 2012. With Windows Server 2012 and Windows 8 Enterprise, you can deploy a DirectAccess infrastructure with a few clicks, even if the network uses Network Address Translation and Internet Protocol version 4 (IPv4). Using more advanced configurations, DirectAccess with Windows Server 2012 can support clients running Windows 8 and Windows 7.
In addition to providing transparent connectivity, DirectAccess also simplifies management of remote PCs by connecting them to the internal network more often and keeping them connected for longer periods of time. For more information about DirectAccess, see Work Smart: Connecting Remotely Using Windows 8 DirectAccess.
Dynamic Access Control
Every systems administrator knows how permissions work: You take the object that you want to secure, give a user or a security group permissions to it, and then you try to keep the user list and security groups up to the date with the correct set of users. It is pretty simple.
This model doesn't scale well; nor does it work for every situation. In the case of file permissions, it does not take into account the content within the files, so a classified document is treated exactly like an unclassified document. File permissions also do not factor in whether the user accessing a file is connected to a secure network or sitting in a coffee shop. Consequently, for many organizations, file permissions just are not flexible enough to protect their data.
With Windows Server 2012 and Windows 8, administrators can solve this problem using a new technology called Dynamic Access Control, which uses dynamic rules-based policies to protect shares, folders, and files. These policies can allow or deny access based on combinations of user, device, and data properties rather than statically maintained user lists and security groups.
The protection capabilities of Dynamic Access Control go beyond simple access control scenarios and can be used to provide persistent protection to data that will continue to protect it even when it is moved off of the original file servers. This is possible when using Dynamic Access Control in combination with Active Directory Rights Management Services (AD RMS), which can encrypt sensitive Microsoft Office documents so that only authorized users can access them. AD RMS also allows administrators to specify whether users can copy, print, forward, and edit documents. For more information about AD RMS, visit Active Directory Rights Management Services on Microsoft TechNet.
Besides authorization, security-focused organizations need detailed information about who accesses confidential files. Using Dynamic Access Control, administrators can also create detail audit policies, potentially documenting who accesses highly sensitive information and meeting compliance reporting and forensic analysis requirements. Unlike traditional auditing capabilities where an ocean of prioritized audit data is collected, Dynamic Access Control and its rules-based policies enable you to either collect everything or, if you choose, target specific data and types of data for auditing.
To compare the two access control methods, imagine how an administrator might restrict access to confidential personnel records:
File permissions. Restrict files and folders so that only members of the Human Resources security group can access them. IT manually adds members of the Human Resources organization to the appropriate groups and manages the group memberships over time.
Dynamic Access Control. Create a policy that allows only members of the Human Resources organization with classified security clearance to access confidential personnel records with personally identifiable information from on-premises PCs configured to meet the organization's security requirements. IT maintains each the user account's properties in AD DS rather than maintaining the users' many group memberships.
Clearly, Dynamic Access Control policies are a more powerful and flexible way to control authorization, and they are particularly useful for meeting regulatory requirements. For more information about Dynamic Access Control, see the blog post, Introduction to Windows Server 2012 Dynamic Access Control.


text:
Establish Your Katy Business! – Katy Commerce Center
Katy Commerce Center
1773 Westborough Drive
Katy, Texas 77449
The Katy Commerce Center offers solutions for new and established businesses that need space and business services. They have 13,000 square feet of office space and 12,000 square feet of warehouse space for rent, in addition to virtual offices, conference rooms, training rooms and hot sites. They also have on-site management, a receptionist, support staff and logistics. So, if your goal is a new enterprise or expansion of your existing business, Katy Commerce Center can help you.


text:
Announcing MSI for 3rd Party Management Partners
Many of you following this blog are very likely familiar with the Media Services Interface (MSI) and the key role MSI plays in the Medianet architecture. The MSI is an SDK residing on rich media applicationsand endpoints that makes the network and applications smarter together. Over the past several months the MSI has been increasingly integrated across a wide range of Cisco applications and endpoints. The path forward looks very exciting with plans for many more rich media applications integrating with the MSI.
The Cisco Developer Network program for Medianet system management partners has been in place for some time now and has been instrumental in helping 3rd party network management system partners leverage the benefits of medianet from a network standpoint. We are pleased to announce the expansion of this program to include MSI interoperability verification and testing for system management partners. For the first time, system management partners that are focused on the endpoint and application side of the equation can use the MSI to proactively monitor application performance and accelerate troubleshooting.
The Media Services Interface 3.2 (available today) provides a robust REST API based management interface. This allows an NMS deliver support for a broad category of operations:
- Session visibility & awareness: Query flows from the endpoint
- Operational Monitoring: Turn performance monitoring on or off on flows for flows of interest
- Accelerated Troubleshooting: Initiate mediatraces and use the results to pin-point the cause of the poor media quality
The MSI and Medianet have been built on an open architecture and support standards so as to make integrating with MSI as easy as possible. A big benefit to application or network management solution vendors, other than the advanced monitoring & troubleshooting capabilities, is the fact that the MSI is a "support once, leverage many times" solution. Supporting the MSI interface once enables NMSes to support different classes of Cisco endpoints and also starting in the near term 3rd party endpoints which also integrate the MSI.
To make it easier for NMS partners to support the MSI, we have also made a reference implementation available.
In the next release of the MSI we are looking to enhance the management interface with a wide array of capabilities including the ability for an NMS to manage thresholds, subscribe to notifications, and consume metadata that describe the flows, the sessions and the applications that own them. This release will also facilitate the discovery of the NMS and the lightweight registration by endpoints that do not necessarily operate with a Communications Manager solution. Cloud based services such as Cisco WebEx as well as Surveillance endpoints will be able to discover and register with an on-premise NMS to enable their network performance to be centrally managed.
IT administrators have always desired a consistent management interface and a single stop solution to manage a seemingly ever-growing variety of rich media endpoints and applications. With the MSI, NMS vendors are now uniquely positioned to effectively address this need.
If you make and sell management solutions or services for rich media endpoints, we strongly encourage you to contact us to see how you can bring the benefits of Medianet and the MSI to your customers.
If you are a Cisco customer and use 3rd party products to manage rich media endpoints on your network, we welcome you to encourage your vendors to get in touch with us to see how they can simplify and accelerate operations via the MSI.
A registration portal via the Cisco Developer network specific to MSI management will be available soon (see the Medianet Tech Center on CDN). In the interim all application and network management system partners are encouraged to reach out to us to obtain the reference implementation to get a flavor for the MSI.
We would also love to talk with you to get your feedback and input around manageability enhancements that are planned for the next release of the MSI.
Learn more:
- Medianet
- Cisco Jabber
- WebEx
- Medianet Knowledge Base
- Media Services Interface (MSI)
- Questions about medianet? Visit the: medianet support forum
In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.


text:
Originally posted by Lewis Shorb
: : Need to find the location of a town called Niggerton not far from Bodie. Was suppose to be founded by some runnaway slaves in the early 1860s Was also well know for I guess you would call it Horse & Buggy Jackings right off the street and trade of Opuim type substance??
: : Thank you ,
: : William
: This town became a ghost because the name was not potlically correct!


text:
England left battered and bewildered
New Zealand set to secure Test and series in Auckland
Kane Williamson, Brendon McCullum and Hamish Rutherford of New Zealand celebrate the wicket of England captain Alastair Cook during day four of the third Test in Auckland. Photograph: Phil Walter/Getty Images
England were in a desperate position at the close of the fourth day of the final Test match dominated by a vibrant New Zealand team in Auckland.
Battered and bruised in the field by a second century in the match from Peter Fulton and McCullumed into oblivion for the umpteenth time in the past two months, England were set the notional target of 484 to win – uncharted territory in that regard for any side in the history of the game – but more realistically 143 overs to bat out and claim a share of the three-match series.
They do have history of surviving such a challenge, most recently the 141 overs they used up against South Africa in Cape Town three years ago, when Paul Collingwood – Brigadier Block – spent four and a half hours over 40 and Ian Bell as long over 78.
As the shadows lengthened though, and the teams left the field, the innings, at 90 for four, was in tatters once more, surely along with their hopes. They lost Nick Compton in the third over of the innings and later Jonathan Trott, a second bastion, to the first delivery purveyed from round the wicket by the indefatigable Neil Wagner, a wide ball at which the batsman drove without due care and attention and edged, an uncharacteristic lapse in his concentration: it was a dismissal that had its roots, perhaps, in the time spent in the field watching the ball sail into the stands.
It appeared that the captain Alastair Cook had the resolve at least to see things through to the close, with Bell digging in alongside him. But like Trott even Cook's powers of concentration wavered and with fewer than four overs of the day remaining he too drove vigorously at Kane Williamson's offbreak where he need not have done, and Dean Brownlie held a stupendous reflex catch at slip.
Cook had made 43 from 145 balls. One further wicket went to what proved the final ball of the day, when Steve Finn, the nightwatchman who survived more than two sessions in Dunedin, prodded a catch, from Williamson once more, to gully where Tim Southee held a second reflex catch. Such things stick when you are on a high. Bell at least remained, with eight runs from 89 balls.
England have been unravelled by the New Zealanders at Eden Park, outbatted by Fulton, a revelation after a four-year absence (to himself as much as anyone no doubt) and recipient of a message from the prime minister for his efforts; outbowled by Trent Boult, Southee and Bruce Martin; outfielded (although that might be harsh for England's rarely flagged under the assault and Matt Prior was terrific throughout); and certainly outgeneralled by McCullum.
It is easy to captain when you have a team on the ropes but New Zealand were able to reach that stage in the first place through his proactivity. The pity is that few Aucklanders have bothered to turn up, even over the weekend, for this has the makings not just of a team that punches above its weight (the default position for Kiwi sides of the past) but with a couple of additions – another top flight batsman for instance, and the return of pacemen such as Doug Bracewell – could be regarded as one of the best around.
Indeed the return series in England, in May, can no longer be looked at as the safe bet it is viewed as by many. A loss here and England will have slipped down the rankings to third place, below India.
Until McCullum pulled the plug on the innings at 241 for six, with a little more than an hour to tea, England had been reduced to rubble. New Zealand already had a sizeable lead at the start of play and after a little early reconnaissance, with licence then, and no consequences, to swing like the Krankies on a Saturday night, batting becomes easier.
England did try a different strategy to Fulton, whose disdain for the offside is matched by his penchant for the onside, by setting a short midwicket and bowling straighter. It might have brought his wicket when he had 32, Anderson unable to cling on in that very position, but it was the last offering he gave until Joe Root held a mishit at long on.
By then he had made 110, his last 60 runs coming from 44 balls, including five sixes as he opened his considerable shoulders: his stand with McCullum was worth 94 from 81 balls and at one time England employed every fielder on the fence except Prior, who in order to do so would have been compelled to hand in his gloves and pads. Later, as England defended, New Zealand had every man bar one around the bat.
Once again they were monstered by McCullum, who should become the threat of choice for errant children: "Be quiet or Brendon McCullum will come and belt your attempted yorker into the stands." In the course of 10 innings in all formats he has made 576 runs at considerably more than a run a ball, hit seven half-centuries and 24 sixes, three of them in his unbeaten 67 here. It is an astounding run of form given the manner in which he plays.
As for his team, they managed 16 sixes in this match, just two short of the record of 18 by West Indies (against England in Antigua in 1986) for a single team in a Test. England's only one thus far has come from Stuart Broad.
Guardian Service


text:
This milk mayonnaise, called maionese de leite in Portuguese, is an emulsion of milk and oil seasoned with garlic and white pepper.
Update August 16, 2014:
I discovered something very interesting about this milk mayonnaise recipe today, and I want to share it with you because I think it could affect your results. I recently bought a new immersion blender, which is my preferred method of making milk mayonnaise. It's less powerful than my older one, and the consistency of the mayonnaise mixture turned out thinner than usual. Hmmmm. So then I really leaned on the blender, but to no avail. That's when I added 2 more tablespoons oil to the milk mayonnaise, and that did the trick to thicken it. So keep in mind: Equipment can affect the success of this recipe.–David
It's the unlikeliest of couples. One thin and popular, the other fat and shunned. Each repelled by the other. But when senselessly beaten into a frenzied submission, oh, how they cave! These two frenemies suddenly give in and embrace one other, creating a more perfect union.
Sound like a bad episode of The Marriage Ref? Not surprising. When these culinary opposites—milk and oil—are thrown together, they act a lot like warring spouses, which makes their participation in the creation of Portuguese maionese de leite (may-o-NEZ duh late), or milk mayonnaise, all the more amazing.
I encountered this ghostly white condiment a few years ago in Portugal while trolling the country for recipes for my cookbook. But on our first date I didn't see it in its shocking bare-naked form. Instead it played the role of a fiendishly good green olive dip at Restaurante A Bolota, in the Alentejo. It was so good, in fact, The One didn't stand a chance. I singlehandedly mopped up the entire bowl with hunks of bread while he nattered away with the restaurant owner, Antonieta Cocheirnha Tarouca, and the chef, Ilda Vinagre. When he looked at the bowl then at me, I just shrugged.
After dinner I followed Ilda into the kitchen to watch her whip up silky clouds and clouds of white buttercream-y goodness in her processador (food processor) using nothing but milk, oil, garlic, and a few drops of lemon juice. What? No eggs? How could it be called a "mayonnaise" without eggs? By definition mayonnaise is a sacred emulsification of egg yolks and oil, which makes it, at least to me, the mother of all mother sauces. But Ilda shook her head: "Não ovos." As she scribbled the recipe on the back of an envelope, she explained she wheedled it out of a chef while visiting Brazil. Then she kissed me goodbye and wished me luck.
And luck was certainly what I needed. My every attempt to make a scaled-down version of her restaurant-size mayonnaise recipe ended in a flood of milk with an oil slick on top. Nothing, and I mean nothing, could keep these two together. Ilda, who found the Internet impertinent and cell phones intrusive, was of no immediate help. Eventually I got through to Antonieta who relayed my frantic pleas to the kitchen. The answer that came back changed everything: Don't make it in a food processor. It's far too big for such a small batch. Bingo! Once I switched over to a mini-chop, I had thick, luscious milk mayonnaise and green olive dip oozing from GladWare containers on almost every shelf of my fridge.
Fast forward two years.
After the book came out, I was positive milk mayonnaise would be one of its most interesting, most blogged about recipes. Milk and oil whipped into an emulsion? It defies all logic. Plus it's eggless. How many people out there have egg allergies? They'll beat a path to my door and throw their jewels and Google stock certificates at my feet as thanks for releasing them from their mayo-less prison, I told myself. But nothing. That is until months later, when Kathleen Purvis and Amanda Hesser wrote about the recipe within a day of each other. Kathleen hit it out of the park on the first try. It took Amanda four late-night attempts to get it right. (She had strayed from the recipe by using a hand mixer instead of an immersion blender or small blender.) The next day I had my 15 minutes of social-media fame—but not because of anything I did. (Note to self: In order to boost your Twitter clout, allow yourself to be pimped by Amanda, even when she's exhausted and misreads your recipes.) Questions poured in. Is it really an emulsion or is it just oil-flavored whipped milk (ack! gross)? Can I use cream instead of milk? Is it stable? Can it be flavored?
So I did as I always do when faced with the perplexing conundrums of food science. I called Shirley Corriher, the doyenne of kitchen wizardry and the award-winning author of CookWise and BakeWise.
"Your mayonnaise is a 100-percent, true emulsion," she assured me over the phone. "It's not any kind of a flavored aerated milk." She went on to explain that for any emulsion—mine included—to take hold, one liquid, in this case the milk, has to break down into finer and finer droplets until it gets "juicy," or looser, allowing the oil to get all up in there between the droplets to thicken it.
"You also have two other things going for you," she added. "Milk has natural emulsifiers, making it easier to blend. And the garlic helps to make a sturdier base before adding the oil." What's the role of the lemon juice? "It helps coagulate the milk, but there's not enough to make it curdle," she said.
Shirley also mentioned that adding a touch of cream would make a better emulsion. Figuring if a little cream is better then a lot must be fantastic, I substituted it for all of the milk and ended up with butter before I even poured in the oil. And for stability? I've had my mayos last up to a week with no ill effect (longer, actually, but my publisher's lawyers would have killed me if I said that in the book).
Last, there's that pesky question of whether the mayonnaise can be flavored. Clearly, not enough of you are buying the book because in it I offer four variations: cilantro and ginger, anchovy, curry, and sun-dried tomato—which, in my magnanimousness, I'm including below.
The case of the milk mayonnaise that may or may not really be a mayonnaise is closed.
Milk Mayonnaise
Since I was given the recipe, I haven't stopped finding ways to cook with it. The master recipe is only a canvas for additions. Besides the uses in this book, I've smeared the variations on grilled meats and fish, used them as dips and in dressings, spread them on sandwiches, and stirred them into potato salads, much as I do with actual mayonnaise.
Atenção: Like all emulsions, this recipe can be a bit finicky. But adding the oil in a thin stream and stopping when the right consistency is reached is the key. For almost foolproof results, a handheld blender is best, but a small canister blender with a narrow base will do.–David Leite
Milk Mayonnaise
- Quick Glance
- Makes 1 cup
- 1/3 cup very cold milk
- 3/4 teaspoon fresh lemon juice
- 1 small garlic clove, peeled
- 1/8 teaspoon freshly ground white pepper
- About 3/4 cup vegetable oil, or 1/2 cup vegetable oil plus 1/4 cup olive oil
- Kosher salt
- 1. Combine the milk, lemon juice, garlic, and pepper in a 2-cup glass measuring cup. Using a handheld blender (or a blender), buzz on high for 30 seconds until frothy.
- 2. With the motor running on high, slowly pour in the oil a few drops at a time, and gradually increase this to a fine thread, moving the blender up and down, until the mixture thickens lusciously and resembles a soft mayonnaise. You may need more or less oil. Season with salt to taste. The mayonnaise will last up to 1 week in the fridge.
- Cilantro and Ginger Milk Mayonnaise | Maionese de Leite com Coentros e Gengibre
- Add 1 loosely packed cup of well-dried fresh cilantro leaves and tendril-soft stems and a 1 1/2-inch peeled and grated thumb of ginger to the cup along with the milk, 1 3/4 teaspoons of lemon juice, and the pepper. Omit the garlic. Whir in the oil as directed above. Stir in 1 scallion cut into thin slices on the diagonal.
- Anchovy Milk Mayonnaise | Maionese de Leite com Anchovas
- Add 6 anchovy fillets (generous 1 tablespoon) packed in oil to the cup along with the milk, lemon juice, garlic, and pepper. Whir in the oil as directed above. Omit the salt.
- Curry Milk Mayonnaise | Maionese de Leite com Caril
- Add 2 teaspoons of your favorite curry powder to the cup along with the milk, lemon juice, garlic, and pepper. Whir in the oil as directed above. Before using, let this sit for an hour or so in the fridge to bloom.
- Tomato Milk Mayonnaise | Maionese de Leite com Tomate
- Add 1 1/2 tablespoons of double-concentrate tomato paste to the cup along with the milk, garlic, and pepper. Omit the lemon juice. Whir in the oil as directed above. Stir in 1 tablespoon minced oil-packed sun-dried tomatoes.
Recipe Testers Reviews
If you make this recipe, snap a photo and hashtag it #LeitesCulinaria. We'd love to see your creations on Instagram, Facebook, and Twitter.


text:
OAKLAND — The city's court-appointed police leader responsible for satisfying long overdue reforms has expanded his mission to include bolstering the ranks of Oakland's severely undermanned force.
Concerned that scheduled police academies won't produce enough recruits to offset retirements and resignations, former Baltimore Police Commissioner Thomas Frazier is demanding quick action to stem attrition, boost recruiting efforts and hire officers from other departments.
Failure to take action would drain Oakland police of its senior leaders and leave it "with an increasing percentage of junior officers," Frazier wrote in his monthly status report released Wednesday.
Assistant chief Paul Figueroa told council members in July that the department was preparing an academy for about eight to 15 recruits from other departments.
Like many major police departments, Oakland has generally chosen to train its own recruits rather than hire from other departments. The last so-called lateral academy fared poorly, police sources have said. Many of the recruits quickly left Oakland for other jobs, and those who remained lost their jobs when the city laid off 80 police officers in 2010.
"My experience is we've never had any luck with laterals staying in Oakland," said Geoff Collins, a police booster who has sat on boards overseeing oral exams for lateral hires.
There are benefits to hiring officers from other departments. They are much less costly to train and can start work after about a 10-week training period.
"Laterals are the quickest way to get officers on the street, and that's what people want to see," Councilman Larry Reid said.
Police union President Barry Donelan said Frazier was right to focus on staffing issues and push for hiring transfers. "Even though we haven't had recent success with lateral academies, we've had success previously with them, and the fact is we need bodies."
As of late July, the department had just 625 sworn officers, despite being authorized for 665. The department's ranks swelled to nearly 650 after a police academy class graduated earlier this year, but a steady stream of retirements and resignations have chipped away at staffing. The department has lost several officers to San Francisco, which pays more than Oakland and has fewer calls for service per officer.
Donelan said morale is low in Oakland, officers get little support from city leadership and have been forced to work mandatory overtime. "It's very difficult to convince officers to stay," he said.
Frazier was granted far-reaching power over Oakland's department earlier this year to push through reforms stemming from the Riders police brutality scandal. Although the reforms are geared toward helping the department police itself, Frazier has expanded his focus to helping the embattled department regain its footing. Last month, he authorized the department to hire retired officers to help do background checks of potential hires.
Frazier wrote Tuesday that the department is struggling with "a substantial number" of deficiencies that impede it from addressing violent crime and meeting reforms. "Crafting sustainable and durable programs that facilitate the delivery of these essential city services has become high priority," he wrote.
August proved to be a difficult month for the reform effort, according to Frazier's report. The department met only two out of 11 benchmarks. Frazier chalked up the poor results to challenges in revising department policies. Cooperation with city leaders, he added, had continued to improve.
Contact Matthew Artz at 510-208-6435.