text:
|Publication number
|Publication type
|Application number
|Publication date
|Nov 20, 2008
|Filing date
|May 14, 2008
|Priority date
|May 14, 2007
|Also published as
|Publication number
|David Hildebrand, Darran Rolls
|Original Assignee
|Sailpoint Technologies, Inc.
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (4), Referenced by (61), Classifications (9), Legal Events (6)
|External Links: USPTO, USPTO Assignment, Espacenet
This application claims priority from Provisional Patent Application No. 60/930,144, filed May 14, 2007, entitled "SYSTEM AND METHOD FOR USER ACCESS RISK SCORING," the content of which is hereby fully incorporated herein for all purposes.
A portion of the disclosure of this patent document contains material to which a claim for copyright is made. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but reserves all other copyright rights whatsoever.
Embodiments of the disclosure relate generally to enterprise access risk management and more particularly to measuring access risk associated with information technology (IT) related resources of enterprises.
Acts of fraud, data tampering, privacy breaches, theft of intellectual property, and exposure of trade secrets have become front page news in today's business world. The security access risk posed by insiders—persons who are granted access to information assets—is growing in magnitude, with the power to damage brand reputation, lower profits, and erode market capitalization.
Escalating security and privacy concerns are driving governance, access risk management, and compliance (GRC) to the forefront of identity management. To effectively meet the requirements of GRC, companies may be required to prove that they have strong and consistent controls over who has access to critical applications and data. And, in response to regulatory requirements and the growing security access risk, most companies have implemented some form of user access or identity controls.
Yet many companies still struggle with how to focus compliance efforts to address actual business risk in their IT (information technology) environment. Decisions about which access entitlements are desirable to grant a particular user are typically based on the business roles that the user plays within the organization. In large organizations, granting and maintaining user access entitlements is a difficult and complex process, involving decisions regarding whether to grant entitlements to thousands of users and hundreds of different applications and databases. This complexity can be exacerbated by high employee turnover, reorganizations, and reconfigurations of the various accessible systems and resources.
A 2007 survey on identity compliance conducted by the Ponemon Institute LLC of Kewadin, Mich. and SailPoint Technologies, Inc. of Austin, Tex. revealed that a majority of organizations do not take an access risk-based approach to identity compliance.
Organizations that are unable to focus their identity compliance efforts on areas of greatest access risk can waste time, labor, and other resources applying compliance monitoring and controls across the board to all users and all applications. Furthermore, with no means to establish a baseline measurement of identity compliance, organizations have no way to quantify improvements over time and demonstrate that their identity controls are working and effectively reducing corporate access risk.
IT personnel of large organizations feel that their greatest security risks stemmed from "insider threats," as opposed to external attacks. The access risks posed by insiders range from careless negligence to more serious cases of financial fraud, corporate espionage, or malicious sabotage of systems and data. Organizations that fail to proactively manage user access can face regulatory fines, litigation penalties, public relations fees, loss of customer trust, and ultimately lost revenue and lower stock valuation. To minimize the security risk posed by insiders, business entities and institutions alike often establish user access policies that eliminate or at least reduce such access risks and implement proactive oversight and management of user access entitlements to ensure compliance with defined policies and other good practices.
Embodiments of the present disclosure provide systems and methods for measuring access risk associated with the internal IT related resources of enterprises that eliminate, or at least substantially reduce, the shortcomings of prior art, access risk measuring systems and methods.
Various embodiments relate to information security, role management, identity management, user access, and user access entitlement management. Embodiments implement systems and methods for providing and improving information security and access risk management. Embodiments provide tools for identifying, evaluating, and responding to the access risks associated with user access to sensitive digital resources such as systems, applications, data, etc.
One embodiment implements a method for measuring access risk associated with an enterprise. The enterprise can have resources accessible by users with entitlements to access the resource. The method can include identifying and documenting the resources, the users, and the access entitlements. Access risk scores can be associated with the entitlements. For each user, the access risk scores associated with the user can be combined to form a composite access risk score which can be output.
One embodiment includes a system which can include resources with access points for various users, a processor in communication with the resources, an output, and a machine readable medium in communication with the processor. The machine readable medium can store instructions which can cause the processor to identify the resources, the users, and access entitlements associated with the resources and users. The instructions can also cause the processor to associate access risk scores with the entitlements. The instructions can cause the processor to, for each user, combine the access risk scores associated with the user to form a composite access risk score.
One embodiment includes machine readable medium which can store instructions for assessing access risk for enterprises. The instructions can cause a processor to identify enterprise resources, users, and access entitlements associated with the resources and users. The instructions can also cause the processor to associate access risk scores with the entitlements. The instructions can cause the processor to, for each user, combine the access risk scores associated with the user to form a composite access risk score.
Embodiments provide systems and methods for measuring access risk associated with an enterprise having potentially numerous resources which can be accessible by various users. Some embodiments implement a method of identifying the resources, users, and entitlements and associating access risk scores with the entitlements. The method can include combining the access risk scores associated with each user to form composite access risks scores for the users and outputting the same. The user with the highest composite access risk score can be identified and remedial action taken. The highest access risk user of some embodiments may be a department, a division, a subsidiary, or an organization. The method can occur in real time and an administrator can be alerted to changes in the entitlements. Access risk scores can be adjusted for compensating controls and personal factors of the users. Personal access risk factors can include geographic locations, demographic characteristics of the user, behavior, personal history, a previous entitlement the user had, a previous role the user had, an entitlement that has been disassociated with the user yet recurs, etc.
Various embodiments provide enterprise level systems which include various internal resources with access points for their users. The enterprise level system can include a processor, an output, and a machine readable memory in communication with each other and the internal resources. The machine readable memory can store instructions which when executed cause the processor to identify the internal resources, the users, and the entitlements. The instructions can also cause the processor to associate an access risk score with each of the entitlements and to combine the access risk scores associated with each individual user to form composite access risk scores for the individual users. The processor can output the composite access risk scores at the output. Machine readable medium storing instructions for measuring access risk associated with enterprise resources are provided by various embodiments.
Methods implemented by various embodiments can identify, measure monitor, and eliminate or mitigate access risks and integrate data relevant to access risk into centralized access risk management solutions. Some embodiments provide insight into potential access risk factors across complex enterprises and allow organizations to proactively focus internal controls to reduce potential compliance exposure and liability as well as other disadvantages associated with previously available access risk management approaches. Access risk can be reduced using advanced analytics which measure baseline access risk, the effectiveness of controls in reducing access risk, and combinations thereof.
Embodiments provide numerous advantages over previously available systems and methods for measuring access risk. Systems and methods disclosed herein can provide IT compliance and governance managers and others simple, intuitive means to assess the effectiveness of access controls and the associated access risk across large numbers of users, applications, systems, etc. By increasing the visibility of user access risk at various levels across various resources, organizations can pinpoint at-risk areas and focus their security and access control efforts where such focus may be desired. At-risk areas can be pinpointed by sorting composite access risk scores of individuals, departments, organizations, and the like and listing those access risks which exceed user selected thresholds. Systems and methods disclosed herein can implement compensating controls which can decrease access risk in situations in which an individual, department, organization, or the like exceeds user selected thresholds.
Embodiments can provide baseline snapshots of user access compliance for a business entity or organization at any point in time. Systems and methods disclosed herein can provide organizations with automated controls to lower individual user access risk scores as well as overall corporate access risk profiles. Methods of scoring access risk, disclosed herein, can enable a business enterprise or organization to track progress over time and provide quantifiable proof of enhanced security and reduced access risk. Systems and methods disclosed herein can provide graphical, intuitive performance tracking of high-access risk users and resources (e.g., systems, applications, data, etc.). Embodiments can provide metrics that can be used to justify security enhancement and access risk reduction initiatives. These metrics can serve as proof of access risk levels; improvements thereto; the effects of re-certification efforts on the same; and attempts to identify and eradicate or reduce access risk issues.
Various embodiments provide systems and methods for notifying users of the access risk status of enterprises. An access risk advisor module of some embodiments sends messages, notifications, reports, alerts, alarms, etc. to the users, system administrators, managers, executives, stakeholders, application owners, etc. These notifications can be based on changes in various access risk scores detected in real time according to various embodiments. The access risk advisor module can be configured to escalate these notifications to appropriate personnel if the initial, and subsequent, notified personnel fail to take appropriate remedial action in a timely manner. The access risk advisor modules of some embodiments can be configured to alert users to the desirability of re-certifying users, systems, resources, data, applications, etc. with access risk levels exceeding user selected thresholds. Re-certifications can occur in real time and on demand in some embodiments. The access risk advisor module can be configured to monitor certain users, systems, resources, data, applications, etc. should they exceed a user selected threshold of access risk. The access risk advisor module can be configured to apply mitigating controls in response to access risk scores exceeding user selected thresholds.
Some embodiments define business roles throughout enterprises in a top down manner. Models of various embodiments can reflect the desired operational objectives of the enterprises. Systems and methods disclosed herein can dynamically correlate users and roles in real time, thereby accurately and in a timely fashion associating those roles, the users, and the capabilities the users have. By dynamically correlating users and roles, systems and methods disclosed herein can identify access entitlements associated with an individual beyond those desirable for the individual's role(s).
In various embodiments, enterprises can perform assessments desirable for improving overall security, detecting potential fraud, and assuring sound management, particularly sound financial management. Various embodiments allow for new, in-depth insights into access risk which can enable enterprises to efficiently, effectively, and globally track, analyze, and control user access to IT resources. Access risks can be quickly and easily assessed in some embodiments. Access risk issues can be identified, prioritized, and immediately remediated or mitigated in various embodiments. By conducting user activity monitoring, eliminating policy violation access risks, and periodic certifications, on-demand certification, scheduled certifications, etc., enterprises can lower access risk. Some embodiments provide access risk trending reports that can measure changes in access risk scores over times providing quantifiable proof thereof.
These, and other, aspects will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. The following description, while indicating various embodiments and numerous specific details thereof, is given by way of illustration and not of limitation. Many substitutions, modifications, additions or rearrangements may be made within the scope of the disclosure, and the disclosure includes all such substitutions, modifications, additions or rearrangements.
A more complete understanding of the disclosure and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers generally indicate like features and wherein:
Various embodiments of the disclosure are illustrated in the FIGURES, like numerals being generally used to refer to like and corresponding parts of the various drawings. Embodiments of the disclosure provide systems and methods for measuring access risk associated with the resources of enterprises.
Before discussing specific embodiments, an embodiment of a hardware architecture for implementing certain embodiments is disclosed herein. One embodiment can include a computer communicatively coupled to a network (the Internet in some embodiments). As is known to those skilled in the art, the computer can include a central processing unit ("CPU"), at least one read-only memory ("ROM"), at least one random access memory ("RAM"), at least one hard drive ("HD"), and one or more input/output ("I/O") device(s). The I/O devices can include a keyboard, monitor, printer, electronic pointing device (such as a mouse, trackball, stylist, etc.), or the like. In various embodiments, the computer has access to at least one database over the network.
ROM, RAM, and HD are computer memories for storing computer-executable instructions executable by the CPU. Within this disclosure, the term "computer-readable medium" is not limited to ROM, RAM, and HD and can include any type of data storage medium that can be read by a processor. In some embodiments, a computer-readable medium may refer to a data cartridge, a data backup magnetic tape, a floppy diskette, a flash memory drive, an optical data storage drive, a CD-ROM, ROM, RAM, HD, or the like.
The functionalities and processes disclosed herein can be implemented in suitable computer-executable instructions. The computer-executable instructions may be stored as software code components or modules on one or more computer readable media (such as non-volatile memories, volatile memories, DASD arrays, magnetic tapes, floppy diskettes, hard drives, optical storage devices, etc. or any other appropriate computer-readable medium or storage device). In one embodiment, the computer-executable instructions may include lines of complied C++, Java, HTML, or any other programming or scripting code.
Additionally, the functions of the disclosed embodiments may be implemented on one computer or shared/distributed among two or more computers in or across a network. Communications between computers implementing embodiments can be accomplished using any electronic, optical, radio frequency signals, or other suitable methods and tools of communication in compliance with known network protocols.
As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having" or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, process, article, or apparatus that comprises a list of elements is not necessarily limited only those elements but may include other elements not expressly listed or inherent to such process, process, article, or apparatus. Further, unless expressly stated to the contrary, "or" refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).
Additionally, any examples or illustrations given herein are not to be regarded in any way as restrictions on, limits to, or express definitions of, any term or terms with which they are utilized. Instead, these examples or illustrations are to be regarded as being described with respect to one particular embodiment and as illustrative only. Those of ordinary skill in the art will appreciate that any term or terms with which these examples or illustrations are utilized will encompass other embodiments, which may or may not be given therewith or elsewhere in the specification and all such embodiments are intended to be included within the scope of that term or terms. Language designating such nonlimiting examples and illustrations includes, but is not limited to: "for example", "for instance", "e.g.", "in one embodiment".
Turning now to various embodiments, historically, security risks associated with user access have been hard to quantify. In large organizations, user access data can be scattered across hundreds of systems and applications and can be difficult to compile, analyze, and present in a manageable format to the persons in position to act on the information. Consequently, most organizations attempt to manage risk in a decentralized manner, focusing on a single application or system at a time.
Such decentralized, one-at-a-time approaches have several drawbacks. With such approaches, managers may not gain enterprise level visibility of access risk across all at-risk resources. Risk management, even within an organization, may be applied sporadically and thus may prove to be insufficient or ineffective in minimizing access risks posed by inside users. Also, when risk management is decentralized, baselines (such as standards, measures, benchmarks, etc.) utilized in assessing risk may vary from department to department, system to system, and application to application even within the same organization. Moreover, previously available approaches can be time consuming, tedious, impracticable, and expensive since conventional risk management processes often consist of manual reviews of user entitlements and access lists. These deficiencies hinder using assess risk as a relative metric.
With reference now to
Users 111 can include employees, supervisors, managers, IT personnel, vendors, suppliers, customers, etc. of enterprise 100. Users 111 may access resources 102 to perform functions associated with their jobs, obtain information about enterprise 100 and its products, services, and resources, enter or manipulate information regarding the same, monitor activity in enterprise 100, order supplies and services for enterprise 100, manage inventory, generate financial analyses and reports, etc.
To accomplish different functions, different users 111 may have differing access entitlements to differing resources 102. Some access entitlements may allow particular users 111 to obtain, enter, manipulate, etc. information in resources 102 which may be relatively innocuous. Some access entitlements may allow particular users 111 to manipulate information in resources 102 which might be relatively sensitive. Some sensitive information can include human resource files, financial records, marketing plans, intellectual property files, etc. Access to sensitive information can allow negligent or malicious activities to harm enterprise 100. Access to particular types of information, when combined with access to other particular types of information can allow negligent or malicious activities to harm enterprise 100. In one scenario, a particular user 111 may, if given access to purchase order entry group of resources 106 and to inventory management group of resources 108, might manipulate information therein to conceal negligence, theft, embezzlement, etc. occurring within the purchasing and inventory control departments of enterprise 100.
Access risks can result from a user having entitlements with which the user can access resources 102 that the particular user should not have access to; gain access to another user's negligently protected entitlements; etc. Access risks can arise from roles in enterprise 100 which may shift, change, evolve, etc. leaving entitlements non optimally distributed among various users. Relationships between various roles in enterprise 100 may also give rise to access risk. Where such access risks might arise, policies can be formulated to control such access risks. For instance, some roles, functions, resources, etc. may be incompatible such as 1) the roles of accountant and auditor or 2) purchase order entry and inventory management resource groups 106 and 108. Rules for detecting incompatible roles being assigned to a particular user can be implemented. By examining users' entitlement sets, roles assigned to various users 111 can be determined and compared to each other according to the policy rules. When particular users have incompatible roles, or roles which violate other policies, access risks can be detected and evaluated
Enterprise 100 can also implement various access risk related compensating controls. Compensating controls can be policies, procedures, actions, steps, security features, which enterprise 100 can implement to control, limit, minimize, etc. various access risks. Compensating controls can include completing access certifications, revoking improper and questionable access entitlements, monitoring access activity, monitoring access entitlements (particularly for entitlement changes), etc. Access related certifications could eliminate or reduce access risks although as access certifications age, certification aging access risks 113 may arise. Access risks and the affects of compensating controls can be identified, measured, reported, and corrected. IT security system 109 can include model 115 which can characterize resources 102, groups of resources 106 and 108, users 111, related entitlements, related access risk and compensating controls, etc. of enterprise 100.
Access risks associated with various aspects of enterprise 100 can be characterized and assessed. Various risk scores such as baseline access risk (BAR) scores, compensating access risk factor (CARF) scores, and composite access risk scores (CARS) associated with access entitlements of various users 111 and groups of users 111 can be determined. Methods for determining various access risk related scores are further disclosed herein with reference to
In determining a CARS score for a particular user 111, selected users 111′ (such as IT personnel, supervisors, managers, etc.) can weight various BAR and CARF subcomponents to indicate the degree to which some subcomponents can contribute to a CARS score for users 111. BAR subcomponents, CARF subcomponents, BAR scores, CARF scores, CARS scores, etc. can be combined for selected groups of users 111.
With reference now to
Now with reference to
Among other aspects of enterprise 100, resources 102 can be characterized in step 302 of
Resources 102 can have associated metadata defining various access related attributes. Some attributes can determine which particular users 111 can access particular resources 102 regardless of entitlements which might (not) have been granted to users 111. One difference that can exist between entitlements and attributes can be that an entitlement can designate that a particular user 111 has access to a particular resource 102. An attribute, though, can determine whether particular users 111 have access to particular resources 102 whether or not they have a particular access entitlement for those particular resources 102. Users 111 with a particular value of the attribute can have access to resource 102. Users without that particular value of the attribute can be denied access to resource 102. In some scenarios, telephone area codes can be an attribute such that if particular users 111 have a certain area code, those users can be granted access to some resource 102. In step 302, therefore, access risks arising from features of resources 102 (such as the nature of resources 102, granted entitlements, and associated attributes) can be characterized and appropriate levels of risk set for each resource 102.
Orphaned accounts, system accounts and privileged user accounts can also influence access risks associated with resources 102. It is some times the case that resource 102 might have an associated number of access entitlements associated with it. Some of these access entitlements can be orphaned as the user population and IT environment (among other factors) change. Access risk levels associated with orphaned access entitlements can be assessed and associated with resources 102 at step 302.
At step 306, access risks associated with users 111 can be identified and assessed. Access risk associated with users 111 can be characterized by considering roles, entitlements, attribute values, and policies associated with users 111. Access risk for each of these aspects associated with users 111 can vary depending on the consequences of potential negligent or malicious activity by user 111. In some scenarios, relatively high access risk level for particular aspects of users 111 (such as a role enabling users 111 to delete particular auditable data trails) can be set. Setting high access risk levels can enable close tracking of particular access risks.
Characterizing access risks of users 111 at step 306 can include considering roles held by users 111. Roles can be associated with logical collections of access entitlements according to enterprise 100 related needs, functions, desires, etc. Thus, roles can be viewed as a pattern or set of entitlements. Access risk can therefore be assessed for access entitlements associated with various roles. In some embodiments, access risk can be assessed against the roles themselves. Access risk levels for various roles can be assessed and associated with users 111 having those roles at step 306.
Step 306 can include ongoing monitoring of enterprise 100 to discover changes in the population of users 111, associated attributes, and associated entitlements. The monitoring can be continuous, periodic, in real-time, on demand, scheduled, etc. User attribute and entitlement discovery (hereinafter "user discovery") can include extracting lists of users 111 attributes and entitlements which have been granted to users 111 to various resources 102 of enterprise 100. With reference now to
As shown in
At step 306 user entitlement sets 402 and entitlement filters 508 (of
When user 111 has a particular entitlement 408 that fails to correspond to any entitlement 506 associated with any role 504, unmatched entitlement 408 can be deemed an "extra entitlement." Extra entitlements 408 for individual users 111 can be grouped together in set 406 of extra entitlements 408. In the current scenario, it can be determined that user 111 has extra entitlements 408B3, 408B5, and 408N2 in extra entitlement set 406.
User entitlement sets 402 and 408 and entitlement filters 508 can be matched using fuzzy logic in which close matches result in user 111 being deemed to have a particular role 504. A fuzzy match can occur when a particular entitlement set 402 matches at least a user selected portion of a particular entitlement filter 508. In some embodiments, the user selected portion of particular entitlement filter 508 includes a majority of entitlements 506 therein. Some embodiments implement configurable fuzzy matching in which users can configure thresholds against which entitlement sets 402 can be deemed to match entitlement filter 508. When the threshold is higher, closer correlation between a particular entitlement set 402 and a particular entitlement filter 508 can result in a match. When the threshold is lower, less precise correlation between a particular entitlement set 404 and a particular entitlement filter 508 can result in a fuzzy match. Users can configure different thresholds for different roles 504, entitlements 506, entitlement filters 508, entitlement sets 402, etc. In one scenario, a particular entitlement filter 508 can include two entitlements 506 of which, one grants greater access to users 111 having that entitlement. In the current scenario, the entitlement 506 granting greater access might have a threshold configured higher than the other entitlement 506. In one scenario, role 504B of
Weightings may be associated with user entitlements 404 to be matched with entitlement filters 508. At step 306, it can be determined whether the combined weight associated with a particular user 111 and a particular entitlement filter 508 exceeds the fuzzy matching threshold for the particular role 504. In one scenario, entitlements 506 of entitlement filter 508 b entitlements are weighted as follows:
Entitlement 506B1
Entitlement 506B2
Entitlement 506B3
Matched by user 111
Entitlement 506B4
Entitlement 506B5
Matched by user 111
User 111 with entitlements corresponding to entitlements 504B3 and 504B5 (of
Entitlement sets 402 of users 111 associated with fuzzy matches can be modified by granting to users 111 entitlements 506 which would cause the fuzzy matches to become exact matches. In some embodiments, which entitlements 506 to grant to particular users 111 to cause fuzzy matches to become exact matches can be determined. Users 111 can be granted entitlements 506B1, 506B2, and 506B4 to complete their entitlement sets 402 with regard to entitlement filter 508. In some embodiments, IT security system 109 notifies a user such as a manager, system administrator, etc. of the possible desirability of granting entitlements 506 to user 111 in order to comply with the entitlement allocation defined by role 504.
Information from efforts to match users 111 to roles can be used to initiate changes to roles, granted entitlements, etc. In one scenario, when a large number of users 111 have a large number (but not all) of entitlements 506 associated with a particular role 504 this condition can indicate that the particular role 504 may have been defined to restrictively. Role 504 may then be modified or various users 111 may be granted the missing entitlements.
Characterizing access risk associated with users 111 at step 306 can also include considering policies applicable to users 111. Policies can be implemented to indicate which users 111 can perform various functions, which users 111 may not be allowed to perform certain functions, etc. One type of policy which is often implemented includes separation of duties policies. Some separation of duty policies indicate that certain functions, roles, etc. should be performed by differing users 111. Separation of duty policies can illustrate how access risk associated with users 111 can be characterized by considering policies. If a particular policy violation (such as a user 111 with entitlements to access purchase order entry resource group 106 is discovered as having entitlements to access inventory management resources group 108) is detected, an access risk level can be set for the particular policy (or violation) and can be associated with users 111 at step 306.
Various entitlements, attributes, and roles can be mapped to associated users 111 to create an identity within enterprise 100. Access risks associated with such identities can also be characterized at step 306.
The effects of compensating controls can be characterized at step 308 of
One type of compensating control can be certification of various aspects of access risks. Certification can include a process of having a designated user 111′ (such as a manager, system administrator, resource owner, etc.) review access risks associated with particular users 111, resources 102, entitlements, attributes, etc. Certification can therefore lower access risks associated with such aspects of enterprise 100. Certification (or recertification) can be triggered by identities, users 111, resources 102, etc. with overall access risk exceeding some user selected threshold. Certification (and recertification) of access risks can occur on a proactive, scheduled, periodic, on demand, random, etc. bases. Since certification can be a dynamic, ongoing process, certification dates can be monitored such that if a certification becomes older than some threshold, access risk may be raised for subjects of the certification.
Another compensating control can be revocation of entitlements. Revocation may occur directly or indirectly by notification of an appropriate manager, administrator, etc. that a revocation might be called for. When an entitlement is revoked, access risk may be re-assessed, thereby accounting for the associated access risk reduction. Extra entitlements 508 can be revoked accordingly to reduce access risk.
Another compensating control, which can be implemented to mitigate access risk, can be implementation of activity monitoring. Activity monitoring can occur at various logs, system control points, etc when access risks associated with some subject exceeds a user selected threshold. Data gathered during activity monitoring can be stored for compliance review, analysis, etc. At step 308, compensating factor levels can be assessed for various compensating controls and associated with applicable subjects identified in steps 302 and 306.
Now with reference to
Steps 604 and 606, respectively, illustrate that various BAR and CARF subcomponents can be configured. Step 604 allows BAR scores to be characterized using a number of access risk subcomponents. BAR scores can characterize the access risk level associated with allowing a particular user 111 access to one or more resources 102 of enterprise 100. BAR subcomponents of some embodiments can reflect: access risk inherent in role(s) 504 or job function(s) of user 111, access risk inherent in extra entitlement set 406 of user 111, and access risk of user 111 violating various policies.
BAR subcomponent scores can be determined using data mined from the IT environment of enterprise 100. Job function access risk can be determined by roles 504 that user 111 plays within enterprise 100 based on access entitlements 506 associated with those roles 504. Entitlement access risk can be determined by the number and type of access entitlements 408 held by user 111 that do not map to roles 504 or to job functions held by user 111 (extra entitlements). Policy violation risk can be determined by the number and type of policy violations detected for a particular user 111.
Using graphical slider bars of graphical user interfaces (GUIs) provided by some embodiments, in step 608, users 111′ can customize the weightings for each BAR subcomponent.
With reference again to step 604 of
With continuing reference to
With continuing reference to step 606, various CARF subcomponents which reduce or increase BAR scores can be configured. Role 504 CARF subcomponents can include subcomponents which can:
Increase role BAR score if role 4F04 has not undergone access certification or failed certification.
Decrease role BAR score if role 4F04 successfully underwent access certification.
Decrease role BAR score if role 4F04 was allowed as an exception during access certification.
Increase role BAR score if role 4F04 if an allowed exception associated with role 4F04 has expired.
Increase role BAR score if role 4F04 was designated for removal during access certification (or any other time) but role 4F04 persists or recurs.
Extra entitlement 508 CARF subcomponents can include subcomponents which can:
Increase extra entitlement BAR score if extra entitlement 508 has not undergone access certification.
Decrease extra entitlement BAR score if extra entitlement 508 successfully underwent access certification.
Decrease extra entitlement BAR score if extra entitlement 508 was allowed as an exception during access certification.
Increase extra entitlement BAR score if an allowed exception associated with extra entitlement 506 has expired.
Increase extra entitlement BAR score if extra entitlement 508 was designated for removal during access certification (or at any other time) but extra entitlement 506 persists or recurs.
In some embodiments, policy violation risks can require that some tasks be separated into disjointed subtasks to be performed by different users 111 with mutually exclusive roles 504. Some policies arise to prevent fraud, conflicts of interest, protection of fiduciary duties, etc. Policies can define a set of rules which can correspond to potential separation of duty (SOD) violations. If a particular user 111 happens to have roles 504 or entitlements 404 or 408 allowing that user 111 to perform two or more tasks which must be disjointed to comply with a SOD policy rule, a SOD violation can be said to exist or, at least, that an access risk of a SOD violation exists. Policy CARF subcomponents can include subcomponents which can:
Increase the SOD policy BAR score if the SOD violation has not undergone access certification.
Decrease the SOD policy BAR score if the SOD violation successfully underwent access certification.
Decrease the SOD policy BAR score if the SOD violation was allowed as an exception during access certification.
Increase the SOD policy BAR score if an allowed exception associated with a SOD policy has expired.
With reference still to step 606, another compensating factor can account for the time, which may have passed since aspects of enterprise 100 underwent access certification. As access certifications age, access risk grows such that aspects of access to resources of enterprise 100 might no longer be optimal. As access certifications age, confidence in the accuracy of the certifications can degrade accordingly. In some embodiments, certification aging CARF subcomponents can increase a BAR score which last underwent access certification longer than some user selectable time ago. In one scenario, 30 days elapses after the sign-off of an access certification before the certification CARF subcomponents begins increasing the BAR score. Certification aging CARF subcomponents can continue increasing the associated BAR score for as long as no new access certification occurs or until some user selected maximum BAR increase occurs. Various certification aging CARF subcomponents can include subcomponents which can:
Increase an appropriate BAR subcomponent if access certification has aged beyond a user selected threshold.
Decrease an appropriate BAR subcomponent if access certification has occurred within a user selected threshold.
Decrease an appropriate BAR subcomponent if a particular role 4F04 was disallowed during access certification.
Decrease an appropriate BAR subcomponent if activity monitoring is occurring for particular users, resources, etc.
In some embodiments activity monitoring may also capture auditable logs of user activity and can serve as a compensating control with an associated CARF subcomponents.
Using graphical slider bars of graphical user interfaces (GUIs) users 111′ can customize the weightings for each BAR score, CARF score, and subcomponents thereof in step 608.
With reference to
Still with reference to
At step 618, users 111 can select a population of users 111 of interest. Individual users' BAR scores, compensated BAR scores, CARS scores, subcomponents thereof, and various combinations, may be combined to create scores for departments, geographic groupings of users, functional groupings of users, the entire enterprise, etc. In some embodiments, such aggregate scores can reflect an average of the corresponding users' scores, a cumulative combination of the corresponding users' scores, etc.
Step 620 shows that method 600 of
With reference now to
Automated controls module 904 can allow organizations to establish consistent, repeatable, internal controls to assist in the mitigation and elimination of access risk. These automated controls can include 1) access certifications such as periodic reviews and approvals of access entitlements, 2) policy enforcement, which can detect, correct, and prevent access policy violations, 3) activity monitors, and 4) activity reports related to high-access risk users and resources as well as other subjects of interest across enterprise 100.
As shown in
Data integration module 908 can discover and correlate users, configuration data pertaining to access entitlements, and user activity data from disparate user accounts, log files, and other data sources, into single, logical representations associated with various users and groupings thereof. In some embodiments, data integration module 908 can use pattern-matching technology to map entitlement data into predefined roles or job functions. Data integration module 908, of some embodiments can transform disparate IT data into centralized information which can be used to proactively manage access risk.
Dashboard module 902 can provide users customizable screens for non-technical users, IT users, etc. Dashboard module 902 can show at-a-glance charts and graphs and provide users the ability to examine related source data. Dashboard module 902 can be an access risk management tool for a variety of users including managers, executives, and compliance and IT staff. In some embodiments, dashboard module 902 can:
Dashboard module 902 (of
Various embodiments provide suites of tools for measuring and tracking access risk. Access risk analytics module 906 can be used to establish baseline access risk assessments of a current state of enterprise compliance with access risk policies, standards, requirements, regulations, etc. Baseline access risk assessments can identify users, resources, applications, systems, groups, departments, etc. with various access risk levels. Dashboard module 902 can allow users to track access risk changes over time and provide measurable proof of enhanced security, lowered access risk, etc.
In some embodiments, users can click on pie chart sectors 1006 or bar segments 1010 to query information underlying the selected sector or bar segment. In one scenario, a user can select IT Department bar 1008D. Dashboard module 902 can display screen 1100 of
Screen 1100 can allow users to query for more detailed information regarding particular users 1102A or various BAR subcomponents 1104A-E. In one scenario, a user can select user 1102A "droberts" and dashboard module 902 (of
Various embodiments offer reporting and ad hoc query tools that enable users to search detailed access risk data and report on access risk trends, statistics, source data, etc. As shown by screen 1300 of
With reference now to
As shown in
With reference to
Various embodiments provide solutions to the problems associated with determining access risk in an organization such as enterprise 100. In some embodiments, solutions include systems and methods for quantifying various types of access risk that can be spread across various resources. In some embodiments, systems and methods utilize data related to user access mined from resources. Various embodiments mine data related to predefined access risk factors and compile multi-dimensional access risk scores based on the mined data. Mined data may be copied from the management stack (or layers thereof such as WAC (web access control) and SIEM (Security Information Event Manager) of various resources. In some embodiments, systems and methods provide information security and access risk management tools for identifying, evaluating, and responding to the access risks associated with user access to enterprise resources. In some embodiments, information security and access risk management tools include browser-based user interfaces through which users can define access risk models. In many embodiments, these tools can run on J2EE platforms. Those skilled in the art will recognize that many other embodiments are possible and within the scope of the disclosure.
Various embodiments implement methods for measuring access risk associated with resources of enterprise 100. Methods of some embodiments can model the enterprise, its systems, applications, programs, data, etc. to define roles and access entitlements associated with those roles. A user discovery engine can collect entitlement information from enterprises 100 in accordance with various embodiments. An entitlement correlation engine of some embodiments can compare the collected entitlement information against sets of entitlements associated with known roles to determine the roles that users currently hold. These sets of entitlements associated with known roles can be termed "entitlement filters." The entitlement filters along with their corresponding roles can be termed "contextual roles" in some embodiments. Methods of some embodiments can assign access risk scores to the entitlements and can combine access risk scores of the entitlements for each user to measure the overall access risk associated with the individual users.
Access certifications, of some embodiments, enable automated, semi-automated, or manual reviews of access entitlements by person or persons within the enterprise. Access certifications can be performed by a user's direct manager or by the resource owner for which access is sought or by various systems discussed herein. In various embodiments, access certification can attest to the correctness of the user's or users' access to resources at the time of certification. Access certifications can also be used to certify that a user's access entitlements which violate enterprise policies can be allowed despite the violation. During access certifications, user entitlements and policy violations can be approved, or exceptions can be allowed, to permit particular access entitlements or policy exemptions for a specific time period. However, because access certifications attest to the correctness of access entitlements, and those entitlements change over time, access certifications age as time passes. Even though a system or application may have been certified some time ago, that certification becomes increasingly less meaningful as the certification ages.
Because users have access to resources the possibility arises that one, or more users may negligently or maliciously misappropriate, misuse, damage, sabotage, etc. some of the resources. In some scenarios, a user may have access to more, or more powerful, resources than warranted by that particular user's roles or functions in enterprise 100. In some scenarios, a particular user might have access to two resources which for policy reasons should not be accessed by the same user. These scenarios, and many others, create the risk that by accessing a resource, a particular user might use that resource improperly thereby causing damage to the enterprise.
In methods according to various embodiments, users such as business process owners, application owners, compliance officers, security officers, chief security officers, auditors, etc. may log in to one or more tools to define access risk models. These access risk models can provide for the access risk scoring disclosed herein. In many embodiments, defining these access risk models may include combinations of identifying potentially risky business processes in enterprise 100; defining business roles and job functions of users involved in the processes; defining access attributes and entitlements; assigning weights to the roles, job functions, attributes, and entitlements; modeling access related policy rules; and assigning weights to those rules. Access risk models of some embodiments can assess and track access risk with respect to user selected IT roles such as chief information officers, chief technical officers, business unit IT managers, IT auditors, IT compliance personnel, IT project managers, customer service representatives, etc. and user selected groups thereof. In various embodiments, defining the access risk models may further include identifying potentially sensitive resources such as systems, applications, data, etc. and obtaining information on users with access entitlements thereto. In some embodiments, user information can be obtained by dynamically discovering and mapping access related data. Other methods of obtaining desired user information such as manual entry are also envisioned and are within the scope of various embodiments.
In some embodiments, systems and methods operate to calculate baseline access risk (BAR) scores for users of various resources. BAR scores can be based on the users' business roles, job functions, responsibilities, duties, and the like and associated attributes, entitlements, and extra entitlements (which do not align with the users' business roles) held by users. BAR scores can be based on detectable violations of access policies by a user, such as separation of duty (SOD) rules. In some embodiments, access risk for applications and other IT resources can be quantified based on orphaned accounts, privileged user accounts, high access risk users, activity policy violations such as access which occurs outside of business hours, remote access, etc. BAR scores can represent un-moderated access risk scores without adjustments for controlling influences imposed upon the access risk sources.
In some embodiments, systems and methods operate to apply compensating factors that can influence BAR scores. Some compensating factors can either reduce or increase BAR scores. Various compensating factors can correspond to compensating controls implemented to influence the access risk underlying the BAR scores. Compensating controls can relate to, but are not limited to: whether a business role has been certified during an access certification; whether a policy exception has been allowed or has expired; whether a remedial action to remove an entitlement has been requested but not performed; whether an entitlement persists or recurs that has been disassociated with a user, and combinations of any of the above. Other compensating controls are also possible and can be readily configured or otherwise implemented in various embodiments. Compensating factors corresponding to compensating controls detected by models of some embodiments can be combined with BAR scores to form composite access risk (CARS) scores for various users. The formulation of CARS scores can be customized or otherwise configurable. Weighting factors may be associated with BAR scores and compensating factors. In some embodiments, CARS scores for individual users can be utilized to generate rolled-up access risk profiles at levels above individual users such as levels corresponding to groups of users, departments, divisions, etc.
Many factors affecting an organization's access risk can be quantified using data mined from applications, resources, systems, and other aspects of IT environments. Access logs, user entitlement lists, system administrator lists, etc. can be mined for data to quantify enterprise 100's access risk. By normalizing and analyzing this data against defined policies and other factors, embodiments can enable business entities, institutions, organizations, and the like to quantify access risk, compile access risk profiles at various levels (e.g., individual, group, department, division, geographic, corporate/enterprise, etc.), track changes in access risk, and perform trend analyses. Some embodiments implement methods in which certain identity attributes can be designated as having a particular influence on access risk. In one scenario, particular identity attributes (such as one indicating that a user accesses resources while located in another geolocation) can indicate that a particular access risk might be associated therewith.
Access risk management, in accordance with various embodiments, can help ensure regulatory compliance in a cost effective manner while also meeting appropriate standards related to enterprise governance. Various embodiments provide solutions which combine automated access risk analytics with automated monitoring and controls thereby allowing organizations to analyze, manage, mitigate, etc. access risk with visibility into various access risk metrics. In accordance with some embodiments, organizations can focus their access risk management efforts strategically, track progress over time, and provide quantifiable proof of enhanced security and reduced access risk.
Various embodiments provide insights into access risk that enable organizations to track, analyze, and control user access to enterprise resources. Some embodiments help organizations assess their access risk, prioritize security efforts, and take remedial action regarding their access risk. Central access risk management systems provided by various embodiments can break down departmental silos, thereby allowing organizations to analyze overall access risk and implement effective enterprise level controls to satisfy regulatory mandates.
Although embodiments have been described in detail herein, it should be understood that the description is by way of example only and is not to be construed in a limiting sense. It is to be further understood, therefore, that numerous changes in the details of the embodiments and additional embodiments will be apparent, and may be made by, persons of ordinary skill in the art having reference to this description. It is contemplated that all such changes and additional embodiments are within scope of the claims below and their legal equivalents.
|Cited Patent
|Filing date
|Publication date
|Jun 20, 2003
|Dec 23, 2004
|Microsoft Corporation
|Efficient fuzzy match for evaluating data records
|Sep 13, 2005
|Apr 6, 2006
|Achilles Guard, Inc. Dba Critical Watch
|Method and system for applying security vulnerability management process to an organization
|Apr 11, 2006
|Oct 11, 2007
|Bank Of America Corporation
|Application Risk and Control Assessment Tool
|Aug 2, 2007
|Feb 28, 2008
|Aveksa, Inc.
|System and method for collecting and normalizing entitlement data within an enterprise
|Citing Patent
|Filing date
|Publication date
|Jun 30, 2005
|Mar 27, 2012
|Armstrong, Quinton Co. LLC
|Methods, systems, and computer program products for role- and locale-based mobile user device feature control
|Jul 24, 2009
|Jul 17, 2012
|Bank Of America Corporation
|Dynamic entitlement manager
|Mar 26, 2009
|Aug 7, 2012
|Symantec Corporation
|Applying differing security policies for users who contribute differently to machine hygiene
|Jun 30, 2009
|Nov 13, 2012
|Symantec Corporation
|Using URL reputation data to selectively block cookies
|Jul 24, 2009
|Nov 20, 2012
|Bank Of America Corporation
|Dynamic community generator
|Jul 28, 2010
|Nov 27, 2012
|Bank Of America Corporation
|Technology evaluation and selection application
|Sep 30, 2008
|Jan 8, 2013
|Symantec Corporation
|Determining firewall rules for an application on a client based on firewall rules and reputations of other clients
|Feb 2, 2010
|Mar 5, 2013
|Bank Of America Corporation
|Compliance methodology
|Jan 28, 2009
|Apr 2, 2013
|Fujitsu Limited
|Access control policy compliance check process
|Jan 25, 2011
|Apr 9, 2013
|Bank Of America Corporation
|Systems and methods for performing access entitlement reviews
|Jan 27, 2012
|Jul 9, 2013
|Chapman Technology Group, Inc.
|Software service to facilitate organizational testing of employees to determine their potential susceptibility to phishing scams
|Jul 31, 2009
|Oct 22, 2013
|Symantec Corporation
|Enforcing good network hygiene using reputation-based automatic remediation
|Nov 21, 2012
|Dec 10, 2013
|YeeJang James Lin
|Method for adaptively building a baseline behavior model
|Mar 5, 2013
|Dec 24, 2013
|PhishMe, Inc.
|Simulated phishing attack with sequential messages
|Mar 5, 2013
|Jan 21, 2014
|PhishMe, Inc.
|Performance benchmarking for simulated phishing attacks
|May 9, 2012
|Feb 18, 2014
|Google Inc.
|Userspace permissions service
|Oct 29, 2009
|Mar 25, 2014
|Bank Of America Corporation
|Reputation risk framework
|Mar 5, 2013
|May 6, 2014
|PhishMe, Inc.
|Collaborative phishing attack detection
|Aug 15, 2011
|May 13, 2014
|Bank Of America Corporation
|Method and apparatus for token-based attribute abstraction
|Feb 21, 2012
|May 27, 2014
|Armstrong, Quinton Co. LLC
|Methods, systems, and computer program products for role- and locale-based mobile user device feature control
|Jun 27, 2008
|Jun 24, 2014
|Bank Of America Corporation
|Dynamic entitlement manager
|Oct 29, 2009
|Jul 8, 2014
|Symantec Corporation
|Applying security policy based on behaviorally-derived user risk profiles
|Aug 28, 2009
|Jul 29, 2014
|Src, Inc.
|System and method for organizational risk analysis and reporting by mapping detected risk patterns onto a risk ontology
|Jun 15, 2010
|Aug 19, 2014
|International Business Machines Corporation
|Managing and monitoring continuous improvement in detection of compliance violations
|Jan 15, 2013
|Sep 30, 2014
|Taasera, Inc.
|Runtime risk detection based on user, application, and system action sequence correlation
|Feb 8, 2013
|Feb 24, 2015
|PhishMe, Inc.
|Performance benchmarking for simulated phishing attacks
|Jun 19, 2013
|Apr 28, 2015
|International Business Machines Corporation
|Intelligent risk level grouping for resource access recertification
|Jun 14, 2011
|Jun 2, 2015
|Novell Intellectual Property Holdings, Inc.
|Event source management using a metadata-driven framework
|Feb 8, 2013
|Jun 9, 2015
|PhishMe, Inc.
|Simulated phishing attack with sequential messages
|Aug 15, 2011
|Jun 9, 2015
|Bank Of America Corporation
|Method and apparatus for token-based combining of risk ratings
|Mar 13, 2013
|Sep 15, 2015
|International Business Machines Corporation
|Generating role-based access control policies based on discovered risk-averse roles
|Aug 17, 2013
|Sep 15, 2015
|International Business Machines Corporation
|Generating role-based access control policies based on discovered risk-averse roles
|Jun 30, 2005
|Jan 4, 2007
|Singh Munindar P
|Methods, systems, and computer program products for role-and locale-based mobile user device feature control
|Mar 7, 2008
|Sep 10, 2009
|International Business Machines Corporation
|Risk profiling for enterprise risk management
|Jan 28, 2009
|Dec 3, 2009
|Fujitsu Limited
|Access control policy compliance check process
|Aug 28, 2009
|Mar 3, 2011
|Src, Inc.
|Adaptive Risk Analysis Engine
|Oct 29, 2009
|May 5, 2011
|Bank Of America Corporation
|Reputation Risk Framework
|Feb 2, 2010
|Aug 4, 2011
|Bank Of America Corporation
|Compliance methodology
|Oct 6, 2011
|Salesforce.Com, Inc.
|System, method and computer program product for determining a risk score for an entity
|Jun 15, 2010
|Dec 15, 2011
|International Business Machines Corporation
|Method and System for Managing and Monitoring Continuous Improvement in Detection of Compliance Violations
|Jan 5, 2012
|Bank Of America Corporation
|Process risk prioritization application
|Jan 25, 2011
|Feb 23, 2012
|Bank Of America Corporation
|Systems and methods for determining risk outliers and performing associated risk reviews
|Jan 25, 2011
|Feb 23, 2012
|Bank Of America Corporation
|Systems and methods for performing access entitlement reviews
|Sep 13, 2010
|Mar 15, 2012
|Microsoft Corporation
|Reputation checking obtained files
|Apr 9, 2012
|Oct 11, 2012
|Wombat Security Technologies, Inc.
|Context-aware training systems, apparatuses, and methods
|Aug 15, 2011
|Feb 21, 2013
|Bank Of America Corporation
|Method and Apparatus for Token-Based Combining of Risk Ratings
|Mar 28, 2013
|YeeJang James Lin
|Method for Adaptively Building a Baseline Behavior Model
|Mar 15, 2013
|Oct 3, 2013
|Wipro Limited
|Methods for improved provisioning of information technology resources and devices thereof
|Apr 4, 2013
|Oct 10, 2013
|Iris Consolidated, Inc.
|System and Method for Security Management
|Jul 2, 2012
|Jan 2, 2014
|International Business Machines Corporation
|Context-dependent transactional management for separation of duties
|Sep 10, 2012
|Mar 13, 2014
|International Business Machines Corporation
|Identity context-based access control
|Nov 27, 2012
|May 8, 2014
|Institute For Information Industry
|Information security audit method, system and computer readable storage medium for storing thereof
|Mar 13, 2013
|Jul 10, 2014
|International Business Machines Corporation
|Generating role-based access control policies based on discovered risk-averse roles
|Aug 17, 2013
|Jul 10, 2014
|Interntional Business Machines Corporation
|Generating role-based access control policies based on discovered risk-averse roles
|Jun 19, 2013
|Dec 25, 2014
|International Business Machines Corporation
|Intelligent Risk Level Grouping for Resource Access Recertification
|Nov 10, 2014
|Jun 25, 2015
|Projectioneering Llc
|Metadata Database System and Method
|Jan 31, 2011
|Aug 11, 2011
|Bank Of America Corporation
|Compliance methodology
|Aug 16, 2011
|Feb 23, 2012
|Bank Of America Corporation
|Systems and methods for performing access entitlement reviews
|Nov 17, 2011
|May 24, 2012
|Projectioneering, LLC
|Metadata database system and method
|Dec 20, 2013
|Jul 3, 2014
|Equifax, Inc.
|Systems and methods for network risk reduction
|Jan 14, 2014
|Jul 24, 2014
|Taasera, Inc.
|System for and a method of cognitive behavior recognition
|U.S. Classification
|705/7.28, 705/7.42
|International Classification
|Cooperative Classification
|European Classification
|Jun 11, 2008
Owner name: SAILPOINT TECHNOLOGIES, TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HILDEBRAND, DAVID;ROLLS, DARRAN;REEL/FRAME:021082/0966
Effective date: 20080513
|Jul 14, 2008
Owner name: SAILPOINT TECHNOLOGIES, INC., DELAWARE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HILDEBRAND, DAVID;ROLLS, DARRAN;REEL/FRAME:021231/0667
Effective date: 20080630
|Jul 16, 2008
Owner name: SAILPOINT TECHNOLOGIES, INC., DELAWARE
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HILDEBRAND, DAVID;ROLLS, DARRAN;REEL/FRAME:021249/0819
Effective date: 20080630
|Nov 2, 2011
Free format text: SECURITY AGREEMENT;ASSIGNOR:SAILPOINT TECHNOLOGIES, INC.;REEL/FRAME:027161/0336
Effective date: 20111019
Owner name: SQUARE 1 BANK, NORTH CAROLINA
|Sep 9, 2014
Owner name: SAILPOINT TECHNOLOGIES, INC., TEXAS
Free format text: RELEASE OF SECURITY INTEREST;ASSIGNOR:SQUARE 1 BANK;REEL/FRAME:033697/0066
Effective date: 20140908
|Sep 11, 2014
Owner name: SILICON VALLEY BANK, CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:SAILPOINT TECHNOLOGIES, INC.;REEL/FRAME:033720/0014
Effective date: 20140908


text:
|This document may not represent best practices for current development, links to downloads and other resources may no longer be valid. Current recommended version can be found here. ArchiveDisclaimer
ContentType Element (ContentType)
This content is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these technologies. This page may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.
Defines a single content type.
<ContentType BaseType="Text" ID="Text" Name="Text" Group="Text" DocumentTemplate="Text" ResourceFolder="Text" ReadOnly="TRUE" | "FALSE" Hidden="TRUE" | "FALSE" Description="Text" Sealed="TRUE" | "FALSE" V2ListTemplateName="Text" Version="Integer" FeatureId="Text"> </ContentType>
Reserved for internal use.
Required Text. Specifies the content type ID of the content type.
Required Text. Specifies the content type name.
Optional Text. Specifies the content type group to which the content type is assigned. Content type groups are user-defined groups that help you organize your columns into logical categories.
Optional Boolean. TRUE to define the content type as read-only.
If you do not include this attribute, Windows SharePoint Services treats the content type as if this attributes was set to FALSE.
Optional Boolean. TRUE to define the content type as hidden. If you define a content type as hidden, Windows SharePoint Services does not display that content type on the New button in list views.
If you do not include this attribute, Windows SharePoint Services treats the content type as if this attributes was set to FALSE.
Optional Text. Provides a description for the content type, to display in the Windows SharePoint Services user interface.
Optional Boolean. TRUE to define the content type as sealed. You must have site collection administrator rights to unseal and edit a content type defined as sealed.
If you do not include this attribute, Windows SharePoint Services treats the content type as if this attributes was set to FALSE.
Optional Text. Specifies the Windows SharePoint Services 2.0 list template type to which this content type maps. For example, the Document content type maps to the Document Library list template.
Reserved for future use.
Optional Text. Provides the ID of the feature in which the content type is packaged.
For more information about content types, see Content Types.
For more information about assigning content type IDs, see Content Type IDs.
For more information about read-only and sealed content types, see Content Type Change Control.
For more information about hidden content types, see Content Type Access Control.
The following example is the content type definition of the Document content type. The example has been edited for clarity.
<ContentType ID="0x0101" Name="$Resources:Document" Group="$Resources:Document_Content_Types" Description="$Resources:DocumentCTDesc" V2ListTemplateName="doclib" Version="0"> <FieldRefs> <RemoveFieldRef ID=FID_Attachments Name="Attachments" /> <!-- Attachments --> <RemoveFieldRef ID=FID_WorkflowVersion Name="WorkflowVersion" /> <!-- WorkflowVersion --> … <FieldRef ID=FID_SelectFilename Name="SelectFilename" /> <!-- SelectFilename --> <FieldRef ID=FID_FileLeafRef Name="FileLeafRef" Required="TRUE"/> <!-- FileLeafRef --> <FieldRef ID=FID_Created Name="Created" Hidden="TRUE" /> <!-- Created --> <FieldRef ID=FID_Title Name="Title" Required="FALSE" ShowInNewForm="FALSE" ShowInEditForm="TRUE"/> <!-- Title --> … </FieldRefs> <XmlDocuments> <XmlDocument NamespaceURI="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"> <FormTemplates xmlns="http://schemas.microsoft.com/sharepoint/v3/contenttype/forms"> <Display>DocumentLibraryForm</Display> <Edit>DocumentLibraryForm</Edit> <New>DocumentLibraryForm</New> </FormTemplates> </XmlDocument> </XmlDocuments> </ContentType>

subset: commoncrawl


text: Razuna API - Developers Share via FacebookShare via TwitterShare via LinkedinShare via Google+Share via RedditShare via Mail The Razuna API lets developers integrate Razuna into their custom solutions. Razuna is an open source digital asset management system. The API uses both REST and SOAP protocol and responses are formatted in XML. Track this API Summary Sample Code How To Developers Comments Followers Summary Sample Code How To Developers Comments Followers Developers (0) Add Mashup


text:
My first thought when seeing Sean Murphy's art on Joe the Barbarian was, "Why isn't this guy bigger? Why isn't he working for Marvel?" I now understand that he's bigger than Marvel. Go read Tokyo Ghost.
Does anyone else feel that these Secret Wars minis are crap?
Seriously. This isn't a slam against the creators; it just that it feels like these stories are being told because people want to keep their job (as opposed to having legit stories they want to tell). Take, for example, Future Imperfect. Great fuckin' artwork. And I don't even like Greg Land. Normally, his stuff always seems stiff and photo-refferenced all over the floor. However, he destroys it on Future Imperfect: he's got tons of bulky, exaggerated Hulk and nice, dynamic action spilling of all the actions scenes. Yet, despite the amazing art job, the story has a plodding pace that kills any enjoyment of the first 4 issues. The final issue, however, is really frickin good. So good that it almost made up for the bore contained in the first four.
Which leads me to my point: this should have a been a single issue, done-in-one story. Cuz that's about how much story there was too tell. Yet, since it was a Marvel Event, and editorial needed a 5 issue story, this one, very good story was stretched to become one long story that wast mostly all boring.
Which is a lot more than I can say about the other Secret War mini I am going to mention: Spider-verse. Now I bought this book because I am collecting every appearance of Spider-Gwen. But fuck you Marvel, 'cuz you know that there are a lot of people like me who were going to buy this book since the millisecond it was announced. And because of that, you knew you could throw any schlock in between those covers and it would sell until the last issue. And you did.
Again, I don't know if I would fault the creators: I liked the indy feel to the art, and the writer did a good job at differentiating all the different Spider-characters. However, the plot was a very basic "we need an excuse to get these characters together as a team", and as we now know, the book is just a lead-in to the upcoming Web Warriors series (stupid idea, IMO- the original Spider-verse was a lot of fun, now please let it die already!). Thank God-Doom for Spider-Ham. Evertything he says in this book is gold, and each of his scenes are maximum entertaining. His interactions with the other characters almost make up for the flatness of the plot.
I haven't read any reviews yet or heard legit word-of-mouth on any break-out minis that are like OMG I GOTTA HAVE THIS. (Remember how the original Edge of Spider-verse was like that?) If I do hear/read/smell anything, I'll share it here.
Holy wow I didn't expect this book to be this good!!
One of my über smart friends from college picked up one of the random books I had in my pile on day. It was written by Zander Cannon. My friend was all, "this guy knows his story construction." or something along those lines. Dude was smart, so I took his word for it and bought more issues. I never actually read them- still have them somewhere.
Years later, I see this book, Kaijumax on the shelves. I don't like Ultra Man, or giant monster movies, or Godzilla or even prison movies (except Shashank Redemption). Yet, somehow, I am loving this book. Give it maybe 3 or 4 issues if you aren't feeling with issue #1 (I'll admit, I didn't feel that issue either). The story takes a few issues to put the pieces into place, but once it gets there things really take off.
The final issue of the 1st story arc is released this Wednesday, which means if you can't track down all of the back issues, the collected trade paperback should be available soon.
in honor of Batman Day (or whatever it is people are talking about)
Long story short, because of a viral crap thing, I needed to change my profile picture to a picture of Batman. I was trying to think of something creative to use, like a picture of Adam West in costume, when I figured that it was time to pick up a pencil again and draw my own picture. I did this in a few hours (most of the time was spent trying to navigate the crappy paint program on my iPad 3 that I used to color it). I WON'T be giving a plug to that program. On a tangental note, I need to check out if the new super iPad + Apple pencil is cheaper than one of those monster Wacom tablets that let you draw directly on your art. Cuz that's what I need in my life.
A little edumacation about PSYCHOSIS (for comic fans and creators)
One mistake that I see all of the time in comics: writers will talk about "psychotic" characters. Cletus Cassidy (aka Carnage) is one example of a character who is constantly identified as psychotic. He's a murderous psychopath. Which is cool, except for that there's NOTHING about being a murderous psychopath that makes you psychotic. Psychotic people have visual hallucinations or they hear voices, feel spiders crawling on them or crap like that, or they're all frozen and catatonic. They don't kill people, they're not remorseless, and they certainly don't act anything like Carnage.
Now that I've said it, can people please reblog this to help spread this knowledge? Maybe people who make comics will get to read it.
Likin' the new Ghostbusters team
The new Ghostbusters are here. Check them out:
Know what's sad? It's sad that I almost expected female Ghostbusters to be wearing form-fitting uniforms and to have model bodies. Not "almost": I did expect that. It's literally a fucking shame, because yes, I am embarrassed to admit that I expected women Ghostbusters to be depicted sexually. But my expectations were wrong, and I'm glad they were wrong. Cuz what we got was 20 fucking times better than what I was expecting!!
There was nothing sexy about the original Ghostbusters: they were goofy, bumbling and funny. I like that a team of female Ghostbusters will be in this new film, and they're keeping the same comedic feel of the first movies. They look bad-ass. They look rag-tag. They look like underdogs, and if there's one thing we liked about the original team of misfits, it's that they were underdogs. Let's hope that this movie kicks as much ass as this team shot is promising, and let's hope that people are willing to receive something different from what they were most likely expecting.
The power of comics as a medium
I thought this was a powerful example of how effective the comic medium can be at illustrating a point over straight text, or even film. I linked the image to its source (TheWireless.co.nz).
Dumb Shit
I hate when people say dumb shit, like, "Sienfield is a show about nothing." Of course it's a show about something! It's about four unmarried people living in an apartment complex who philosophize about the mundane. A show can't be about nothing, because then there would be no show.
Erik Larsen and Kanye West
Seriously. Larsen is like the Kanye West of comics. He shoots off at the mouth with poorly worded statements that make him come off as an asshole, yet when you listen in depth about what he was really trying to say, it makes sense. Case in point: this article explaining his statement about female superhero costumes.
Who's Crash Ryan? I dunno, but I'm down for the movie
I've never heard of Crash Ryan before, but this article from ICV2 definitely got me interested. I'm down for a movie about "a steampunk-inspired fusion of Indiana Jones and Star Wars."


text:
Select Local Merchants
Easy Airport ParkingRead MoreEasy Airport Parking offers safe haven to cars whose owners are bound for Indianapolis International Airport. Drivers silence engines in a valet lane and exchange keys or ignition-lodged screwdrivers for a claim check, relinquishing vehicles to employees who steer them into a standard or oversize spot. They then hop aboard a shuttle bus that drops off at terminals within 5 or 10 minutes. Since the buses run 24 hours a day, jet setters can call for a pickup as soon as they return, no matter the hour. The parking lot is also open all day and night, with security fences, cameras, and guards watching over roadsters and keeping patrons' personal chauffeurs from escaping. For an additional fee, cars can freshen up with a wash.5773 W Washington St.Indianapolis, IN US
Indy Park Ride and FlyRead MorePark Ride & Fly USA's car caretakers protect vacationing cars within 24-hour, well-lit parking lots near airports in more than 30 states. After dropping off their automobiles, customers can transport themselves and their luggage to the airport aboard one of the company's complimentary shuttles or human-size hamster balls. While away, patrons rest easy knowing that their steel steeds are safe within fenced lots that are monitored by 24-hour surveillance. At many locations, shuttles also swing by the terminal to pick up returning travelers and reunite them with their respective vehicles, which are first freed of cloud-based artillery, including snow or recently rained molasses.3875 Plainfield RdIndianapolis, IN US
Wheel Fun Rentals IndianapolisRead MoreEagle Creek Outfitters doles our an array of watercraft such as sailboats, kayaks, and canoes, all of which can be used to explore a 1,400-acre lake. Paddle programs, from either kayaks or canoes, are held weekly on Wednesdays at night. During these programs, an experienced guide leads guests around the reservoir, divulging its stories and history while paddlers enjoy the sites and sounds of the area. All gear and instruction is provided.7602 Walnut Point RoadIndianapolis, IN US


text:
|ESPN.com: College Basketball Nation
|[Print without images]
"I texted him and said, 'Gotta talk,'" Nored said. "He wrote, 'What do we gotta talk about? So when he called me back I told him I had the chance to be the head basketball coach at Brownsburg. He said, 'What? Are you serious? You better do that. You can't turn that down.' The fact that Gordon was so excited about it was good for me because Gordon and I are so close that he can be honest about things with me. If he thought it wasn't a good decision, he would have told me that and I would have respected it. But his excitement got me excited for it as well and definitely had some input in my decision."


text:
By Catholic Online (NEWS CONSORTIUM)
10/8/2013 (2 years ago)
Catholic Online (www.catholic.org)
It's a fun graphic that shows the enormous land mass of the African continent. While its creator Kai Krause says the graphic doesn't truly depict the continent's land mass, it shows that Africa is as big as India, China, the United States and most of Europe - put together.
By Catholic Online (NEWS CONSORTIUM)
Catholic Online (www.catholic.org)
10/8/2013 (2 years ago)
Published in Africa
Keywords: Africa, landmass, graphic
LOS ANGELES, CA (Catholic Online) - The graphic shows Africa as big as 13 nations and Eastern Europe. It must be noted, however, that the biggest nation in terms of landmass is Russia, at more than 17 million square feet.
The United Kingdom is also featured on the graphic, covering the island of Madagascar. Overall, Africa is more than 30 million square kilometers.
This graphic illustrates that its size is not shown accurately on a standard Mercator map, where countries in the center appear smaller than they are. Designer IO9, the creator of the graphic notes that accuracy is compromised for neatness and "straight lines."
This graphic shows Africa is bigger than the land masses of the U.S., China, India, Mexico, Peru, France, Spain, Papua New Guinea, Sweden, Japan, Germany, Norway, Italy, New Zealand, the UK, Nepal, Bangladesh and Greece put together.
Th graph also lists the top 100 countries in the world in terms of biggest land size. Russia, Canada, China, the U.S. and Brazil make up the top five.
The clever illustration also shows how easily the whole of Europe would fit into Africa, as well as some of the biggest nations in the world individually.
Creator Kai Krause overlaid Portugal, Belgium, the Netherlands, Switzerland, the UK, Japan, China, India, Eastern Europe, Italy, Germany, France, Spain and the U.S. on to the continent.
Discover the true meaning of Christmas!
Brown Wood Family Rosary
St Patrick Rosary
By Nikky Andres (CALIFORNIA NETWORK)
Scientists recently discovered over 1,500 bones belonging to 15 individuals, ranging from babies to the elderly Homo naledi species. This species, assigned to the genus Homo, was apparently capable of walking and swinging in trees. LOS ANGELES, CA (Catholic Online) - ... continue reading
By Talia Ramos (NEWS CONSORTIUM)
After years performing in a Bulgarian circus, brothers Jora and Black got to experience a real magical moment following a 10,500-mile journey to Africa, where the lions got to experience freedom and their natural habitat for the first time. LOS ANGELES, CA ... continue reading
By Catholic Online (NEWS CONSORTIUM)
Boulders located on the top of Santiago Island has scientist Ricardo Ramalho, at the Lamont-Doherty Earth Observatory at Columbia University, that giant, mega-tsunamis in prehistoric times hurled them 900 feet in the air. The theory is an intriguing one - ... continue reading
By Catholic Online (NEWS CONSORTIUM)
The theory offered by British archaeologist Nicolas Reeves that Queen Nefertiti's final resting place is hidden away in a chamber inside King Tut's tomb excited archaeologists worldwide last year. However, the theory is based on pure speculation. Experts point out ... continue reading
By Hannah Marfil (NEWS CONSORTIUM)
Thousands of Sudanese women and girls as young as 12-years-old have been abducted and repeatedly raped by several men, sometimes all at once. The women are usually held captive indefinitely in secret rape camps maintained by government soldiers or abused until they are ... continue reading
By Catholic Online (NEWS CONSORTIUM)
The Catholic Bishops of Africa's Congo has spoken out against the relentless exploitation of that nation's material wealth. The bishops are highly critical of Western governments who have failed to act, and are urging church groups to follow the Pope's call to ... continue reading
By Catholic Online (NEWS CONSORTIUM)
Much mystery and speculation remains on the final resting place of Queen Nefertiti, "the beautiful one." British archaeologist Nicholas Reeves has now received permission from Egyptian authorities to search Tutankhamen's tomb for the final resting place of ... continue reading
By Catholic Online (NEWS CONSORTIUM)
There is an improved rate of survival in Africa with the introduction advanced medical technologies. Because of this, the population along with the continent is sure to grow. According to the British Broadcasting Corporation, or BBC, Africa's population will ... continue reading
By Catholic Online (NEWS CONSORTIUM)
A new species of early human being has been confirmed with the discovery of fossilized remains in South Africa. Discovered inside a cave, the Homo naledi has been assigned to the genus Homo to which modern man belongs. LOS ANGELES, CA (Catholic Online) - ... continue reading
By Kenya Sinclair (NEWS CONSORTIUM)
Archaeologists have discovered 1,500 fossils dated 2.8 million-years-old in a subterranean chamber just outside Johannesburg South Africa in an area called the "Cradle of Humankind." LOS ANGELES, CALIFORNIA (Catholic Online) - The fossils were originally discovered in ... continue reading


text:
Friday, January 14, 2011
© Copyright 2015 Gwinnett Daily Post
Zsa Zsa Gabor's right leg amputatedLOS ANGELES — Doctors in Los Angeles say they have successfully amputated most of Zsa Zsa Gabor's right leg. They said Friday's surgery at the Ronald Reagan UCLA Medical Center was successful and the 93-year-old ''Moulin Rouge'' and ''Queen of Outer Space'' star is recovering. Gabor had an infection in her leg for several months and doctors tried using antibiotics to save the leg. She was hospitalized Jan. 2. Publicist John Blanchette said the wound wouldn't heal, making the surgery necessary. Gabor broke her hip and had replacement surgery in July, and has been hospitalized several times since for swelling in her legs and blood clots throughout her body. Steve Carell leaving 'The Office' early PASADENA, Calif. — Steve Carell will be leaving ''The Office'' early. The NBC comedy's executive producer, Greg Daniels, said Carell will be gone before the season-ending episodes in May. The final episodes of the season will focus on the scrambling to replace him at the Scranton branch of the mythical Dunder Mifflin paper company. Carell had said previously that he was quitting the show to concentrate on his movie career. But NBC plans to press on without him. NBC said Friday that Carell will leave with four episodes left in the season. That means his farewell episode will most likely come in April. Sissy Spacek writing memoir NEW YORK — Take off your shoes and relax: Oscar winner Sissy Spacek has a few stories to tell. Hyperion announced Friday that it's publishing her memoir, which is tentatively called ''Barefoot Stories.'' The book is scheduled to come out next year. The 61-year-old actress won an Academy Award in 1981 for ''Coal Miner's Daughter,'' in which she played country singer Loretta Lynn. She also starred in the horror classic ''Carrie.'' She was seen last year in ''Get Low,'' with Robert Duvall and Bill Murray.
More like this story
- PEOPLE IN BRIEF: Publicist says Zsa Zsa Gabor back in hospital ( February 1, 2011 )
- People Briefs ( July 8, 2005 )
- People Briefs ( July 15, 2005 )
- PEOPLE: Zsa Zsa Gabor has transfusion, remains critical ( July 24, 2010 )
- People Briefs ( September 19, 2007 )


text:
From $228 / night
15 travelers
viewed this property in the past week
Description from the owner
Description from the owner
Bedrooms: 4/
Bathrooms: 2/
Sleeps: 10/
Type: Cottage
AVAILABLE YEAR-ROUND! Just 2 hours from Ottawa (nation's capitol) and 4 hours from Toronto, 5.5 hours from Niagara Falls, 8 hours to NYC. EVERYTHING you and your family could possibly want. Swim, fish, bike, hike...or just relax in space and privacy. This large, expansive park-like property boasts a gorgeous turn of the century two storey 4 bedroom farm house with large country kitchen with wood-burning fireplace, huge windows, and all the modern amenities: air-conditioning, satellite with 52" flat screen tv, DVD/VCR, extra TVs and video games, games, books, dishwasher, laundry, quality linens and bedding, fully equipped kitchen, propane and ...Read more
About the owner
About the owner
Julie S.
Julie S.
- Response rate: 20%
- Response time: Within a day
- Calendar updated: 4 weeks ago
Overall rating:
Additional Location Information
More About This Location
Beach or lakeside relaxation, Waterfront
Getting There
Nearest train station: Ottawa, Ontario , 150 miles
Nearest airport: Ottawa, Ontario , 150 miles
Car is essential


text:
Appointments & Offices
Check insurance plans, locations and make an appointment
Is Nikole Ahner-Brown accepting new patients?
If you are a new patient, please check with Nikole Ahner-Brown before scheduling an appointment.
What insurance does she accept?*Less
Office Locations
- 1327 Superior St
- Sandpoint, ID 83864
- (208) 290-5569 (Office)


text:
Also found in these collections
Description: Vintage with Laces: Lots of Birds and some Flea Market Finds
Athena B. was first to heart it
73 people have hearted this image
This image is in 7 collections
You might like these too
Now available in your language!Use in your language! Go back to English
Also found in these collections
You might like these too
Sign in with Facebook or Twitter to start your gallery.
Sign in with Facebook Sign in with TwitterDon't have Twitter or Facebook? Skip this step!


text: opera MSU Opera director preview's Handel's "Xerxes" By Peter Whorf • Mar 24, 2015 Courtesy - MSU College of Music Listen Listening... / 11:56 George Frederic Handel's opera "Xerxes" comes to the Fairchild Theatre stage this week. The MSU College of Music opens the production tomorrow night, with additional performances Friday through Sunday. "William Tell": an opera, not just an overture By Peter Whorf • Dec 9, 2014 Courtesy Teatre Reggio Turin Orchestra Listen Listening... / 9:42 Tonight at 7:30 at Ann Arbor's Hill Auditorium, artists from Teatro Regio Torino perform a concert version of Rossini's famed opera "William Tell". Music Director Gianandrea Noseda leads the performance, which makes stops in Chicago, Toronto and New York City. MSU Opera presents Mozart's "Cosi Fan Tutte" By Peter Whorf • Nov 19, 2014 http://music.msu.edu/ Listen Listening... / 9:07 Romance, intrigue, deception, and great music. All the ingredients for memorable opera are in the mix in Mozart's classic, "Cosi Fan Tutte". Heartbreaking opera classic comes to MSU By Peter Whorf • Apr 4, 2014 Flickr - Andrea Puggioni Listen Listening... / 13:12 MSU Opera Theater perform's Giacomo Puccini's "La Boheme" this weekend at Fairchild Theatre. Current State's Peter Whorf spoke with director Melanie Helton and music director Daniel Beckwith, and the three are also joined by cast members for WKAR studio performances. MSU Opera presents 'The Magic Flute' By Current State • Nov 22, 2013 http://music.msu.edu/ Listen Listening... / 8:36 The Michigan State University Opera Theatre is presenting Mozart's "The Magic Flute" starting Friday night in the newly renovated Fairchild Theatre.


text:
Lib Tech Skis - MensDedicated Lib Tech Skis fans, it's time for you all to get ready for the coolest savings on the web. Save up to 20% off your next pair of Skis by Lib Tech today. Available in a wide array of measurements, these unbeatable skis are ready for immediate shipment. Place an order today and Proboardshop will make it a priority to get your order shipped out within 24 hours, Monday-Friday!
Lib Tech Backwards Skis
Size: 166cm, 172cm, 178cmReg: $649.95 On Sale: $487.95
Lib Tech FFF NAS Skis
Size: 175cm, 185cmReg: $749.95 On Sale: $487.95
Lib Tech Freeride NAS Skis
Size: 188cmReg: $699.95 On Sale: $454.95
Lib Tech Freeride Skis
Size: 178cm, 188cmReg: $699.95 On Sale: $524.95
Lib Tech Jib Nas Recurve Skis
Size: 166cmReg: $699.95 On Sale: $419.95
Lib Tech Magic HP NAS Re-Curve Skis
Size: 168cm, 178cm, 188cmReg: $899.95 On Sale: $584.95
Lib Tech Magic Rec NAS Skis
Size: 188cmReg: $899.95 On Sale: $584.95
Lib Tech NAS Backwards SkisReg: $649.95 On Sale: $389.95 - $422.95
Size: 160cm, 166cm, 172cm, 178cm
Lib Tech Pow NAS SkisReg: $849.95 On Sale: $552.95
Size: 171cm, 181cm, 191cm
Lib Tech Tranny NAS SkisReg: $599.95 On Sale: $389.95
Size: 154cm, 166cm, 173cm, 181cm
Lib Tech Wreckcreate NAS SkisReg: $599.95 On Sale: $389.95
Size: 155cm, 163cm, 187cm
Lib Tech Wreckcreate Series Skis 2014
Size: 163cmReg: $599.95 On Sale: $419.95


text:
219Re: [PCElSalAg42002] Reunion!!!
- May 19, 2007What's taking you to the Dominican? We are actually going to be there the weekend of the 14th, so that's out for us for the DC reunion. I wanna hear about where you're staying and doing there. We're just going for a short fun trip sin el ninito!!! When do you leave?
los Bartley----- Original Message ----
From: Christa Bruce <chbru19@...>
To: email@example.com
Sent: Saturday, May 19, 2007 9:32:21 AM
Subject: Re: [PCElSalAg42002] Reunion!!!
So, it looks like July 14 or the 20th is what most people want. So, please vote for one or the other and then we can all put it in our books and Lucas can buy an airline ticket.
And for everyone who has called, I promise to return your calls when I get back from the Dominican.
ChristaOn 5/10/07, Christopher E. Clement <clementcee@yahoo. com> wrote:
Hello everyone,
I am so excited to see some of you this summer! I actually will be in DC for the duration of the summer working with a community development corporation. That being said, any of the proposed dates would work for me. I would be happy to help out organizing things when we get closer to the date. Until then, I am in the throes of finishing my semester and preparing for a jaunt in Guatemala before graduation (alas, I am not graduating, just participating in various ways). I should be in DC starting early June. Hope everyone is well.
Take care,
P.S. Spring just hit several days ago here in lovely New Haven, CT, makes me giddy with the anticipation of summer fun.
Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase.
- << Previous post in topic Next post in topic >>


text:
Colorado loses starting LB Kenneth Olugbode for 4-6 weeks
Getty Images
Colorado had already lost one starting inside linebacker to injury. Now, the Buffs have lost another.
Kenneth Olugbode sustained an unspecified leg injury in the Week 5 loss to Oregon. As a result, Olugbode will miss 4-6 weeks.
At minimum, Olugbode will miss games against Arizona State, Arizona, Oregon State and UCLA, possibly returning for the Nov. 7 game against Stanford. Missing six weeks would see him miss the Stanford and USC games, returning, Nov. 21 vs. Washington State.
"It's going to be a big loss," defensive tackle Justin Solis said according to the Denver Post. "It starts up front with us, the D-line. Not having K.O. out there is a huge loss, but it's definitely something we accept as a challenge as a D-line. We're going to step it up while he's out."
Olugbode had started all five games this season after starting all 12 games as a sophomore last season. Ryan Severson is expected to take his place in the starting lineup.
Dismissed Wolverine Logan Tuley-Tillman charged with three felonies
Michigan Athletics
Back on September 10, it was announced that Jim Harbaugh had dismissed Logan Tuley-Tillman for "conduct unacceptable for a Michigan student-athlete." Now we know what that unacceptable conduct was. Allegedly.
Wednesday morning, mlive.com is reporting, Tuley-Tillman was charged with three felonies stemming from a Sept. 4 incident in which he's accused of filming a sex act with a woman without her knowledge. Tuley-Tillman was officially charged with two counts of capturing/distributing an image of an unclothed person and one count of using a computer to commit a crime.
From the report:
Capturing/distributing an image of an unclothed person is punishable by up to two years in prison, a fine of no more than $2,000, or both. Using a computer to commit a crime, in this case, would be punishable by up to 10 years in prison, a fine of no more than $5,000, or both.
The incident occurred in the 300 block of Catherine Street Sept. 4. Tuley-Tillman is accused of filming a portion of a sexual encounter with a woman without her knowledge and then transmitting it to his personal device without her permission, according to Ann Arbor police.
Tuley-Tillman was a four-star member of Brady Hoke's second-to-last UM recruiting class, rated as the No. 24 offensive tackle in the country and the No. 7 player at any position in the state of Illinois. He played in one game as a redshirt freshman last season, the season opener against Appalachian State.
This season, he had been listed as the No. 2 left tackle and played in the 2015 opener.


text:
orYANY Victoria Leather Shoulder Bag
Clearance $149.94 - 179.94
Compare at $425.00
Add To Bag
Please select your size, width, and color.
Check In-Store Availability
Select color, size, and width before proceeding to check in-store availability.
select locations
Add to Wishlist
Item # 295590
Carry this color block bag by orYANY all year long. With fashion forward details the Victoria satchel is a perfect option for your everyday handbag.
- Leather satchel
- Top snap closure
- Flat buckle handles with 7" drop
- Attached shoulder strap adjusts up to a 20" drop
- Color block detail with gold hardware accents
- Fabric lining with double zip pockets & two slip pockets
- Dimensions 16" x 15" x 4"
- Imported
- View more orYANY Handbags
By: Meryl22
Location: California
September 09, 2015
this bag has a 'je ne sais quoi'
"This bag is really nice the blue one has a mesmerizing color. I just love the way it is shaped and is roomy enough for everyday use but small enough for evenings."
Click anywhere to close this.


text:
It's pretty much an all-out (one-woman) riot in the new visual for Azealia Banks' "Yung Rapunxel" track. The dark Jam Sutton-directed aesthetic notes the Harlem rapper in a sort of underworld, all while experiencing altercations with the police. Yeah, she's even smashing bottles over heads and having owls fly out of her body and also talking with her eyes at certain points. You'll just have to press play to take this all in. The audio will, of course, be featured on Banks' forthcoming Broke With Expensive Taste debut.
Azealia Banks – Yung Rapunxel