text:
Published at Wednesday, 20 September 2017 by jarwo in Living Room, with total 66 digitals.
The elegance of your living room depends also on the floors you have installed. The same as walls, floors should remain solid and neutral, allowing other important elements (art, furniture, or decorations) to grab attention first. If you decide to use carpets, make sure they are equally soft and unobtrusive, painted with the same color palette. Modern interior design prefers sharpness. Therefore, edgy rectangles and angular lines, and even impeccable circles are very common. It means that the most important feature is precise definition.
Because living rooms can serve many purposes, you'll want to be sure to incorporate a variety of different furniture pieces to cover all possible activities. When considering living room ideas, start with your space. If your home is generally tight on space, having plenty of shelves, cabinets or drawers will be crucial to accommodating any storage needs. Built-ins are the best way to do this, since they take up less space and are often customized to meet your needs, however they can run on the more expensive side. If built-ins aren't part of your living room design ideas, start with the big pieces, like an entertainment center or TV stand to house any electronics and accessories, or a bookcase to keep books, picture frames and knickknacks in check.
Looking at modern interior design ideas online for inspiration is a good idea to get your creativity going. It is never a bad idea to redesign your Living room, especially if you feel it is not cozy or sophisticated enough. After all, it is the room where your family spends most of their time, and it definitely deserves a critical look from time to time. The truth, however, is that many people have no clue on how to update their living space; and it is exactly those people we had in mind when gathering useful tips and themes for design and decoration. All of these can be seen in the interior design pictures below.


text:
Eric's Heroes: The bagpiper who plays at sunset
NEWCASTLE, Wash, -- There are three sounds that stir our souls, that make us stop to reflect and remember what it feels like to be human.
The sound of taps played on a bugle.
The sound of children laughing.
And the haunting, otherworldly harmonics of that strangest of instruments, the bagpipe.
Every night, from May through September, Neil Hubbard, dressed in a kilt, walks slowly to the top of a little knoll facing the clubhouse of the Golfclub at Newcastle, with the glory of the Pacific Northwest glistening behind him and plays his pipes.
The sound covers the fairways and greens like an old tartan blanket. The gentle echo rolls up into surrounding hills like a fog of forgotten memories. Diners at the clubhouse stop eating for a moment. Golfers pause before putting. It is a beautiful, soulful sound, and it is irresistible.
Those moments when everything is perfect and the instrument works its magic, are earned in the Issaquah Brewhouse, where those who've surrendered to the siren song of the pipes gather to pay their dues in the form of practice. Lots of practice.
Neil has been playing the bagpipes since he was 12.
He knows, better than most, that his chosen instrument of expression is the one that's played when the occasion is bigger than us. Funerals. Weddings. When we most need to search our souls, only the pipes will do.
"The bagpipe is not an easy instrument to play", said Neil. "It is physically difficult. There is a lot of air pressure and air that is required and the finger work is pretty intricate. I have been playing almost 23 years, and I still take lessons when my teacher and I can sync up. I'm really lucky , I get to do this full time now, I get to do what I love to do full time."
And so every night, with his back to one of our most stunning vistas he offers his gift to the world, and exquisite evenings are transformed into "perfect" ones.
It's become a Newcastle tradition. No night here is complete without it. People stop what they're doing. They listen. Many of them come just to hear Neil.
I asked Neil, "When you're up there, you're on that hill, and you know people are listening... what are YOU thinking about?"
He looked out at Lake Washington in the distance, and Seattle, with the Olympics far off behind. "Gratitude," he said. "Yeah, because, you know, look"
He swept his arm in front of him. "I'm just glad to be here."
Neil isn't aware of it, but every night, a half-mile away, the Rheder family, like so many families, hears the echo of Neil's work, and it carries a special meaning.
A little girl named Charlotte strains to hear. "Yes, that's him!" she exclaims.
"You know what that means," her parents say.
Charlotte pauses. "Yes, "she says. "It's bedtime."
Neil tried to explain the sound the pipes make. "It's soul stirring. It's a soul-stirring sound."
"And, you get to make that sound," I acknowledged.
"Every day."
"For 13 years," I reminded him.
"Well, for 27, but here at the golf club, 13, yeah."
Times change and people change, and yet for some reason we still harken back to this ancient sound that punches us in the gut every time.
The tradition will continue at Newcastle. Night after night, Neil will do his job, which is, simply, to make us remember what it feels like to be human.
(You can contact Neil Hubbard and check out his schedule at this site.)
Editor's Note: "Eric's Heroes" is a weekly series airing every Wednesday on KOMO News in the 6 p.m. newscast. If you have a good story about a good person doing good things for the right reasons, share it with Eric by sending an email to firstname.lastname@example.com.

subset: commoncrawl


text:
This water bottle cost me $150 USD. I've had it since the fall of 2009. Since then it's saved me 3 to 4 times it's initial cost, because I never, ever buy bottled water anymore.
Whether I'm at home, or backpacking, or camping on an island … I always have sterile, safe, great tasting water (because I buy the easily replaceable carbon filters and pop one in every ~4 months, which cost about $7 a pop).
It works without fail. No matter how "ok", or how dangerous the water is, I pour it into the bottle, pump it out, and presto — awesome water. You can even pee in it up to three times in a row, although I haven't gotten past two yet.
Anyway, this thing really does save a crap ton of cash. It's a little bulky, but it's the single best investment I've ever made for traveling, because it saves me hundreds of dollars a year. Really, I watched my camera guys spend over $4 dollars a day on bottled water in London this past May/June. I was there for almost 6 weeks. Had I spent that much on water every day, on this one trip alone, I would have spent over … you guessed it, $150. The price of a brand new Life Saver Bottle.
They also have a larger 6,000 L model, but I don't think I will even break 4,000 L within the first 2 years, at which point you have to replace the main filter anyway (regardless of whether or not you've used the full capacity of the primary filter).
You can also view a video here (link) from the creator demonstrating and discussing the bottle, and how it filters out damn near everything — even polio.
— Anthony Dream Johnson
ps — if there's ever a viral zombie outbreak, I am totally set. =D


text:
Canticles of Fate
The island nation of Eskarof has only existed as a country of it's own for less than two hundred years, half that time has been under human rule while the other half came after the rise of the tiefling noble class. Colonized by formerly oppressed humans from across the Calashar sea, conflict with the Draconic Isle came almost immediately and would have been an assuredly quick defeat at the claws of the dragon kings had not the infernal forces of Baator intervened on the Eskarofians behalf. Using the desperate situation and mankind's malleable nature to their advantage, the powers of the Nine Hells twisted the burgeoning human nation into a sinister reflection of themselves. Nobility in Eskarof suddenly had a different hierarchy as the nobility signed there souls to various devils for less than equivalent vestiges of power, the most cunning of these pact recipients became new Lords of Eskarof and they set about securing their new kingdom with ruthless efficiency.
Anung Un Rama- The Bronze Lord, Hell's Harrier, King of Eskarof, all describe the mortal son of Bel himself who has sat upon the Throne of Blood since his violent ascent through the noble ranks of Eskarof. His reign has ironically been one of peacekeeping for the close to twenty years since the public slaying of his predecessor and guard, a feat that has left him with few willing to challenge him. King Anung Un Rama stands at over seven feet tall and has a pair of sweeping horns that bears his flaming crown between them,. His right hand is a large and intricate bronze device of unknown origin and purpose, many believe it to be a focus for the infernal powers he receives from his father, others a key to a prison of extraplanar entities he has been intrusted to guard, then again, the truth may be far worse…


text:
Best Practices: Use of Web Application Firewalls
- Elaine Knight
- 3 years ago
- Views:
1 Best Practices: Use of Web Application Firewalls Version 1.0.5, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber
2 Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF. Special attention has been paid wherever possible to the display of work estimates including in comparison to possible alternatives such as modifications to the source code. In addition to the importance of the web application regarding turnover or image the term access to a web application used in this document can be a good criterion in the decision-making process relating to the use of WAFs. Specifically, the access to a web application, measures the extent to which the required changes to the application source code are actually carried out in-house, on time,or can be carried out by third parties. As illustrated by the graph below, a web application to which there is no access can only be protected sensibly by a WAF (additional benefit of the WAF). Even with an application in full access, a WAF can be used as a central service point for various services such as secure session management, which can be implemented for all applications equally, and as a suitable means for proactive safety measures such as URL encryption
3 About Further key topics discussed in this paper include best practices for processes concerning the installation and operation of a WAF as well as in particular for larger companies a description of the role of the WAF application manager. This document has been developed by the OWASP German Chapter. The authors are employees of companies, who are consulting on the use and operation of WAFs, are producing WAFs and/or are setting up WAFs. Authors Maximilian Dermann maximilian.dermann lht.dlh.de Lufthansa Technik AG Mirko Dziadzka mirko.dziadzka artofdefence.com art of defence GmbH Boris Hemkemeier boris owasp.org OWASP German Chapter Achim Hoffmann achim.hoffmann securenet.de SecureNet GmbH Alexander Meisel alexander.meisel artofdefence.com art of defence GmbH Matthias Rohr matthias.rohr securenet.de SecureNet GmbH Thomas Schreiber thomas.schreiber securenet.de SecureNet GmbH Terminology Licence The specialist terms used in this document are not explained in detail and knowledge of their meaning is assumed. No glossary has been included in order to keep the volume manageable and to keep to the actual subject of this paper as closely as possible the use of Web Application Firewalls. Detailed definitions and more in-depth descriptions concerning WAS Web Application Security can be found at: OWASP Category:Attack OWASP Category:Threat OWASP Category:Vulnerability WASTC Web Application Security Consortium: Web Security Threat Classification WAFEC Web Application Security Consortium: Web Application Firewall Evaluation Criteria OWASP WAFs When Are They Useful This document is licensed under a Creative Commons attribution under equivalent conditions as the 2.0 Germany licence To view the licence, please go to or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California 94105, USA.
4 Contents A1 Introduction and aim of this document... 5 A1.1 Introduction... 5 A1.2 Definition of the term WAF Web Application Firewall... 5 A1.3 Target readership and objective... 5 A2 Characteristics of web applications with regard to Web Application Security... 6 A2.1 Higher level aspects within the organization... 6 A2.2 Technical aspects of each of the company s individual web application... 6 A3 Overview of Web Application Firewall (WAF) features... 7 A3.1 Where WAFs fit into the Web Application Security field as a whole... 7 A3.2 Typical security mechanisms of WAFs using specific vulnerabilities as example... 8 A4 Overview of benefits and risks of Web Application Firewalls A4.1 Main benefits of WAFs A4.2 Additional benefits of WAFs depending on the actual functionality of the product A4.3 Risks in the use of WAFs A5 Security versus OWASP TOP10 a comparison of WAFs and other methods A6 Criteria for deciding whether or not to use a WAF A6.1 Organization-wide criteria A6.2 Criteria with regard to a web application A6.3 Evaluation and summary...16 A6.4 A consideration of the financial aspects A7 Best practices for introducing and operating a WAF A7.1 Aspects of the existing web infrastructure Central or decentral infrastructure predictable changes Performance criteria A7.2 Organisational aspects Conforming to existing security policies New role model: WAF application manager A7.3 Iterative procedure for implementation from basic security to full protection Step 1: Specification of role distribution / inclusion of application development Step 2: Basic protection for all web applications Step 3: Creating a priority list of all existing web applications Further steps: Full protection of the web applications according to priority A8 Appendices A8.1 Checklist: Access to a web application from a security-standpoint A8.2 Role model when operating a WAF A8.3 The individual roles WAF platform manager WAF application manager (per application) Application manager...23
5 A1 Introduction and aim of this document A1.1 Introduction Whether the online branch of a bank, an online-shop, a customer-, partner- or employee-portal all of these web applications are available to their customers as well as their attackers around the clock due to the always on nature of the internet. Attacks such as SQL injection, cross-site scripting or session hijacking are aimed at vulnerabilities in the web applications itself and not at those on the network level. For this reason, traditional IT security systems such as firewalls or IDS/IPS are either totally unable to guard against these attacks or are incapable of offering comprehensive protection. From a technical point of view the fundamental issue is, that the web, especially the HTTP protocol, was not designed for such complex applications which are currently state of the art. Many vulnerabilities have their origin here: for example, HTTP is not stateful, i.e. sessions or stateful applications must be defined separately and implemented securely. These vulnerabilities are increased even further by the high degree of complexity of the web scripts, frameworks and web technologies frequently used. In addition to the recent introduction of industrial standards, e.g. the data security standard of the credit card industry (PCI DSS v1.1), security breaches in Germany which have only recently been revealed, such as the loss of approx. 70,000 items of customer data incl. credit card information for online ticker dealer kartenhaus.de, have ensured an increased level of interest in possible security measures against application level attacks. This document covers a category of security systems, the Web Application Firewalls (WAF), which are especially well suited for securing web applications which are already in production. A1.2 Definition of the term WAF Web Application Firewall In this document, a WAF is defined as a security solution on the web application level which from a technical point of view does not depend on the application itself. This document focuses on the exposition and evaluation of the security methods and functions provided by a WAF. Aspects of the deployment within the existing IT infrastructure whether as a hardware appliance, a software plug-in for a web server or as an add-on for existing infrastructure components, such as load balancers or network firewalls are only covered in brief. Unlike the definition in WAFEC it is not assumed that a WAF has to be available as a separate hardware appliance in front of the web servers; this certainly does not represent the best implementation option, especially in large, fast-growing infrastructures. A1.3 Target readership and objective The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF. Special attention has been paid wherever possible to the display of work estimates. Further key topics discussed in this paper include best practices for processes concerning the installation and operation of a WAF as well as in particular for larger companies a description of the role of the WAF application manager.
6 A2 Characteristics of web applications with regard to Web Application Security A2.1 Higher level aspects within the organization Especially within larger organizations, many aspects need to be taken into account regarding the importance of the security of the web applications in operation. One of the most important aspects is the number of productive web applications in the company. Large companies often operate in-house or externally web applications numbering in the hundreds. Even if a prioritisation of each individual web application in order of its relevance for the success of the organization is reasonable, it is nevertheless necessary to assume that all web applications operated in-house depending on the architecture could permit an attack on internal systems given the right attack methods. Even web applications which seem to be unimportant at first glance should at minimum be secured against known attacks. The following aspects should be considered when prioritizing web applications in regard to their importance for the organization: Access to personal data of customers, partners and/or employees Access to confidential information Essential requirement for the completion of critical business processes Relevance for the attainment of critical (security-)certifications. Possible effects of the non-availability or data loss in the web applications include: Interruption of business processes (including those of customers or partners) Loss of reputation Damage compensation claims Revocation of licenses Loss of confidential information. For other aspects such as risks and costs, see A4.3 and A6.4. A2.2 Technical aspects of each of the company s individual web application The decision regarding suitable security measures for a web application essentially depends on the relevant phase in the application development process. This means that in the design phase suitable tools for the implementation as well as test- and quality-assurance-tools can be selected; where appropriate the developers can also be trained in web application security and the relevant time frame until the deployment into productive operation can be extended. For already completed or productive applications, very different aspects are relevant with regard to subsequent possible security measures, such as: Complete documentation of the architecture and the source code or availability of the developers of the web application Maintenance contracts for all components of the application architecture Short error rectification times by the manufacturer of third party products used Only if these aspects have been met, the application can be secured within the existing application infrastructure, not regarding the amount of work involved.
7 A3 Overview of Web Application Firewall (WAF) features A3.1 Where WAFs fit into the Web Application Security field as a whole The basic principle is that every web application should be developed as secure as possible. This is because the later vulnerability is detected in the life cycle of a web application, the greater the risk of a successful attack, and often also the amount of work involved in correcting the issue. In addition to appropriate training measures, e.g. on the basis of the OWASP guidelines the application development can be supported effectively by the use various tools. Tools such as Stinger are normally based on a framework J2EE in this example; they are part of the application (even if they can be added to completed applications conforming to J2EE) and, from an organisational point of view, are thus generally subject to the normal application release cycle. At their core, they effective help developers in making their application more secure. Unlike WAFs, they will always be part of the application, however. These tools are mentioned in this document at various points, in particular in relation to the comparative amount of work for various security measures, but they themselves are not the focus of this document. In the development phase, methods such as static source code analysis help to promptly detect and rectify vulnerabilities in the code. This additionally includes penetration tests, ideally carried out by experts, which cover the vulnerabilities in the external behaviour of the web application in productive operation as well. In this context, it is the primary function of a WAF to secure web applications against detected vulnerabilities, with as little effort as possible, so that they cannot be exploited by attackers. This is already a very challenging task due to the high degree of complexity of the typical web-application infrastructure: web servers, application servers, frameworks, as well as the typical components of a web application; session handling with cookies, input validation, etc. The main aim in using a WAF is therefore securing the existing, often productive web applications, where the required changes within the application can no longer be implemented or can only be implemented with a disproportionately large amount of work. This applies to vulnerabilities in particular which have been revealed via a penetration test or even via analysis of the source code,, and especially in the short term cannot be fixed within the application. Besides the basic protection via blacklisting in other words the description of known attack patterns the basic feature of the WAF is the option of whitelisting which can be configured appropriately. With active whitelisting, the rule set of the WAF describes the exact behaviour of the application; the configuration of suitable whitelists is often supported via a learning mode. In addition, several WAFs also offer functionalities which extend beyond a purely protective nature and which can therefore also be used in the design process in order to avoid unnecessary work. The WAF therefore becomes a central service point for completing tasks which should otherwise be on the application side, but which can and should be addressed in the same way for all applications. Examples of this include secure session management for all applications based on cookie stores, central authentication and authorisation, the collection of all relevant error messages and log files or the option for proactive security mechanisms such as URL encryption. The table below uses what are currently the most well-known vulnerabilities or methods of attack on web applications to indicate the protection offered by WAFs. The usual functionality of a WAF is assumed, although not all WAFs available on the market necessarily offer all the functionality described here.
8 A3.2 Typical security mechanisms of WAFs using specific vulnerabilities as example The table below gives possible security measures (Countermeasure column) for typical threats, vulnerabilities and attacks (Problem column), and in the WAF column, evaluates how well a WAF can protect the application. The symbols indicate: + very well covered by a WAF - cannot be covered (or only to a small degree) by a WAF! dependent on the WAF/application/requirements = can partially be covered by a WAF Problem Cookie protection + +!! WAF Countermeasure Cookies can be signed. Cookies can be encrypted. Cookies can be completely hidden or replaced (Cookie Store) Cookies can be linked to the client IP. Information leakage + Cloaking filter, outgoing pages can be cleaned (error messages, comments, undesirable information). Session riding (CSRF) + URL encryption / token. Session timeout! Timeout for active and inactive (idle) sessions can be specified (if the WAF can manage the sessions itself). Even if the sessions are managed by the application, the WAF can detect these and terminate them with the appropriate Session fixation = Can be prevented if the WAF manages the sessions itself. Session hijacking - Difficult to prevent, although the WAF can issue an alarm in the event of irregularities (e.g. changing IP) or terminate a session with changing IP. File upload + Virus check (generally via external systems) via ICAP linked to the WAF. Parameter tampering + + Forced browsing + + Path traversal (URL) link validation Path traversal (parameter), path manipulation + + In addition to/instead of data validation (see below), parameter manipulation can be prevented via URL encryption (GET) and parameter encryption (GET and POST). Site usage enforcement, meaning the possible sequence of URLs can be fixed or can be detected. Can be prevented via URL encryption. Site usage enforcement. Can be prevented via URL encryption. Site usage enforcement. + See parameter tampering and data validation. Logging + All or only specific/permitted parts of the data of a request and of the connected tests can be logged. Priv. Escalation - Privilege escalation cannot be checked, or can only be checked to a limited degree, for example via cookie/parameter Logical level - Application logic going beyond the validity of URLs and form fields cannot normally be checked by a WAF
9 Anti-automation = Automatic attacks can be partially detected and blocked (e.g. number of requests/time interval, identical requests, etc.). Application DoS (moderate) = = SSL Data validation (relating to field/content/context/appl) + +! - Transactions, IPs, and/or users can be blocked. Connections, and /or sessions can be ended. WAF can force SSL with pre-defined encryption strength (depending on the infrastructure scenario). SSL termination on the WAF, forwarding of the SSL data (e.g. client certificate) to application. SSL connection possible from WAF to application. Can be tested to very detailed degree (length, constant value/range of values, e.g. for SELECT, character area); validation possible with whitelist and/or blacklist (signature). Rules can in part be generated automatically. High dependency on application, specific fields (hidden form) or pre-defined parameters in the URL; can be automatically verified by the WAF however. Risk due to false positives, problematic with business critical applications in particular. Data validation (general/global) + HTTP(w3c) conformity, a WAF conducts a canonalisation of the data so that it is available to the application in a Buffer overflow + See data validation [1] Format string attack = Can be detected using data validation if the corresponding characters or strings are filtered (difficult in practice, as precise knowledge of the application is required to do this). For the majority of the hidden input fields, this can be carried out without knowledge of the application. Cross-site scripting = Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the attack is sent in parameters of the request. Cross-site tracing + Restriction of the HTTP method to, for example GET or POST. WebDAV + Restriction to only reading WebDAV methods possible. Code injection (PHP, perl, java) + See data validation [1] Command injection + See data validation [1] SQL injection + See data validation [1] LDAP injection + See data validation [1] XML/Xpath injection + See data validation [1] Just-in-time patching (hotfix patching) HTTP response splitting (HTTP splitting) + Using data validation (see above), the WAF can protect against newly detected vulnerabilities and/or attacks (Zero Day Exploit)! Can only be detected using data validation in URL and/or parameters if %0d%0a is filtered however this can be carried out on virtually any input field without impairing the functionality HTTP request smuggling + Is prevented via strict testing of the conformity to standards of each request. 1 Basic protection with blacklisting generally sufficient, other options be combining blacklisting and whitelisting
10 A4 Overview of benefits and risks of Web Application Firewalls The specific potential benefits of a WAF described here are explained in detail in the in-depth overview in the next chapter. This chapter is used primarily as a summary for decision-makers who only want to work through the next chapter as an overview. A4.1 Main benefits of WAFs The main benefit of a WAF is the subsequent protection of completed, productive web applications on the application level with a reasonable amount of effort and without having to change the application itself. On the one hand, the WAF offers a basic protection against known attacks or vulnerabilities based on blacklists: The data security standard of the credit card industry (PCI DSS v.1.1) for example, in its current version prescribes the use of a WAF as an alternative to regular code reviews by a specialist as an adequate measure to protect web applications. The WAF is therefore a suitable tool for attaining industrial standards as well as fulfilling legal requirements. The use of a WAF becomes especially relevant in the case of concrete vulnerabilities, for example uncovered via penetration tests or source code reviews. Even if it were possible to fix the vulnerability in the application promptly and with a reasonable amount of effort, the modified version can generally only be deployed at the next maintenance interval, often 2-4 weeks later (patch dilemma). For a WAF with whitelisting, the vulnerability can be fixed promptly (hotfix), so that it cannot be exploited before the next scheduled maintenance. WAFs are especially fast in this aspect, meaning they can collaborate with source code analysis tools, so that detected external vulnerabilities can automatically result in a recommended rule set for the WAF. A WAF is particularly important in securing productive web applications which themselves in turn consist of multiple components and which cannot be quickly changed by the operator; e.g. in the case of poorly documented applications or regarding third-party products without sufficient maintenance cycles. A WAF is the only option for promptly closing external vulnerabilities. A4.2 Additional benefits of WAFs depending on the actual functionality of the product There are other considerable potential benefits which are due to the central role of the WAF. The error location process is simplified considerably if the WAF supports central error messages in contrast to individually generated error messages by several applications. Error messages can then be centrally evaluated at the WAF. The same applies to all aspects of monitoring and reporting. As a central service point, the WAF can implement tasks which can be solved in the same way for every application. A good example of this is secure session management for all applications based on cookie stores. Many WAFs also provide proactive security mechanisms such as URL encryption or site usage enforcement, in order to minimise the area of attack with as little effort as possible. In addition, the use of a WAF increases the robustness of a web application to external attacks. WAFs offer other additional benefits depending on the type of implementation. A hardware appliance in front of the web servers can often terminate SSL connections and also sometimes has load balancer capabilities. This can be desirable, but can also be provided by suitable web application security add-ons for products already in use. In high-security environments, however, the existing
11 security guidelines frequently prohibit the termination of SSL connections in front of the web server. In this case, WAFs which are implemented as a plug-in for the web server are especially well-suited. The WAF can also provide a SSL termination if the application to be protected or its web server or application server does not have this capability. A4.3 Risks in the use of WAFs Note that changes in the existing IT, web and any application infrastructure are required when using a WAF. Depending on the WAF s implementation e.g. hardware appliance vs. embedded WAF there are also additional tasks and risks: Yet-another-proxy argument (increased complexity of the IT infrastructure) Organisational tasks (see A8.2 Role model when operating WAFs) Training the WAF On each new release of the web application Testing False positives (which may have a significant business impact) More complex troubleshooting WAFs also have/generate errors Responsibility for system-wide error situations Any potential effect on the web application if the WAF terminates the application session, for example Cost-effectiveness
12 A5 Security versus OWASP TOP10 a comparison of WAFs and other methods This chapter covers the various security options for what is known as the OWASP Top10 vulnerabilities. Three different classes of web applications are used as examples: T1: a web application in the design phase, new application T2: an already productive application (with MVC architecture), which can be easily adapted T3: a productive application which cannot or only with difficulty be modified. Security measures within the application or the application architecture itself are described in detail and are evaluated, based on these three classes, either with the use of a WAF or, alternatively by definition of an appropriate security policy The security measures are also assessed in regard to the amount of work required for their implementation. In some instances, there are notes on special functionalities of WAFs or assumptions on the application infrastructure used, as these do not apply globally. As the table below clearly shows, especially in the case of applications which are in production, the use of WAFs very often requires the least amount of work.. In the case of applications which cannot be modified or which are difficult to modify, in some instances the use of WAFs is actually the only feasible security measure. In the table below, the Work volume column lists the estimated amount of work required for the application types (T1, T2, T3), a WAF or a security policy (P) in regard to the threat (Top 10 column) Comments and notes for each type regarding the implementation of security measures can be found in the Comment column. The categories for the work volume are: 1 little work required 2 moderate amount of work required 3 considerable amount of work required not normally implemented A1 Top10 Type Comment Work volume Cross-site scripting (XSS) T1 T2 E.g. by the consistent use of taglibs (Java), or controls (ASP.NET), or additional frameworks (PHPIDS). Input encoding is difficult to integrate (e.g. using OWASP Stinger), using an upstream WAF is a better solution here. For.NET applications XSS filters can be activated. 1 3 (.NET: 2) T3 For.NET applications, activate XSS filters. - (.NET: 2) WAF WAF does not permit output validation in this case, as it 2 does not recognise the context of the data. The validation must be carried out during the input phase, and may be correlated with the output. P - A2 Injection flaws T1 Can be avoided by using an OR mapper (e.g. Hibernate) or consistent parameterisation of all inputs (e.g. stored 1 procedures or ideally: prepared statements). Other injection flaws (e.g. with XML) can only be avoided with dedicated output coding, where necessary. T2 Complicated, as program modifications are required. 3
13 A3 A4 A5 Malicious File Execution Insecure Direct Object Reference Cross-site Request Forgery (CSRF) T3 - - WAF WAF with blacklisting: In principle can only search for specific characters or character strings and prevent processing. Essentially there are problems with this approach in the degree of coverage as well as with possible filter evasion attacks (e.g. with multiple coding) if no input normalisation is carried out. This works very well with known attacks (e.g. SQL injection), but certainly less well with protocols not known to the WAF or with proprietary protocols. In addition, injection attacks on some types of input data can be effectively prevented using URL encryption and hidden form parameter protection. An example of this is the item number in an online shop, which traditionally would often be used for SQL injection attacks, but it should never actually be possible for users to manipulate these directly. WAF with whitelisting: For all other input fields, there is a whitelist approach. Here the WAF can make suggestions for the individual fields following a learning phase. This means that not all, but the majority of the input fields can be protected against all types of injection attacks. P In the case of SQL injection: Specifications for database access permissions, otherwise little or no options. T1 Integrating upload scanners or whitelisting of the permitted remote inclusions. T2 3 T3 - - WAF Whitelisting of the parameters for the permitted inclusion of URLs external to the system inclusion of upload scanners via ICAP protocol - response analysis to prevent the display of critical data (partially also error messages). P Specifications for deployment platform, specifications for access permissions 2 T1 Implementation of an object virtualisation is very timeconsuming, as database objects are frequently mapped 3 to parameters by the frameworks in use (OR mapper). Protection requires intensive testing. T2 Prevention of ID manipulation generally necessitates code modifications. Protection requires intensive testing. 3 T3 - - WAF Protection against ID manipulation using ID virtualisation or hidden parameter protection. P Use of impersonation and delegation. 3 T1 Can be solved using specific application architecture. 1 T2 Significant amount of work. Program changes generally required. T3 - - WAF Can be prevented using page token or URL encryption. 1 P
14 A6.1 Information Leakage A6.2 Improper Error Handling A7.1 Broken Authentication A7.2 Session Management T1 T2 Tool-supported testing with high test coverage and relevant focus. Tool-supported testing with high test coverage and relevant focus. T3 - - WAF Automatic filtering of comments possible. Site usage enforcement can prevent access to existing but unpublished (unlinked) documents. Traditional examples are backup files on the web server which contain database passwords in plain text and whose URL can be guessed by the attacker. P Requirement for programmers and authors not to enter any comments. Specifications for the design of error messages. T1 Can be configured declaratively depending on the platform. T2 Can be configured declaratively depending on the platform. T3 Can be configured declaratively depending on the platform. WAF Difficult to detect. 2 P - - T1 T2 Link-up to a central access management system with appropriate security standards. Link-up to a central access management system with appropriate security standards. Program modifications may be required. T3 - - WAF Depends on the abilities of the WAF. A WAF can carry out authentication independent of the application and thus permit a link-up to a central authentication infrastructure without changing the application. P Specifications with regard to password complexity. 2 T1 On the design level, e.g. using session manager design 2 pattern, otherwise numerous options. Amount of implementation work partially dependent on application server, see also A7.1, if the session management is carried out by the access management system / - T2 Can be integrated centrally to a large extent (using filters, 2-3 listeners or hardened server configuration); nevertheless, a large amount of work in some places; see also A7.1, if the session management is carried out by the access management system. T3 Depends on application server, partially configurable A8 Insecure Cryptographic Storage WAF Hardening of insecure session management possible via various techniques (e.g. page tokens). P - T1 Use of crypto APIs. 1 T2 Use of crypto APIs. Subsequent implementation requires numerous program modifications. 1-3
15 A9 Insecure Communications A10 Failure to Restrict URL Access T3 - - WAF - - P Specifications for saving sensitive data. - T1 Can be configured declaratively in the application or web 1 server. T2 T3 Can be configured declaratively in the application or web server. Very high amount of work if URL schema (HTTP) has been hard-coded. Can be configured declaratively in the application or web server (if there is access). Not possible if URL schema (HTTP) has been hard-coded. WAF Can secure HTTP applications using HTTPS. 1 1 / - 1 / - P - - T1 Use of a front controller with gateway. Code must still 1-2 check user assignment via the program at various points (e.g. in the service). Gaps possible. T2 Differs depending on the application. URL access 2-3 permissions can be configured declaratively with J2EE and.net. Prevention of ID manipulation generally necessitates code modifications. T3 Differs depending on the application. URL access 3 permissions can be configured declaratively with J2EE and.net. WAF Page tokens or URL encryption can be used to restrict 1 users to pages received from the application as links. The application must not display protected links, however (limited access pattern). With site usage enforcement, the user can only access linked content. Specific URLs/sub-trees can also be excluded via whitelist/blacklist approaches (e.g. only allow access for *.html, *.php, *.gif, *.jpg but not for *.bak or other extensions).
16 A6 Criteria for deciding whether or not to use a WAF A6.1 Organization-wide criteria Core criteria in this area are: Importance of the web application(s) for the success of the organization (proportional turnover, reputation) Importance of the loss of data of the web application (customer data, confidential information, reputation) Number of web applications Basic legal conditions or industrial standards Complexity Operating costs Performance Scalability A6.2 Criteria with regard to a web application The term of access to the web application is introduced and explained below. The checklist in appendix A8.1 is used to determine the degree of access individually for each web application, using a points system. The access to a web application can be used as a measure of the extent to which the organization in possession of the application can promptly carry out or initiate and implement the necessary changes to the web application, in other words has access to the source code of the application. A web application in the design phase (see T1 in A5) can be considered as a special case of a web application with optimum access. The other extreme, a web application without access is an application consisting of many undocumented components, for example, whose developer cannot be contacted, and which uses third-party software products, which are no longer maintained by the manufacturer, or in case of open source projects - by the community (see T3 in A5). Important criteria for determining the degree of access to a web application are: Complete documentation of the architecture and the source code or availability of the developers of the web application Maintenance contracts for all components of the application architecture Short error rectification times by the manufacturer for all third-party products used (portals, frameworks, SAP, etc.). Other important criteria for each web application are given in the checklist which can be found in the appendix. A6.3 Evaluation and summary The degree of access can be determined for every web application using the checklist in appendix A8.1. This also allows to determine a mean value of access for all the web applications of an organization; it is important to note that applications which are critical to the success or the image of the organization need to be rated accordingly. The illustration given below may be useful as a guide in the decision-making process regarding the benefits of using a WAF:
17 If an organization has full access to their web applications, the use of a WAF primarily provides a reduction of the cost of operation especially due to the additional benefits of a WAF given in A3 as a central service point, as well as some comparatively easy-to-implement security mechanisms, see A4. If there is virtually no access to the web applications, the use of a WAF is definitely appropriate as this is the only way that the relevant security measures can be implemented. With decreasing access to the web application and depending on its importance and complexity the benefits stemming from the use of a WAF grow rapidly: from a second line of defence to true full protection of the web application from outside influence, attained by the use of whitelisting. Using a WAF often results in the least additional work for the required security level. A6.4 A consideration of the financial aspects The cost-effectiveness of the procurement and the operation of a WAF can be considered from multiple points of view: Avoidance of financial damage resulting from successful attacks on the web application Lower costs for reaching the necessary protection level for the web application in comparison to other options Savings via the use of central services which are made available by a WAF for multiple web applications, and therefore no longer have to be implemented or configured in every application. When protecting applications with insufficient access (see A6.2), but which still need to be protected, the costs of a WAF can either be viewed as a strategic investment, or where realistic, set against the costs of replacing the application in question.
18 The costs of using a WAF normally consist of the following components: Licence costs Licence updates / software support Project costs for evaluating and introducing a WAF (Partial) costs for operating the necessary platform Personnel costs for the WAF application manager(s) Time required in projects for coordination with the WAF application manager.
19 A7 Best practices for introducing and operating a WAF A7.1 Aspects of the existing web infrastructure Central or decentral infrastructure predictable changes It is essential to note that its the WAF that needs to be integrated into the existing Web infrastructure and its planned or foreseeable changes and not the infrastructure which needs to be fundamentally changed due to the implementation of a WAF. Accordingly, a WAF can be installed in a central infrastructure which is not predicted to change, as a central infrastructure component, e.g. as a hardware appliance; whereas with an infrastructure which is still decentral, but which may be growing quickly for example a large online shop a distributed WAF approach, e.g. as a plug-in into the existing web servers, is more appropriate. With regard to the infrastructure aspects, those WAF products are particularly flexible, which combine an essentially distributed implementation approach with a central administration point and therefore offer the benefits of both scenarios. What is worth mentioning and becoming increasingly important with regard to probable future developments is the option of hardened infrastructures using virtualisation. When selecting the WAF, it is particularly important that the WAF can also be integrated seamlessly into a virtualised approach Performance criteria With regard to technical performance, it is necessary to ensure that the required WAF infrastructure supports the main key performance indicators of the existing web infrastructure. Statements which purely refer to the GB throughput of hardware should not be taken at face value, as the given numbers are often not achievable in practice. What is more important are the typical key performance indicators of a web application such as the number of simultaneous users of the application and on that basis, the number of HTTP requests per time unit on average and at peak load times. It should be noted that many applications have high-load phases which occur only rarely, e.g. during the Christmas season for an online shop. A7.2 Organisational aspects Conforming to existing security policies As far as possible, existing security policies should not have to be changed due to the implementation of a WAF. A typical example is SSL termination in front of the web servers. This is often denied, in particular in high-security infrastructures, by the existing security guidelines This policy can be maintained by the use of a suitable WAF, as a plug-in on the web server with the SSL termination still subsequently being carried out in the web server New role model: WAF application manager After the one-off task of commissioning, the subsequent successful use of a WAF essentially depends on the seamless interaction of the WAF with all other components of the application infrastructure. These include both obvious issues such as understanding of and appropriate response to error and alarm messages originating from the WAF, as well as aspects such as the modification of the WAF rule set in conjunction with changes to the applications being protected. To fully exploit the opportunity presented by a WAF as a central service point for instance for secure session management, positive collaboration with application development is required.
20 In other words: In order to fully exploit the potential of a WAF, it is not sufficient to view the WAF solely as an infrastructure component. For this reason, we propose the new role of a WAF application manager in addition to the role of a WAF platform manager, who in a similar way to a network firewall platform manager is responsible for the infrastructure-related aspects of the WAF - for each application which metaphorically speaking represents the bridge between the WAF and the specialist application. This person must have excellent knowledge of the WAF in order to be able to configure and monitor it for each individual application. He or she must know the application well to be able to classify and interpret messages coming from the WAF. A WAF application manager will normally maintain the WAF configuration for multiple applications. An example would be managing the WAF for all web-based SAP systems, whilst the shop system is managed by another WAF application manager. A detailed description of the proposed role model can be found in appendix A8.3. A7.3 Iterative procedure for implementation from basic security to full protection An iterative procedure has been tried and trusted as best practice in the implementation and operation of WAFs Step 1: Specification of role distribution / inclusion of application development First the responsibilities need to be defined, ideally on the basis of the role concept presented above. If the web application development is being carried out in-house, this needs to be integrated into the process as early on as possible. This means that all applications not yet in production use the central functions of the WAF as soon as possible, which increases security and saves time and money. In addition, possible obstacles on the personal level can also be overcome at an early stage Step 2: Basic protection for all web applications Regardless of the characteristics of the web application in question, basic protection, normally implemented as blacklisting, is activated first. Initial evaluations normally show the first successful protection measures, or show false positives i.e. rules are set too strictly At the same time this phase serves as training for the organisational processes Step 3: Creating a priority list of all existing web applications The principle for this list of priorities can be the measure of the access to the web application according to the checklist in appendix A8.1, in addition to the higher level criteria such as a loss of reputation, etc Further steps: Full protection of the web applications according to priority Web applications are fully protected from outside attack with whitelist rule sets in a step by step process according to the priority list. This is normally supported by a learning mode in the WAF or a source code review/penetration test. The WAF application manager, in collaboration with the specialist application manager, ensures the full availability of the application at all times, including during a conversion of the rule set.
Best Practices: Use of Web Application Firewalls
Best Practices: Use of Web Application Firewalls Version 1.0.4, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka BorisMore information
Best Practices Guide: Web Application Firewalls. OWASP German Chapter. The OWASP Foundation http://www.owasp.org. OWASP Europe Conference 2008
Europe Conference 2008 Best Practices Guide: Web Application Firewalls Alexander Meisel art of defence German Chapter Copyright The Foundation Permission is granted to copy, distribute and/or modify thisMore information
White Paper Secure Reverse Proxy Server and Web Application Firewall
White Paper Secure Reverse Proxy Server and Web Application Firewall 2 Contents 3 3 4 4 8 Losing control Online accessibility means vulnerability Regain control with a central access point Strategic securityMore information
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White PaperMore information
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...More information
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP TopMore information
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application DevelopmentMore information
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and SecurityMore information
Application Reviews and Web Application Firewalls Clarified. Information Supplement: PCI Data Security Standard (PCI DSS) Requirement:
Standard: Version: Date: Requirement: Author: PCI Data Security Standard (PCI DSS) 1.2 October 2008 6.6 PCI Security Standards Council Information Supplement: Application Reviews and Web Application FirewallsMore information
What is Web Security? Motivation
email@example.com http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is WebMore information
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure thatMore information
Web Application Firewalls: When Are They Useful? OWASP AppSec Europe May 2006. The OWASP Foundation http://www.owasp.org/
Web Application Firewalls: When Are They Useful? OWASP AppSec Europe May 2006 Ivan Ristic Thinking Stone firstname.lastname@example.com +44 7766 508 210 Copyright 2006 - The OWASP Foundation Permission is grantedMore information
Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified
Standard: Data Security Standard (DSS) Requirement: 6.6 Date: February 2008 Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified Release date: 2008-04-15 General PCIMore information
Title: Functional Category: Information Technology Services Issuing Department: Information Technology Services Code Number: xx.xxx.xx Effective Date: xx/xx/2014 1.0 PURPOSE 1.1 To appropriately manageMore information
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter firstname.lastname@example.com information
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application SecurityMore information
Attack Vector Detail Report Atlassian
Attack Vector Detail Report Atlassian Report As Of Tuesday, March 24, 2015 Prepared By Report Description Notes firstname.lastname@example.com The Attack Vector Details report provides details of vulnerabilityMore information
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-More information
WEB APPLICATION SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in partMore information
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet
Out of the Fire - Adding Layers of Protection When Deploying Oracle EBS to the Internet March 8, 2012 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business DevelopmentMore information
Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated VulnerabilityMore information
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or SystemMore information
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis Document Scope This document aims to assist organizations comply with PCI DSS 3 when it comes to Application Security best practices.More information
OWASP Top 10: Effectiveness of Web Application Firewalls. David Caissy AppSec Asia 2016 Wuhan, China
OWASP Top 10: Effectiveness of Web Application Firewalls David Caissy AppSec Asia 2016 Wuhan, China Agenda Commercial vs Open Source Web Application Firewalls (WAF) Bypassing WAF Filtering EffectivenessMore information
Sitefinity Security and Best Practices
Sitefinity Security and Best Practices Table of Contents Overview The Ten Most Critical Web Application Security Risks Injection Cross-Site-Scripting (XSS) Broken Authentication and Session ManagementMore information
OWASP Top 10 Effectiveness of Web Application Firewalls
OWASP Top 10 Effectiveness of Web Application Firewalls David Caissy About Me David Caissy Web App Penetration Tester Java Application Architect IT Security Trainer: Developers Penetration Testers 2 MyMore information
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0More information
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it mustMore information
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. CurrentMore information
Web Application Security. Vulnerabilities, Weakness and Countermeasures. Massimo Cotelli CISSP. Secure
Vulnerabilities, Weakness and Countermeasures Massimo Cotelli CISSP Secure : Goal of This Talk Security awareness purpose Know the Web Application vulnerabilities Understand the impacts and consequencesMore information
Intrusion detection for web applications
Intrusion detection for web applications Intrusion detection for web applications Łukasz Pilorz Application Security Team, Allegro.pl Reasons for using IDS solutions known weaknesses and vulnerabilitiesMore information
Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway
Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway All transparent deployment Full HTTPS site defense Prevention of OWASP top 10 Website AccelerationMore information
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standardsMore information
Table of Contents. Page 2/13
Page 1/13 Table of Contents Introduction...3 Top Reasons Firewalls Are Not Enough...3 Extreme Vulnerabilities...3 TD Ameritrade Security Breach...3 OWASP s Top 10 Web Application Security VulnerabilitiesMore information
ASP.NET MVC Secure Coding 4-Day hands on Course. Course Syllabus
ASP.NET MVC Secure Coding 4-Day hands on Course Course Syllabus Course description ASP.NET MVC Secure Coding 4-Day hands on Course Secure programming is the best defense against hackers. This multilayeredMore information
Application Security Testing. Indian Computer Emergency Response Team (CERT-In)
Application Security Testing Indian Computer Emergency Response Team (CERT-In) OWASP Top 10 Place to start for learning about application security risks. Periodically updated What is OWASP? Open Web ApplicationMore information
Standard: Web Application Development
Information Security Standards Web Application Development Standard IS-WAD Effective Date TBD Email firstname.lastname@example.com # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Web Application DevelopmentMore information
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:More information
TECHNICAL AUDITS FOR CERTIFYING EUROPEAN CITIZEN COLLECTION SYSTEMS Technical audits in accordance with Regulation 211/2011 of the European Union and according to Executional Regulation 1179/2011 of theMore information
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application PenetrationMore information
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validationMore information
Guidelines for Web applications protection with dedicated Web Application Firewall
Guidelines for Web applications protection with dedicated Web Application Firewall Prepared by: dr inŝ. Mariusz Stawowski, CISSP Bartosz Kryński, Imperva Certified Security Engineer INTRODUCTION SecurityMore information
001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110More information
Basic & Advanced Administration for Citrix NetScaler 9.2
Basic & Advanced Administration for Citrix NetScaler 9.2 Day One Introducing and deploying Citrix NetScaler Key - Brief Introduction to the NetScaler system Planning a NetScaler deployment Deployment scenariosMore information
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker
PCI-DSS and Application Security Achieving PCI DSS Compliance with Seeker www.quotium.com 1/14 Summary Abstract 3 PCI DSS Statistics 4 PCI DSS Application Security 5 How Seeker Helps You Achieve PCI DSSMore information
We protect you applications! No, you don t. Digicomp Hacking Day 2013 May 16 th 2013
We protect you applications! No, you don t Digicomp Hacking Day 2013 May 16 th 2013 Sven Vetsch Partner & CTO at Redguard AG www.redguard.ch Specialized in Application Security (Web, Web-Services, Mobile,More information
NSFOCUS Web Vulnerability Scanning System
NSFOCUS Web Vulnerability Scanning System Overview Most Web application systems are tailor-made and delivered in source codes by Customer Benefits Accurate Analysis on Website Vulnerabilities Fast scanMore information
Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go FromMore information
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks likeMore information
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank youMore information
IJMIE Volume 2, Issue 9 ISSN: 2249-0558
Survey on Web Application Vulnerabilities Prevention Tools Student, Nilesh Khochare* Student,Satish Chalurkar* Professor, Dr.B.B.Meshram* Abstract There are many commercial software security assuranceMore information
Web Application Security. Radovan Gibala Senior Field Systems Engineer F5 Networks email@example.com
Web Application Security Radovan Gibala Senior Field Systems Engineer F5 Networks email@example.com Security s Gaping Hole 64% of the 10 million security incidents tracked targeted port 80. Information WeekMore information
WEB CONTENT MANAGEMENT SYSTEM February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or inMore information
OWASP and OWASP Top 10 (2007 Update) OWASP. The OWASP Foundation. Dave Wichers. The OWASP Foundation. OWASP Conferences Chair dave.wichers@owasp.
and Top 10 (2007 Update) Dave Wichers The Foundation Conferences Chair email@example.com COO, Aspect Security firstname.lastname@example.com Copyright 2007 - The Foundation This work is availableMore information
THE SMARTEST WAY TO PROTECT WEBSITES AND WEB APPS FROM ATTACKS INCONVENIENT STATISTICS 70% of ALL threats are at the Web application layer. Gartner 73% of organizations have been hacked in the past twoMore information
ASL IT SECURITY BEGINNERS WEB HACKING AND EXPLOITATION V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: Learn the various attacks like sql injections, cross site scripting, command executionMore information
WEB APPLICATION VULNERABILITY STATISTICS (2013) Page 1 CONTENTS Contents 2 1. Introduction 3 2. Research Methodology 4 3. Summary 5 4. Participant Portrait 6 5. Vulnerability Statistics 7 5.1. The mostMore information
Web Application Firewall-as-a-Service
data sheet Most websites are vulnerable to attack. Vulnerabilities are due to both insecure coding practices and an increasingly complex threat landscape. In 2015, two the application security testingMore information
Reducing Application Vulnerabilities by Security Engineering
Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The informationMore information
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basisMore information
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. TheseMore information
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL. Ensuring Compliance for PCI DSS 6.5 and 6.6
WHITE PAPER FORTIWEB WEB APPLICATION FIREWALL Ensuring Compliance for PCI DSS 6.5 and 6.6 CONTENTS 04 04 06 08 11 12 13 Overview Payment Card Industry Data Security Standard PCI Compliance for Web ApplicationsMore information
Data Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The GiantMore information
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is toMore information
Web Application Vulnerability Testing with Nessus
The OWASP Foundation http://www.owasp.org Web Application Vulnerability Testing with Nessus Rïk A. Jones, CISSP firstname.lastname@example.com Rïk A. Jones Web developer since 1995 (16+ years) Involved with informationMore information
Columbia University Web Security Standards and Practices. Objective and Scope
Columbia University Web Security Standards and Practices Objective and Scope Effective Date: January 2011 This Web Security Standards and Practices document establishes a baseline of security related requirementsMore information
Application Firewall Overview. Published: February 2007 For the latest information, please see http://www.microsoft.com/iag
Application Firewall Overview Published: February 2007 For the latest information, please see http://www.microsoft.com/iag Contents IAG Application Firewall: An Overview... 1 Features and Benefits... 2More information
Network Test Labs (NTL) Software Testing Services for igaming
Network Test Labs (NTL) Software Testing Services for igaming Led by committed, young and dynamic professionals with extensive expertise and experience of independent testing services, Network Test LabsMore information
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions email@example.com Agenda Current State of Web Application Security UnderstandingMore information
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04More information
CompTIA Security+ (Exam SY0-410)
CompTIA Security+ (Exam SY0-410) Length: Location: Language(s): Audience(s): Level: Vendor: Type: Delivery Method: 5 Days 182, Broadway, Newmarket, Auckland English, Entry Level IT Professionals IntermediateMore information
Cloud Security:Threats & Mitgations
Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s DeveloperMore information
Security Testing & Load Testing for Online Document Management system
1 Security Testing & Load Testing for Online Document Management system Abstract The client is a leading provider of online technical documentation solutions in UK, they wanted to protect their documentsMore information
How to complete the Secure Internet Site Declaration (SISD) form
1 How to complete the Secure Internet Site Declaration (SISD) form The following instructions are designed to assist you in completing the SISD form that forms part of your Merchant application. Once completed,More information
STOPPING LAYER 7 ATTACKS with F5 ASM. Sven Müller Security Solution Architect
STOPPING LAYER 7 ATTACKS with F5 ASM Sven Müller Security Solution Architect Agenda Who is targeted How do Layer 7 attacks look like How to protect against Layer 7 attacks Building a security policy LayerMore information
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, notMore information
Guide for the attention of developers/hosts for merchant websites on the minimum level of security for bank card data processing
Guide for the attention of developers/hosts for merchant websites on the minimum level of security for bank card data processing Foreword This guide in no way intends to replace a PCI DSS certificationMore information
Rational AppScan & Ounce Products
IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168More information
The New PCI Requirement: Application Firewall vs. Code Review
The New PCI Requirement: Application Firewall vs. Code Review The Imperva SecureSphere Web Application Firewall meets the new PCI requirement for an application layer firewall. With the highest securityMore information
How to Build a Trusted Application. John Dickson, CISSP
How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.More information
Network Security Audit. Vulnerability Assessment (VA)
Network Security Audit Vulnerability Assessment (VA) Introduction Vulnerability Assessment is the systematic examination of an information system (IS) or product to determine the adequacy of security measures.More information
Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0
Special Publication 500-269 Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 Paul E. Black Elizabeth Fong Vadim Okun Romain Gaucher Software Diagnostics andMore information
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site IsMore information
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 184.108.40.206 11/14/2012 8:52:13 AM 11/14/2012More information
Web Application Firewall on SonicWALL SRA
Web Application Firewall on SonicWALL SRA Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SRA 6.0. This document contains the followingMore information
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchangeMore information
Making your web application. White paper - August 2014. secure
Making your web application White paper - August 2014 secure User Acceptance Tests Test Case Execution Quality Definition Test Design Test Plan Test Case Development Table of Contents Introduction 1 WhyMore information
Client logo placeholder XXX REPORT. Page 1 of 37
Client logo placeholder XXX REPORT Page 1 of 37 Report Details Title Xxx Penetration Testing Report Version V1.0 Author Tester(s) Approved by Client Classification Confidential Recipient Name Title CompanyMore information
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandatedMore information
Members of the UK cyber security forum. Soteria Health Check. A Cyber Security Health Check for SAP systems
Soteria Health Check A Cyber Security Health Check for SAP systems Soteria Cyber Security are staffed by SAP certified consultants. We are CISSP qualified, and members of the UK Cyber Security Forum. SecurityMore information
Enterprise Application Security Workshop Series
Enterprise Application Security Workshop Series Phone 877-697-2434 fax 877-697-2434 www.thesagegrp.com Defending JAVA Applications (3 Days) In The Sage Group s Defending JAVA Applications workshop, participantsMore information
Barracuda Web Site Firewall Ensures PCI DSS Compliance
Barracuda Web Site Firewall Ensures PCI DSS Compliance E-commerce sales are estimated to reach $259.1 billion in 2007, up from the $219.9 billion earned in 2006, according to The State of Retailing OnlineMore information
Barracuda Web Application Firewall vs. Intrusion Prevention Systems (IPS) Whitepaper
Barracuda Web Application Firewall vs. Intrusion Prevention Systems (IPS) Whitepaper Securing Web Applications As hackers moved from attacking the network to attacking the deployed applications, a categoryMore information
Web application security: automated scanning versus manual penetration testing.
Web application security White paper January 2008 Web application security: automated scanning versus manual penetration testing. Danny Allan, strategic research analyst, IBM Software Group Page 2 ContentsMore information
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applicationsMore information
PCI Requirements Coverage Summary Table
StillSecure PCI Complete Managed PCI Compliance Solution PCI Requirements Coverage Summary Table January 2013 Table of Contents Introduction... 2 Coverage assumptions for PCI Complete deployments... 2More information
CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office
CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier TornerMore information
Penta Security 3rd Generation Web Application Firewall No Signature Required. www.gasystems.com.au
Penta Security 3rd Generation Web Application Firewall No Signature Required www.gasystems.com.au 1 1 The Web Presence Demand The Web Still Grows INTERNET USERS 2006 1.2B Internet Users - 18% of 6.5B peopleMore information
Interactive Application Security Testing (IAST)
WHITEPAPER Interactive Application Security Testing (IAST) The World s Fastest Application Security Software Software affects virtually every aspect of an individual s finances, safety, government, communication,More information


text:
Minami Alps hikes (南アルプス)
The Minami Alps are one of the most rugged, inaccessible mountain chains on Honshu and home to some of the most spectacular vistas of Mt. Fuji. The weather is usually more stable than the Chuo or Kita Alps and a full-length traverse of the entire range is without a doubt the toughest multi-day trek in Japan.


text:
Inserts & Logs
Our Fireplace Insert collection is the ideal and most cost effective solution for your inoperable gas or natural fireplace. Do you have a broken down wood burning or gas fireplace that you want to bring back to life? A gel fireplace insert is the easiest and cost effective answer for any interior.
A gel fireplace insert is much more cost effective than hiring an expensive repairman. Our inserts only require simple assembly which you can do yourself. Less than 30 minutes from box to burn.
Simply measure your existing wood or gas fireplace to determine what size insert would suit your needs, then order it, assemble it, and light a fire. What could be easier?
Fireplace Logs
Does your existing gel fuel fireplace need a little sprucing up? Use our stand alone gel fuel
Gel Fireplace Inserts
SPECIAL SALE ON YOUR FIREPLACE INSERT!!! Our Fireplace Insert collection is the ideal and most cost
All your personal information
is encrypted and 100% secure.


text:
S.B. 243 enacted a one-time sales tax holiday to occur only in 2015. The holiday starts on Friday, August 7, 2015 at 12:01 a.m. and ends on Sunday, August 9, 2015 at 11:59 p.m. During the holiday, the following items are exempt from sales and use tax: An item of clothing priced at $75 or […]
State Sales Tax
New York State – Changes in sales tax clothing exemption effective April 1, 2012
Sales of eligible clothing and footwear for less than $110 are exempt from state sales tax Beginning April 1, 2012, the New York State sales tax clothing exemption is restored to the original less-than-$110 threshold. Sales of eligible clothing and footwear costing less than $110 per item or pair are exempt from the state's 4% […]
New York State and Local Annual Sales and Use Tax Return – Due date March 20, 2012
Instructions for Form ST-101 New York State and Local Annual Sales and Use Tax Return For tax period: March 1, 2011, through February 29, 2012 You must file a return even if you had no taxable sales and made no purchases subject to tax. Filers who owe more than $3,000 in tax for this annual […]
Ranking State and Local Sales Taxes
Five states do not have a statewide sales tax: Alaska, Delaware, Montana, New Hampshire and Oregon. Four of these five (all but Alaska) do not allow localities to charge a local sales tax. Read more
Iowa Sales Tax Holiday 2011
Sales Information Taxable and Exempt List More
Florida Back-to-School Sales Tax Holiday, August 12-14, 2011
Florida's back-to-school sales tax holiday will begin at 12:01 a.m., Friday, August 12, 2011, and end at midnight Sunday, August 14, 2011. During this period, no sales tax will be collected on sales of clothing, footwear, and certain accessories selling for $75 or less, or on certain school supplies selling for $15 or less. […]
Connecticut 2011 Sales Tax Holiday
Connecticut shoppers will have one week to buy items of clothing and footwear costing under $300 without paying Connecticut sales tax. This year, the tax free week will run from Sunday, August 21 through Saturday, August 27, 2011. More information about the rules that apply to the sales tax free week are found in: SN 2006(10), One-Week […]
Arkansas 2011 Sales Tax Holiday
Beginning at 12:01 a.m. on Saturday August 6, 2011, and ending at 11:59 p.m. on Sunday August 7, 2011, the State of Arkansas will hold its sales tax holiday allowing shoppers the opportunity to purchase certain School Supplies, School Art Supplies, School Instructional Materials, and clothing free of state and local sales or use tax. […]
Alabama 2011 Sales Tax Holiday
The State of Tennessee's Annual Sales Tax Holiday is held every year on the first Friday in August and ends the following Sunday night. This year's tax-free holiday weekend begins at 12:01 a.m on Friday, August 5 and ends Sunday, August 7 at 11:59 p.m. What is Tax Free?
2011 State Sales Tax Holidays
2011 State Sales Tax Holidays


text:
Valrico Station Apartments are set back in the giant live oaks of Florida and are the finest in apartment living, just minutes from Tampa and Brandon. Our 1, 2 and 3 bedroom apartment homes offer spacious floor plans with tons of extra storage. We are eager to show you our beautiful community, and would like to set an appointment for you to view Valrico Station apartments! We would love to have you as a new resident!
We are offering newly constructed and renovated apartments! Come see Valrico's newest community with resort-style amenities, including our lighted tennis courts, 2 large salt water swimming pools with sun deck, state of the art fitness center, business center with Wi-Fi, bark park for your fur-family and car care center. It's easy to see why we're continually known as the best Valrico has to offer! Come and experience the Valrico lifestyle.
7-Month, 8-Month, 9-Month, 10-Month, 11-Month, 12-Month
Terrible, terrible, terrible. Over priced, pool area is left trashed every weekend buy residents who bring more than the limit of guest, children are unsupervised by thier parents. The trash facility always has garbage piled up from Friday to Monday, looks like a small version of the Rocky Mountains by Sunday evening. The security gates are always broken and left open. Find something else.
Looking for a two bedroom apartment. One bath is ok.
this is good place to live
This is a good place to live.
This is a good place to live.
We are not always told when there is a worker that will be coming by our apartment. I am a young college girl and when strangers come knocking on the door saying they are there to do some type of work in my apartment I will not let them in because I was not correctly notified before this work was to be done. The guy that it claims to have has not been open since I moved in over a year ago. The staff is very friendly and easy to talk to about any issues.


text:
- Home >
- Accessories >
- Power Tool Accessories >
- Multitool, Precision & Modelling >
- Rotary Multitool Accessories >
- Cutting Discs for Rotary Multitools >
- Proxxon Diamond Cutting Discs
For cutting marble, brick, plaster and many other materials in the sanitary and electrical fields. Only 0.6mm kerf, with two diameters available either 20mm or 38mm, both mount on a 2.35mm diameter arbor.
Own it? Review it! Be the first to tell everyone what you think about this product...


text:
Plaque on the garden wall
Philip Speakmann Webb
Red brick and tiling
Morris's Red House
Bexleyheath, Greater London
The blue plaque for Red House is on the original red-brick garden wall, beside the gate. As it says, Morris only spent five years at Red House, but it was so important to him, and to his career. It was the need to furnish it that inspired him "to found the interior design firm that bears his name" (Red House 3); while the house itself, "a complex fusion of Morris's romantic utopianism and Webb's practical common sense" (Red House 7), remains to this day a huge and enduring influence on domestic architecture in Britain.


text:
Arcadian America: The Death and Life of an Environmental Tradition (New Directions in Narrative History)By: Aaron Sachs (author)Hardback
Up to 2 WeeksUsually despatched within 2 weeks
DescriptionPerhaps America's best environmental idea was not the national park but the garden cemetery, a use of space that quickly gained popularity in the mid-nineteenth century. Such spaces of repose brought key elements of the countryside into rapidly expanding cities, making nature accessible to all and serving to remind visitors of the natural cycles of life. In this unique interdisciplinary blend of historical narrative, cultural criticism, and poignant memoir, Aaron Sachs argues that American cemeteries embody a forgotten landscape tradition that has much to teach us in our current moment of environmental crisis. Until the trauma of the Civil War, many Americans sought to shape society into what they thought of as an Arcadia-not an Eden where fruit simply fell off the tree, but a public garden that depended on an ethic of communal care, and whose sense of beauty and repose related directly to an acknowledgement of mortality and limitation. Sachs explores the notion of Arcadia in the works of nineteenth-century nature writers, novelists, painters, horticulturists, landscape architects, and city planners, and holds up for comparison the twenty-first century's-and his own-tendency toward denial of both death and environmental limits. His far-reaching insights suggest new possibilities for the environmental movement today and new ways of understanding American history.
About AuthorAaron Sachs is associate professor of history and American studies, Cornell University.
Product Details
- publication date: 08/01/2013
- Format: Hardback
- Number Of Pages: 496
- weight: 953
Delivery Information
- Saver Delivery: Yes
- 1st Class Delivery: Yes
- Courier Delivery: Yes
- Store Delivery: Yes


text:
We run into this problem at the Missourian all the time — a reporter, usually doing their first-ever video report, decides to save their movie as an .mp4, .wmv or .mpeg. The only problem is, the Missourian's website only supports .mov files. (I could spend an entire blog post complaining about why I hate the .mov format, but that's not the point here …)
Here are two pretty good options for converting a video file from one format to the other.
The first is Media Converter, a webware site that is so ridiculously easy and fast it's almost too good to be true. Best of all, it's free (or you can pay for a premium upgrade, the free version is pretty sweet).
It works like this. Upload the video you want to convert. Convert it to the format you want. Download it back to your desktop.
It's that simple. No registration required. No menus with loads of confusing options for the video novice. You can convert up to five videos a day before you have to shell out for the premium site (prices start at $4 per week; the weekly rate goes down the longer you sign up).
There are advantages to premium membership, like the ability to convert bigger documents (up to 1GB in size vs. 100 MB for free) and up to 5 GB of online storage. So, if you have tons of videos to convert and they're all huge, shell out the $4. Otherwise, enjoy the free.
Another option is Prism, from NCH Software. This little bit of freeware goodness is every bit as easy Media Converter, but it offers a few more bells and whistles, like the ability to resize videos. Oh, and if you're without an Internet connection while playing with your videos, it's handy to have the software on your hard drive rather than online.
Prism is available for both Mac and PC.
Filed under: Geeky links, Software, Web sites |


text: (Swedesboro, NJ) – Gloucester County Freeholder Director Robert M. Damminger and Freeholder Lyman Barnes announced today that the Swedesboro Branch of the Gloucester County Library System has been awarded a Local History grant from the Gloucester County Cultural and Heritage Commission. The funds, provided by the New Jersey Historical Commission, will allow the Swedesboro Library to offer three public programs focusing on the history of the area now known as Swedesboro."Having been a lifelong resident of Gloucester County, I am still intrigued by the rich history of our area," said Freeholder Director Robert M. Damminger. "According to 2010 census information, Gloucester County had the highest population growth in New Jersey from 2000 to 2010 at 13.2%. That growth equates to 33,615 new residents over the last ten years, and I am sure many of them are interested in the history of our region," stated Director Damminger.Freeholder Lyman Barnes, Liaison to the Gloucester County Library System, said that the historical programs are designed to help participants gain insight into early-American life for Swedish settlers. Freeholder Barnes said, "This is going to be a wonderful series on the origin of one of our most historical boroughs. Whether you drive through it, shop in it or live in it, I do encourage everyone to come out and learn about the importance of Swedesboro."Monday, April 8th at 7pm: Dr. Kevin Brady of the American Institute for History Education will present a talk, "Sweden During the Time of Exploration".Thursday, May 23rd at 7pm: "Memories of Life in New Sweden". Aleasa Hogate of the New Sweden Centre will perform as her ancestor, Elisabeth Dalbo, who lived in Raccoon (Swedesboro) in the 17th century.Tuesday, October 22nd at 7pm: Dr. Kim-Eric Williams, Swedish Colonial Society Historian, will discuss "Culture, Heritage, and Genealogy of New Sweden Colonists".All programs are free and open to the public. The Swedesboro Branch is located at 1442 Kings Highway, Swedesboro. For more information call the library at 856-467-0111.These programs are made possible in part by funds from the New Jersey Historical Commission, a division of the Department of the State, and the Gloucester County Cultural and Heritage Commission at Gloucester County College.


text:
Despite promising research, there is neither a cure for Parkinson's disease (PD) nor medications that can reverse its course. But there can be.
We can make research more efficient and effective by ensuring that people with Parkinson's and care partners are primary partners in research alongside scientists, industry and government. As a signature program of the Parkinson's Foundation, Parkinson's Advocates in Research (PAIR) is making this partnership a reality. We are bringing together the people who live with Parkinson's and the people developing new treatments.
How PAIR Works
- Through in-person trainings and an online course (coming Spring 2019), the PAIR program gives people impacted by Parkinson's the knowledge and skills needed to pair up with scientists and health professionals.
- Through collaborating with research institutions, the PAIR program facilitates partnerships between Research Advocates and professionals at the front lines of research.
- To learn more about PAIR, visit Advocate for Research here.
Get Involved: In-Person Trainings
The cornerstone of the PAIR program is a national network of Research Advocates. Since 2008, the program has trained more than 300 people with PD and caregivers as Research Advocates, preparing them to work on the frontlines with the professionals seeking better PD treatments. Research Advocates change research by:
- Prioritizing research
- Improving studies
- Influencing stakeholders
All Parkinson's Foundation Research Advocates complete a three-day training program at one of the Foundation's Learning Institutes. Leading experts from the field teach them about the science of Parkinson's and new treatment developments (see our curriculum here). Each person who completes a Learning Institute becomes a Parkinson's Foundation Research Advocate.
Training is just the beginning of a Research Advocate's work and Parkinson's Foundation support of his or her advocacy. The entire network works closely with Foundation staff and each other to identify advocacy opportunities, take part in ongoing education, share resources and network with the research community.
We recommend these trainings to individuals who can commit at least two to three hours a month to research advocacy work.
Happening in 2018
Are you interested in playing your part to change research, but have decided that an in-person training is not an option right now? There's still a way to get involved. Take the PAIR online course that offers the core components of our in-person trainings from the comfort of home. You then have the opportunity to work closely with Parkinson's Foundation Research Advocates, foundation staff and local research centers to find ways to advance Parkinson's research in your community. We recommend this course to anyone impacted by PD. The online course is coming soon in 2018!
To learn more about this program or speak with the Parkinson's Foundation about partnering with a Research Advocate at your institution, clinical study or support group, please contact our Helpline at 1-800-4PD-INFO (473-4636) or email@example.com.