text:
Towards a competitive low-carbon energy sector
EU sets out plans for cutting emissions by over 80% without disrupting energy supplies and competitiveness. Committed to reducing greenhouse gas emissions to 80-95% below 1990 levels by 2050, the EU is exploring the challenges of decarbonisation.
In March this year the EU published its low-carbon roadmap covering all sections of the economy. It is also producing specific plans to cover individual economic sectors. The latest to be unveiled is the energy roadmap 2050 .
As future needs and supply are difficult to predict, the plan presents numerous scenarios examining the possible impacts, challenges and opportunities of modernising the energy system. They take into account potential changes in carbon prices, technology and networks.
Routes towards decarbonisation
Scenarios were created by combining the four main decarbonisation options – energy efficiency, renewable energy, nuclear and carbon capture and storage. The main findings suggest:
- decarbonisation is possible and could be less costly than current policies in the long-run
- energy efficiency and renewables are critical, regardless of the energy mix chosen
- investment to modernise infrastructure must start now to avoid more costly changes in the future
- a common energy market is vital to keeping energy costs down and to ensure a secure supply – it should be completed by 2014.
All the scenarios depend on every country taking action on climate change. And regardless of decarbonisation efforts, the EU's energy networks need investment to replace ageing infrastructure – some of which was built up to 40 years ago.
Investing for the future
With electricity prices set to rise until 2030, investment is needed now in "intelligent" electricity grids and improved technologies to produce, transmit and store energy more effectively. Together with a common energy market, these measures should ensure that prices fall in the long run.
The costs will be outweighed by the high level of sustainable investment brought into the European economy, related jobs, and reduced dependency on imports.
Next steps
Proposals based on the roadmap's approach will follow in the coming years, starting with measures targeting the internal market, renewable energy and nuclear safety next year.Quelle: PM © Europäische Kommission
Hier finden Sie thematisch passend weitere Einträge aus unserem Firmenportal, oder aktuelle Beiträge aus den EU Wirtschaftsnews:


text:
This section contains 803 words
(approx. 3 pages at 400 words per page)
Chapter Seven: A City Transformed Summary and Analysis
The new president, Louis Bonaparte, was seen as courteous and attentive by the American diplomatic corps. He was considered difficult to read and was known as a womanizer. One American, Dr. Thomas W. Evans, of Philadelphia, formed a close friendship with the president. Louis Bonaparte was born in 1808 and was the son of the first Napoleon's brother, Louis. His popularity resided mainly in the rural areas that overwhelmingly voted for him after an earlier coup d'etat he staged that basically made him a dictator.
Improvements were seen throughout the city; however, the disparity between the rich and poor was ever increasing. Demolition was taking place everywhere in the city to make way for the new, modern and restored structures. Les Halles, a new central market replete with ironwork and skylight roof, was erected...
(read more from the Chapter Seven: A City Transformed Summary)
This section contains 803 words
(approx. 3 pages at 400 words per page)

subset: commoncrawl


text:
Eyebright Herb Tea Health Benefits
- Relieves Allergy Symptoms
- Improves Memory & Cognitive Function
- Supports Upper Respiratory Health
- 18 Bleach Free Tea Bags / Box
Steeping Instructions
Fresh water is essential for brewing a proper cup of tea.
- Use 1 teabag per cup of boiling water.
- Cover and steep for 3 to 6 minutes
- Remove tea bag and enjoy!
Free Shipping on orders over $50.
*On orders placed in the United States. Learn More
Satisfaction Guaranteed
100% Money Back and Satisfaction Guarantee. NO questions asked!
Eyebright is a short flowering plant native to alpine meadows and pastures across Europe and western Asia. It is characterized by tiny white flowers whose ornate petal shape somewhat resembles an orchid. It is sometimes called euphrasia, a name it earned from Euphrosyne, a figure in Greek mythology known for her joy and mirth. Eyebright tea is made from the petals, stems and leaves, and has been enjoyed since the Elizabethan era or even longer. As a tea, eyebright offers a pleasantly subtle fragrance and taste, and is well complemented by a little sugar or honey.
A Closer Look At Eyebright
Eyebright tea is more than a fragrant floral brew; this tea offers a plethora of vitamins, minerals, and other important nutrients. Eyebright tea can provide a boost in vitamin C, vitamin E, several B vitamins, and even vitamin D. A variety of minerals can be found in eyebright tea as well, including iron, phosphorus, potassium, selenium and zinc. Flavonoids, tannins, beta carotene and volatile oil are also present in eyebright tea, and many of its constituents have antioxidant properties. These elements combined give an even bigger reason to experience eyebright tea for yourself.
Great Deals for Avid Tea Drinkers
If you're an herbal tea lover, save more buy making bulk purchases of eyebright tea so that you can keep a good stock of tea on hand to enjoy regularly or as needed. Furthermore, purchases of $50 or more are eligible for FREE shipping and we often have coupon codes available to help you save even more!
Why choose Buddha Teas?
What sets us apart from other tea companies? We start with a philosophy of living in harmony with nature, not using it for profit. Buddha Teas uses only fresh, pure organic or sustainably wild harvested ingredients and maintains their natural purity in every tea we sell. We have also created the "Teas for Trees" campaign, planting 5000 trees a year to offset the paper use in our tea bags. Each of our tea bags is bleach-free to eliminate the risk of chemicals, and our boxes are made from 100% recycled material. When you buy Buddha Teas, you'll enjoy the fresh, full flavor of a truly natural tea in every sip.
Learn About Our "Tea For Trees" Campaign
Buddha Teas is always looking for ways we can give back to our world. Our Tea for Trees campaign is designed to restore one of our most important resources and offset the use of paper in our products. We've partnered with the National Forest Foundation's "Trees for US" program to plant thousands of trees every year. Every box you purchase helps us to support this cause. Read more about it here.
Review Title: Eh, it's alrightReview by Kimberlyon June 12, 2018
Review Title: Eyebright teaReview by Debraon April 18, 2018
Review Title: Very SatisfyingReview by Victoriaon April 4, 2018
Review Title: AwesomeReview by Johnon September 26, 2017
Review Title: Eyebright Herb TeaReview by Evaon September 4, 2017
Es un producto de calidad, es grato comprar en la web, y el servcio al cliente es muy bueno!
Review Title: Why I use Eyebright Herb teaReview by Kimon September 4, 2017
Review Title: My new favorite tea company.Review by Julieon April 24, 2017
Review Title: :)Review by margareton March 23, 2017


text:
"To know someone truly, you should walk a mile in their shoes." Sarcoma UK supporters walk a heck of a lot further than that.
There are loads of walking events all around the UK and abroad to meet other people, whilst raising funds for Sarcoma UK.
All of our trekking events are organised by a third-party, Do It For Charity.
View 2016-2017 dates, search for the event that's right for you, or book directly online
Our fundraising team are here to support you firstname.lastname@example.com
Three Peaks
Take on not one, not two, but three of the UK's tallest peaks – all in 24 hours.
As one of the most popular UK-based challenges, this challenge is a real way to test yourself. In the space of 24 hours, you will tackle Ben Nevis in Scotland, Scafell Pike in England, and finish the day climbing Wales' Snowdon. That's a total of 3,407m climbed – what an achievement!
Registration fee: £99
Sponsorship Level: £600
Next date TBC: check back here
Mount Kilimanjaro
Take on a once in a lifetime challenge.: conquer Kilimanjaro. This iconic challenge will take you through diverse landscapes: jungles, snowy mountainsides, volcanoes. Push yourself to complete this high-altitude challenge, and be rewarded with incredible views over this stunning part of Africa.
Registration fee: £399
Sponsorship Level: £ 4,340
Find out more information or book online today
China Trek
Take in the history as you spend nine days walking one of the most iconic and celebrated monuments in the world.
Covering a stretch of the Great Wall of China between Huangyaguan and Beijing, this challenge will take you on a history-steeped exploration of this beautiful part of China.
Registration fee: £ 349
Sponsorship Level: £2,840
Find out more information and book online today
I've bought my own place on a trek
We'd love to have you on Team Sarcoma. You will receive the same support and materials . Let us know and we'll send you our fundraising pack.


text:
It looks like you're using an Ad Blocker.
Please white-list or disable AboveTopSecret.com in your ad-blocking tool.
Thank you.
Some features of ATS will be disabled while you continue to use an ad-blocker.
(from my links above and previous member posting within it)
Hundreds of spectators .....watched glowing egg-shaped object moving
from place to place and...... a times shooting down beams of light....... Mayor Wolfe, some Councilmen, Dam guards and young teen-age children of the Councilmen were up there and they declared: "Up on the Dam when this object came over and was over the ice, and put out a flash of light (light beam), and the beams of light seemed to put holes in the ice"
Originally posted by ThePeaceMaker
Hmm as a previous poster said .. They couldn't find a source of ignition yet they don't want to investigate it .. Hmm suspicious


text:
Selected Works of Page Scholars
Anghelcev, George, and Sela Sar. "In the mood for [the right kind of] social marketing communication: how congruity between consumer mood and message framing influences intentions to recycle." Journal of Social Marketing 4.1 (2014): 38-57.
Pompper, D. (2014). The Sarbanes-Oxley Act: Impact, processes and roles for strategiccommunication.International Journal of Strategic Communication,8(3). Special issue, "Financial Strategic Communication."
Ojebode, Ayobami. (2013). Ethical dilemma revisited: PBO newspapers and the professional elbowroom of the Nigerian journalist. Journal of African Media Studies, Volume 5 (3), Pages 295 - 322.
Snow, Nancy. (2013) Truth is the Best Propaganda: Edward R. Murrow's Speeches in the Kennedy Years. McLean, VA: Miniver Press.
Daugherty, Emma L. (2012). Executive women in business: Exploring challenges and pathways of specialty areas. International Journal of Business Strategy, (12)1, 47-56.
Daugherty, E. L. (2012, March). "An Exploratory Study of Successful Entrepreneurial Women in Communications: Recommendations from the Field." Presented at the International Academy of Business and Economics Annual Meeting. Key West, FL.
Kanihan, S. (2013). Communications managers in the dominant coalition: Power attributes and communications practices.Journal of Communications Management, 17 (2).
Schwartz, M. S. (2012). The State of Business Ethics in Israel: A Light Unto the Nation?Journal of Business Ethics, 105(4),429-446.
Pompper, D., & Crider, D. (2012). New media and symmetry-conservation duality: As viewed through the legal / public relations counselor relationship lens. In S. G. Duhé (Ed.),New media and public relations, 2nd ed. (pp. 31-39). New York: Peter Lang.
Gangadharbatla, H. & Sheehan, K. (2012). Individual Factors and Green Message Reception: Framing, Lifestyles and Environmental Choices.Talking Green (pp. 129-146). New York, NY: Peter Lang.
Foreman, G.(2010)The Ethical Journalist: Making Responsible Decisions in the Pursuit of News. UK: Blackwell Publishing.
Cummings, R. H. (2010)Radio Free Europe's "Crusade for Freedom". Jefferson, NC: McFarland & Company, Inc.
Connolly-Ahern, C., Grantham S. & Cabrera-Baukus, M. (2010). The Effects of Attribution of VNRs and Risk on News Viewers' Assessments of Credibility.Journal of Public Relations Research,22(1), 49-64.
Peck, L. A. & Matchett, N. J. (2010) An Online Ethics Training Module for Public Relations Professionals: A Demonstration Project.Public Relations Journal, 4(4).
Cooper, T. (2009). Learning from the experts: How ethics and moral philosophy are taught at leading
English-speaking institutions.Ethical Space: The International Journal of Communications Ethics. 6(1).
Polonsky, M. J. & Grau, S. L. (2008). Evaluating the Social Value of Charitable Organizations: A Conceptual Foundation.Journal of Macromarketing. (June 2008), 130-140.
Schejter, A. (2007) "Jacob's Voice, Esau's Hands:" Transparency as a First Amendment Right in an Age of Deceit and Impersonation.Hofstra Law Review35(2), 1489-1518.
Schejter, A. (2006). "Art Thou For Us, or For Our Adversaries?" Communicative Action and the Regulation of Product Placement: A Comparative Study and a Tool for Analysis.Tulane Journal of International and Comparative Law,15(1), 89-119.
Fitzpatrick, K. R. (2010)Future of United States Public Diplomacy. Netherlands: Brill Publishing.
Wilkins, L. & Coleman, R. (2009). The Moral Development of Public Relations Practitioners: A comparison with Other Professions and Influences of Higher Quality Ethical Reasoning.Journal of Public Relations Research, 21(3), 318-340.
Fisher Liu, B. (2009). An analysis of US government and media disaster frames.Journal of Communications Management. 13(3), 268-283.


text:
Five things for pharma marketers to know: Wednesday, June 3
An FDA panel is set to review Eli Lilly's experimental lung-cancer drug, necitumumab, in combination with two chemotherapy agents on July 9. Lilly is seeking an indication in non-small cell lung cancer, the most common form of the disease. If approved, it would mark Lilly's third lung-cancer treatment, according to Reuters.
AstraZeneca CEO Pascal Soriot said the company would consider acquiring a drug developer specializing in cancer immunotherapies. Soriot answered that AstraZeneca "certainly would consider it" when asked if the company would buy a company like Juno Therapeutics—a company it is currently collaborating with. Juno is now developing a highly touted CAR-T cancer treatment, according to Bloomberg Business.
Pharmacy benefit manager Express Scripts was so desperate to find ways to pay for Gilead Sciences' $84,000-per-treatment pill Sovaldi that it considered docking a boat off the coast of Miami and selling discount versions of the drug, according to Bloomberg Business. The PBM stopped covering Sovaldi this year due to its cost.
For a medical and commercial trend report geared toward marketers of anticancer modalities, click here for our latest eBook, "Innovations in Oncology."
Teva is reportedly positioning itself to take over Mylan, Reuters reported. The drugmaker is looking to buy more equity in Mylan in preparation for a possible legal challenge to its spurned takeover bid, unnamed sources told the news service. Mylan's executive chairman recently told investors he would consider a merger with Teva if it was the buyer.
Speaking of hostile takeovers, Perrigo agreed to buy a portfolio of OTC drugs from GlaxoSmithKline in a move that could help it fend off Mylan's unwanted advances. Perrigo purchased cold and flu medicines, nicotine patches and cold-sore treatments sold mainly in European markets for an undisclosed sum, according to Investor's Business Daily.


text:
What is the sound of You?
Sound can express feelings and identity more than anything. We love music. All kinds OF music. Your kind, my kind, his kind and her kind. So that´s what we do, we make the sound of you
Every year 20.000 new brands are being launched, compared to 500 in the 70´s. brands that have developed their own sound are 96% more recognized than other brands. That´s why the world's biggest brands like coca-cola, starbucks and McDonald's have their own sound strategy and signature music.
What is yours? OUR TEAM WON INTERNATIONAL AWARDS AND MADE MUSIC FOR TV-series, films, brands and world-class artists such as sTING, SHIRLEY BASSEY, Scandic hotels, moods of norway, KLP, woolland, Moo , nrk, tv2, JT FoXX, UNITED YACHT SALES and more.
... and THIS IS THE SOUND OF us:
It`s time to get your own sound.


text:
Food for Friends Over 100 recipes based on the award-winning cookbook 'Modern Vegetarian Cooking at Home' by the UK's landmark vegetarian restaurant, Food for Friends.
The original cookbook was recommended by the BBC Good Food Magazine and was voted one of the top ten vegetarian cookbooks by The Independent.
Based on the restaurant's seasonal menus and daily specials, this iBook is an inspiring and practical approach to cooking meals that are meat-free or that cater for special dietary requirements such as vegan or gluten-free diets.
The recipes reflect their love of Middle Eastern, North African and Mediterranean food. Their signature mix of ingredients, colours, textures and flavours attracts all lovers of good food. Recipe favourites include Thai Sweetcorn Fritters, Puy Lentil and Red Wine Moussaka and White Chocolate Bread and Butter Pudding.


text:
Grey's Anatomy Spoiler Watch: More MerDer Trouble?Steve Marsi at . Comments
E! Online columnist Kristin Veitch dishes a little on the upcoming guest star that poses potential problems for Derek and Meredith. This doesn't reveal a whole lot, so no real spoilers here. Just more MerDer hesitation and conflict. Will it ever end? Or will this finally help lead TV's favorite couple to a better end?
Question: Any word on Meredith Grey and Derek Shepherd? I'm so tired of the back and forth. Can they just get together or break up for good?
Answer: Now, what fun would that be?! Trust me, I feel your pain, but this is TV, and in the spirit of Sam & Diane / Ross & Rachel / Kristin & Stamos, things will get more complicated before they get any easier.
Sources confirm to me that Lauren Stamile is most definitely a new love interest for Derek (Patrick Dempsey), and she'll be sticking around for a while. I'm told she's pretty much the anti-Meredith (all the way around â€" looks and personality) and will make Derek somewhat conflicted... at least in the short run.
What do you think? Are you losing faith in Mer and Der? Or is this just what the doctor ordered to help them get their respective acts together?
Steve Marsi is the Managing Editor of TV Fanatic. Follow him on Google+ or email him here.


text:
Ciggie Run
Theatre Royal, Saint Helens
February 3 – February 13
Author: John Evans
The Theatre Royal is an exciting place to be at the moment and, following recent hits The Salon and Four Girls & A Caravan, John Evans' The Ciggie Run looks set to provide Merseyside theatre with another fun night out.
The credit crunch is biting deep into Chrissie's struggling Liverpool Bar and, with Fitzy and Satan demanding more money with menaces than he can possibly afford, he and his mates Lash and Franna have decided pillaging Europe of it tobacco is as sensible a way to get some easy money as any.
Established TV and theatre actors Louis Emerick and Ozzie Yue gives a solid performances as Chrissie and Lasha respectively, aided comfortably by Liverpool DJ Kev Seed as Franna. Veteran stand up Micky Finn is also great value as Shakes, a washed up old drunk who only lives for his next beer in order to "forget".
But this show – and this theatre – is all about the up-and-coming talent that Merseyside is renowned for producing. Not least of which is Jodie Nesbitt who takes her chance to shine before a near sell out audience, playing Chanel, Chrissie's love struck barmaid and soon-to-be air hostess, with great timing, style and poise. Also impressive are Steven Williamson as naive hijacker Fernando, who somehow manages to keep it together brilliantly when things briefly flirt with collapse, Charlie Griffiths who's dual roles as of tarty, bondage loving Vera and stuck up Grace are quite memorable if a too short, and Stephen Hill as Hilary which is a moniker that's clearly short for hilarious.
Yes there are faults and some tightening up of the script is necessary – particularly the reveal as to what it is that Shakes is trying to "forget" –but nevertheless The Ciggie Run is still a whole lot of fun.
you would like to add your comments to this review of 'The Ciggie Run'?
If so - please feel free to leave your FEEDBACK
Writing gets me away for a while' from this world and into one where I, alone, can make or
break the rules as I see fit. - Chris High 2003.
Site designed and maintained by Steve Bennett 2011 all rights reserved


text:
Free e-Newsletter
|How to help your child make friends at school
|Wednesday, 25 January 2017 00:00
My child has no friends at school.
To support the development of friendships in your child's life, try some of these techniques:
• Offer a variety of opportunities for play and socialising. Host friends over for play dates or lunch. See if you can participate in a carpool and sign-up your child for group activities such as art, drama or dance. Exposing him to different areas of play will help him learn to socialise. "Giving children lots of unstructured time to play is important because they learn the social skills they need so they can keep playing and have fun," says Salin. Additionally, you can include your child when talking to people out of his normal range of peers. Take him to visit a neighbour, or bring him along to the dry cleaner. The more he is exposed to interacting with all kinds of people, the more he will learn to do the same.
• Provide support to your child. This may seem easy, but how often do you really listen to your child? Pick up on her social cues by listening to what she says happened on the playground. Support your child's choice of friends and welcome them to your home. Try getting to know her friends and their parents.
According to Boys Town Pediatrics, there are several ways you can accomplish this at home:
Article by parents.com


text:
Always On
Episode 41: Swimming with iPhones in HawaiiIt's the ultimate summer vacation, where we test out top products in the sand and water, including rugged digital cameras, iPhone underwater cases, and the Kindle Paperwhite.
-I think it needs to cook a little longer. We should get a shave ice. This week on Always On-- -Oh, my gosh! These are spectacular. -No way! -Oh. -Oh. -Three. -Oh. A rock almost hit me in the eye. Welcome to Always On. I'm Molly Wood. -And I'm Jeff Cannata. -And this is the show where we take a look at the tech that's part of your life. -And your future. -This week, we're coming to you from the youngest and largest island in the Hawaii chain. We're here in Kona. -Beautiful Kona. A place known for its snorkeling and other water sports and the perfect spot for us to test some gadgets in the heat and sand and water. -So, let's get right to it because a lot of you have asked us to try out underwater cases for the iPhone. -We have three of them for you ranging in price, durability, and size. -Let's see how they stack up. All right. Like we said, we're gonna road test these iPhone underwater cases. We're gonna start with the BeachBuoy which is-- -20 bucks. -Right, 20 bucks. This is a $20 case. We have the iPhone 5 that we've already tortured in here. -Yes. -Then, we have this kind of voodoo daddy from Hitcase. This is $90 and that's why my iPhone 5 is in here. -Yes. -We're basically just gonna swim out. We're gonna start with this-- this, though, the third one that we'll try is the iGills. How much does-- -$330. Yeah. -330. But this is for serious business. It goes down pretty deep. -And then the one downside to this is only available for iPhone 4, 4S, 3G. So, we're gonna try that out in a minute, but first-- -We got our gear. We got our snorkel gear. -Hey, this is my phone, so you could go. -I get the [unk]. -Okay. Here's the deal with the Hitcase. Everything seemed fine under there and I can definitely operate the buttons up here. -Yeah. -Okay, watch, right. Like I go like this, I'm like, that's the camera thing. And then, I put it on camera. No biggie. And then I take a picture of you. That all works fine. I can do any of that under the water. What I had to do was basically come up to the surface, put it on video mode, and then just take a bunch of video underwater. So, for 80 bucks, I wanna be able to press the button underwater and take a picture, that seems reasonable if that's what it's for. -I gotta say a little sick-- a little sick. I'm fully functional. I could do everything I needed to do. It's superconvenient. It's just hanging out. -I know, that's really nice. -I think it's dry. There's plenty to see out there. It's beautiful. -It's beautiful and the fish-- -They were amazing. -It's time for round two. We have the iGills case which is that $330 case. This one is much more than just a waterproof case. It's all about really professional diving. -It interests me. Yeah. I mean, the fact that it has a whole dive meter thing means that it's built for much more than we're gonna use it for today 'cause we're just gonna kind of go snorkeling. The good news is I feel like there's zero chance that thing's ever gonna get wet. And then, while you're going for the Cadillac of cases there,-- -Yes. -I was so impressed with the little Honda Civic, the BeachBuoy. -The BeachBuoy. -I'm gonna take this out because the Hitcase wouldn't let me take any photos. I-- -You put your own real phone in the BeachBuoy. -I put my own real phone in the BeachBuoy. -I like their hits [unk]. -Okay. All right. Round two. -All right, here we go. -Serious business. -The big bad expensive case, we dropped it. I took lots of pictures with it. -That seems like the best thing. We need to get out there and see if there's any-- -We should take it out. -moisture inside 'cause if there is-- -Yeah. Scary. -Oh, it looks pretty dry. -[unk] sure. -It looks pretty dry. Oh, my gosh. These are spectacular. -No way. He goes right into the-- -[unk] of me. -It takes really good [unk] -It really does. -We went on back to the dive van and looked at our pictures and video. -I like to call it base camp. -I mean, I think we had a pretty good idea on the beach, certainly, in terms of underwater performance. -It's the most expensive, but you get what you pay for. -Beautiful. -But this is really designed for divers and I feel like if you're a diver, the device is [unk]. I don't know why you wanna bring your iPhone and turn your iPhone into a diving device. -Well, I will say that, even in the BeachBuoy, I got a text while I was underwater. That was kind of awesome. -But you couldn't respond to it. -I know, that's true. Because I couldn't make any buttons work. So, the biggest bummer for me about both the BeachBuoy and the Hitcase, maybe, it's the saltwater, the conduction of the touch interface 'cause it worked fine above, but it didn't work underwater. That was just kind of a letdown overall. -Yeah. I think the BeachBuoy is great if you're just looking for something to protect your phone and keeps you accidentally dropping it in the water if you're on a boat somewhere, whatever. But as far as like taking pictures underwater-- -Yeah. -it's not gonna do the job. -Hitcase video quality since that's all I could take was really good and the Hitcase has something going for which is that is an all-around tough case. -Yeah. -So, if you wanna use it for any adventure, it's got a cool wide-angle lens on the back and you can take it underwater. So, there's a lot to recommend this at 90 bucks. -If I really had to choose between one of these three-- -Uh-huh. -and the one I think you're most likely to buy, BeachBuoy. -Yes. -I think for most people who are just gonna use it once and really wanna take that thing in the water, spend your 20 bucks wisely. -But if price is no object-- -Nice pictures -Nice pictures. -I have to say each one of those cases has something to recommend it depending on what you wanna use it for. I just don't think you're wrong with the $20 bag. -That's right. A $20 bag is a great way to put it. I'm just still gonna look out for that perfect underwater iPhone case that lets me take great pictures and is in that sweet spot of price. -Me too. I think we're just gonna have to come back next year and-- -Twist my arm. -keep trying. -Twist my arm. -Keep trying. All right. We're gonna take a quick break. When we come back, we will chill out on the beach while we heat up the Kindle Paperwhite. -And then later, we have two very rugged cameras that we're going to road test with some underwater wildlife. -Some friends. Welcome back everyone. Now, when I look around a beach or a pool lately, all I see is Kindle's no more trashy novel romance covers. -Well, I'm one of those guys that has a Kindle Paperwhite and I love it. I love bringing it to the beach, but I'm always worried about dropping it into the sand or in the water. -Everyone is and that's why we're gonna torture test one, but not his. -Thank you. -Time for our beach side torture test of the Kindle Paperwhite. -Yeah, it's going in the sand, it's going in the sun, and it's going in the water. -All those things. Let's get it going and let-- You know what, I think I could easily imagine just leaving it on the towel in the hot sun while we frolic in the cool, cool water. Shall we? -Let's put it there. Let's frolic. -Hey, I bet that thing seems pretty hot. -Yeah, we should probably check it out. -Yeah. All right. 132. I think it needs to cook a little longer. We should get a shave ice. -Okay. -Care for a shave ice? -Cheers. -Cheers. -Oh, poor Kindle. -Poor Kindle? -Look at that thing. -Been hanging out in the sun. It's a beautiful day. -It's got a nice tan, I bet. -That's-- I hope so. -Let's find out. We flipped it over because it just wasn't heating up enough when it was faced up. 140. You know, I'm saying this thing has been out here about two hours. -Yeah. -I feel like that's about as hot as it's gonna get. -I agree. I mean, that's a real world situation. -Yeah. -Out in the sun, two hours. It's a-- -Oh, oh. Oh, here, why don't you take that? -Yeah, that's really hot. -That's hot. -Very hot. All right. I'm gonna turn it on. -Swipe to unlock. -Swiping to unlock. -Still perfectly responsive. -No problem. -Wow! -It's still Paperwhitey. Look at that. -Not so bad. -I mean, we were having a hard time sitting in the sun. -I know. The Kindle was like-- -But Kindle could handle it, no problem. -Okay, Kindle. All right. What do you say if we drop our Kindle on the beach here? -It's time for the Kindle to get it from here to eternity moment. -That's right. -Ready? -Yup. Oh. -Oh, no. -Oh, Kindle. Oh, no. It's so-- That's some dirty water. Hey, let's do that thing we're not supposed to do. -Turn it right on. -Turn it right on. Oh, no, Kindle. Oh, no. Oh, don't go. Oh, no, Kindle is-- Oh, oh, mayday. No. How are we doin' here? Yup. -So what's happening? -The touchscreen is freakin out a little bit, but I wouldn't say it's terrible. -Yeah. It's still working. -It's working. Upon further reflection-- -It won't come back to life. -It won't come back to life. I think we may have actually killed it when we did that thing you're not supposed to do, turn it back on. -Yeah. It was working fine, but then when we tried to turn it off and turn it back on, didn't-- it didn't survive. -Not so good. So, we'll dry it out on the sun for a little while. We're still gonna drop it, but hopefully, it will recover later. -Yeah. -Yeah. We'll see. So, we're on a very windy beach off the Kona Highway. -It's kind of post-apocalyptic. -It's pretty crazy. One of the locals told me that he calls this Turtle Beach, like I don't see any turtles, but I do see a lot of dangerous-looking lava rocks. -Yes. -It would be a shame if the Kindle fell on one of those, don't you think? -I do think. -Three, two, one-- -Oh! -Oh, I miss the rocks completely. How about you have a jolt like that? -You missed the-- You missed the jagged rocks. -Oh. I can't watch. I can watch, though. I can watch. -And one, two, three. -Oh. All right. We have some scratching. -The screen held up though. -With a moisture screen, it's okay. Oh, but it's sharp to the touch. -Sharp to the touch. -What do you think? One more? -Okay, go for it. Maybe, a little height this time. -Three, two, one. -Oh. -Oh. A rock almost hit me in the eye. -[unk] -It's beat up plenty, but the screen is okay. -I mean, that's what you get with that plastic backing. It really can handle it. -Yeah. I would say, as far as the drop goes, it's pretty tough. We can't really see it, but it'll come on, though, 'cause of the saltwater. Sorry to see you go, Paperwhite. At least, it wasn't yours. -Yes. Thank you for not using mine. It looks like I could finish my books. But we have lots more to see on the island including some places to take some excellent photos. -Oh, yes! We have two rugged cameras and we're going to pit them against each other in our first-ever Always On underwater road test. Welcome to the funniest road test that I think we've done yet. -Yeah. -Maybe, even better than the skydiving. -Yeah. We're on a boat with a whole pod of dolphins surrounding us and taking pictures with our new action cam. -I know. We're so old school. We're actually using cameras instead of phones. So, I am gonna try out the hopefully waterproof and otherwise rugged Fujifilm FinePix XP200 and you have the Olympus Tough TG-2. -Indeed. -Now, both of these are supposed to be good underwater, up to about 50 feet. -Uh-huh. -We're gonna test it with just snorkeling in the water and then we're gonna hand them off to some divers to try to take them just a tiny bit deeper. -Yeah. -Tiny bit deeper. Oh, my God. Look at this, Jeff. Like there was something right there. -It's so cool. -Wow. -Look at that shot. -Dude. -Pretty good, huh? -Yeah. That's outstanding. All right, I have to say, so far, our cameras are holding up pretty well. -Yeah. -It's gonna come down to image quality. Okay, so, we have the two Tims here. -Yeah, we wanted to make it fair. So, we got two Tims. We don't wanna have-- -Because that makes them more awesome. -Exactly. -And the Tims are divers. We are not. Neither Jeff nor I are dive certified. So, we're gonna go ahead and give each of you a camera. -Tims, are you ready? -Ready to rock. -All right. -Let's do this. -Good luck. -Nice. -Tims down. -Two Tims in the water. -Two Tims in the water [unk] in the water. -I think one thing we can guarantee is that Tim will-- Hey. -Hey. Welcome back. -The Olympus might be done. -Oh, no. -The Olympus might be done. -It was on all the way to 130 feet and lost focus around 80. -Okay. -And then, just when we're sort of coming up, she shut off. -Really? She has the vents. We need to get one of those chambers. -So, we went to 100, it was fine. -Yeah. -And far and far, still taking pictures with [unk] at 130. -Wow. -Wow. -Very sweet. It's got me much more [unk]. -Oh. We've got problems. -Only the-- -Yeah. -So, I'm assuming there may be some water in here. So I've dried mine off and opened the battery compartment, but-- -Yeah. Unlocking it and opening the battery compartment-- -Yeah. -and there's definitely moisture in there. -Oh, no. Oh, yeah, I can see a little water in there. Oh. -Yeah. I can see droplets. Yeah. -So that might be what happened to it. -Okay. Just because my camera doesn't work anymore and every glass surface has a moisture under it,-- -Oh. -it doesn't mean, the pictures might not be amazing. So, let's check them out. -Okay. Oh, nice shot, though. -Thanks. Wow. Wow. Oh, wow. -I know. -Isn't it awesome? -That was great. Wow. -That was the best moment ever. -That's a great photo. -That's-- You gotta print that. -Yeah. -You're gonna put that on the wall. I have to say, though, I'm thinking the image quality is on the straw at this point. -I agree. -Unfortunately, for your camera, that does not appear to be the deciding factor. -It was fine down to 50 feet, but below that, it's not so much. I think that both of these cameras did a great job with pictures and video both. -Absolutely. I would feel perfectly comfortable taking any of these on a snorkeling trip. I just think if you're gonna mess up, maybe go a little more rugged-- -Yeah. -then ultimately, the Fujifilm stayed strongest. It's a little unfair. It says right on the front, 50 feet. So, we did exceed that, but if you're gonna award a winner, the guy that can go beyond and still hold up is gotta be the winner. -Yeah. I mean, I think it's clear that even in nonoptimal circumstances, the Fujifilm FinePix XP200 is the ruggedest. So, that was kind of like a tough 10 day in life. -Yeah. Being that close to that many dolphins, it is really quite an amazing experience. Exactly the kind of thing that you wanna be able to record forever with a camera. -Seriously. Oh, my God. -Yeah. -That was incredible. Okay, but it is time to move on now and read some of your mail. -We got a great torture test idea from Tyler who writes, "You should do a torture test where a dog chews the phone. My phone has many holes in the screen protector from my dog chewing it." -That's hilarious. Maybe, you should take your dog in a training school. -Or maybe, you should buy a less delicious phone. -Oh, I think that's the key. You know, we've had-- someone suggests that we do like hook up with SPCA and do kind of a puppy bomb, wrap a phone in bacon. -I like it. -We just need to make sure that it's safe for the doggies. -I think this is what happens when Android makes operating systems like Jelly Bean and-- -It's true. -sweets. You know, dogs love them all. -They're irresistible to the doggies. Oh, I am so grateful for this e-mail because we have been having this conversation on the show for ages now. "You are driving me and every other electrical tech crazy-- -Oh, oh. -when you say milliamps per hour. The correct term is milliamp hours. It is similar to man hours. Since batteries can and do supply power at varying rates, the capacity waiting takes time into account. The 2200 milliamp-hour battery can supply 2200 milliamps for an hour or 1100 milliamps for two hours and so on. This efficiency does decrease as the battery wears with age and can vary with temperature charge-discharge cycle and discharge rates. Always On is our favorite tech show in our house. Keep up the great work." That one comes from Nathan who sent us three references. -I love that. That's actually very helpful. I got a personal e-mail from somebody else that said the same thing. -I know. -I was clueless about it. I'm glad to know. -I mean, I know I couldn't have been bothered to look it up, but I have wondered about it and I'm glad that, Nathan, you were there. -This is why we have awesome fans. -That's right. And awesome fans like you should keep e-mailing us, firstname.lastname@example.com. You can also reach us on Twitter, Facebook, and Google+. -Aloha. -Aloha. Thank you. -Thank you. Well, sadly, that's it from Hawaii for this week. I know. But next week on Always On, the fun continues. We are headed to Vail, Colorado to get dirty with the Fitbit Flex. -And to torture test the Samsung Galaxy S4 in some extreme sports competitions. -Oh, yeah. Until then, thank you for watching Always On everyone. -Aloha. -Aloha. -Yeah. It's-- -Totally dry. -totally dry. -Safe and [unk] -So, I'm not worried. -Yeah. -[unk] -[unk] -[unk] -Thank you. -[unk]


text:
Air Force Major Charged in Vaccine Refusal
CreatorUnknown creator
Bibliographic Citation
Washington Post 2000 January 15; p. A10
Permanent LinkFind in a Library
MetadataShow full item record
Related items
Showing items related by title, author, creator and subject.
Vaccine Refusal and the Risks of Vaccine-Preventable Diseases Gill, Denis G.; Leask, Julie; McIntyre, Peter B.; Omer, Saad B.; Sanders, Daniel A. (2009-08-13)
Vaccine Refusal, Mandatory Immunization, and the Risks of Vaccine-Preventable Diseases Omer, Saad B.; Salmon, Daniel A.; Orenstein, Walter A.; deHart, M. Patricia; Halsey, Neal (2009-05-07)Vaccines are among the most effective prevention tools available to clinicians. However, the success of an immunization program depends on high rates of acceptance and coverage. There is evidence of an increase in vaccine ...


text:
Funeral services for the five family members found slain Monday in the tiny central Illinois community of Beason will be held Monday.
Raymond "Rick" Gee, 46, Ruth Gee, 39, Justina Constant, 16, Dillen Constant, 14, and Austin Gee, 11, died of blunt-force injuries, officials said. No charges have been filed in their killings.
Visitation will be from 10 a.m. to 2 p.m. at the Family Life Center in Mount Pulaski, with services afterwards, said Nathan Fricke, a funeral director at the Fricke-Calvert-Schrader Funeral Homes.


text:
About Us
What is Hospice Care?
Hospice care affirms the belief that is important to make every moment of life as
meaningful as possible, from the first days of a life-limiting illness to the last…to validate
the quality rather than quantity of life…and to provide care to the patient and family reflecting
a living expression of love, warmth, and compassion. Comfort Plus Hospice provides services to
relieve symptoms, manage pain, and give emotional and spiritual support.
Where is Hospice Care Provided?
Comfort Plus Hospice provides services wherever our patients call home:
- House or apartment
- A friend or relative's home
- Assisted living facility
- Nursing home
General Guidelines
Hospice-appropriate individuals may exhibit some or all of the following:
- Frequent hospitlizations
- Progressive weight loss
- Deteriorating mental abilities
- Recurrent infections
- Specific decline in condition


text:
Contracting Vehicles
The Mitchell Group offers a variety of different contracting vehicles that provide government agencies the flexibility to respond to broad agency requirements through a streamlined procurement process. TMG has a consistent record of successfully performing all the different types of individual contracts of all durations to best meet the needs of each individual client. Under our existing Indefinite Quantity Contracts (IQCs) , we can easily meet needs identified by USAID in specific sectors.
Under GSA Schedules (including Management, Organizational, and Business Improvement Services--MOBIS and Schedule 70), we offer targeted services to the U.S. government at prices published by the U.S. General Services Administration.
What Is A Federal Supply or Multiple Award Schedule?
A Multiple Award Schedule covers contracts that the GSA Federal Supply Service has negotiated with qualified companies for a group of related products or services to be delivered directly to the customer. The terms Federal Supply Schedule and Multiple Award Schedule are often interchangeable.
Schedule contracts are awarded to companies supplying the same types of items - in this case, consulting, facilitation, survey services, privatization support services and documentation, and program integration and project management services - at varying prices. All you have to do is review the features and prices of the service you need, determine the best value for your agency, and place your order.


text:
When it comes to success in any industry, commitment is very important. In my cases, I have a lot of talent and creativity. I can do almost anything when I put my mind to it. However, success or failure depends on my ability and willingness to commit to what I am doing. However, it has taken a long time to succeed because I have given up easily on some projects. This is one thing that could cause people to fail. When they give up on something, they often give up right when they are about to succeed. This is especially true of people that are in poverty.
Malini Saba herself was in poverty. However, she has found something that she was truly interested in and has committed to it. She learned everything she can about the industry of her interest. This is why she has managed to build a couple of successful businesses with one of them being a nonprofit company called Stree. The first step that Malini has taken was learning about the financial industry. Then the next step was applying what she has learned so that she could form a successful company. The third and final step was her expanding her company.
Malini has shown how important it is to commit. When one puts the pedal to the metal, she will earn a lot more than if she just dips her toes into the industry. For one thing, making money is always going to be hard work. This is why it is important for one to be willing to do the work that she is very interested in. If one tries to settle for work that she is not interested in doing for any reason, then it is going to be real hard and discouraging when it comes to earning the money needed.
In my case, I had to commit before I could earn a full time income with what I am doing. As a matter of fact, I had to make sure that I am disciplined in the work I am doing so that I can actually bring in a significant amount of money.


text:
There's a new website on the block…and it's gonna help you spend less at the grocery store!
SavingStar is a website that allows you to download electronic "e-coupons" to your store loyalty card. It works with over 100 different grocery stores and is the most comprehensive electronic coupon source yet!
You can load the following coupons and more…
- $.50/1 Dannon Greek Yogurt, 5.3 oz.
- $1/2 Juicy Juice
- $1/1 Fisher's Baking Nuts, 4 oz or larger
- $.55/1 Gum Kids Crayola Toothbrush
These all expire on 7/31…and more will be available in August!
If this is your first time using SavingStar, then sign up for a totally free account. Enter your store loyalty card number (found on the back of the little tag on your key ring.) and start saving the coupons to your card. The savings are added to your SavingStar account within 7-30 days depending on the store you shop. Once you accumulate $5 in savings, you can pick your payout from a deposit to your bank account or PayPal account, an Amazon gift card, or a donation to charity.
Learn more about SavingStar and see the complete list of over 100 stores that accept their e-coupons!


text:
Selecting a Registrar
- Quote Basics
- Registrar Basics
- When to select a Registrar
- Registration Costs
- Choosing a Registrar
- Recommended Registrars
- Complete List of Registrars
We provide you with a quick and simple way of receiving multiple quotations from up to three different registrars at one time. Where ever your company is in its certification process, we are here to simplify.
- Select Your Country
- Choose Your Standard
- Select Three Accredited Registrars to Receive Quotes From
- Complete Form
- Submit!
Quote Basics
The certification form is automatically sent to the ISO registrars you chose. You will receive a copy of your submittal, and we retain one for our records. You receive a quotation within 72 hours so you may select the registrar that will best fit your unique requirements.
Looking for the right registrar to audit your company can be confusing. That is why The9000store.com has partnered with many different registrars around the world and has made them easy for you to find, choose, and hire to complete your company's needs. (Or, to complete your registration audit.)
We strive to find you the best registrar for your unique company and needs while saving you time and money. Our process is proven to decrease the time needed to find the proper registrar and complete required audits for ISO certification.
Registrar Basics
Generally, when you sign a contract with a Registrar, it will include the Registration Audit and Surveillance Audits. The Registration Audit is the initial audit that will be done to see if you will achieve registration. Once you are approved, your certificate will be valid for three years.
After you have your registration, the Registrar will come back every 6 months or year for a Surveillance Audit to see if you are maintaining your system and continuing to meet the requirements of the standard. ISO Registrars vary in their approach, so you will want to find out details from each Registrar you are interested in.
Your certificate will be valid for 3 years. After that period your registrar will be required to do another Registration Audit to renew your certification.
The contract you set up with your Registrar (or Certifying Body or CB) will be for the three year period. You would renew your contract after three years to start the cycle again. Since you are starting a relationship that will last at least 3 years or longer, you will want to choose carefully.
When to Select a Registrar
Organizations often wait until they feel their QMS is running smoothly before they select a registrar. However, we recommend choosing them earlier in the process – like when they are creating their documentation. Why?
- This assures that you can find one who is able to meet your timeframe.
- The advantage of interviewing them early is that they will ultimately be the ones who will evaluate your QMS. A registrar CANNOT consult for a company who they audit, but they can explain (based on their experience) how they intend to audit your organization. So if you choose them earlier in the process you can ask them questions along the way. It's like asking the teacher what you're going to be tested on. This can be important because much is up to the individual's discretion (like a referee in a sporting event) and you'd be wise to consider it.
The costs for the audits and registration will be dependent on the size of your company, the number of locations, the accreditations that you need, and the distance between you and your Registrar.
The costs are typically dependent on the number of audit days required for the registration audit and the surveillance audits, the travel costs for the auditors, and the administration fees and accreditation fees for the registration.
- A good estimate is $1400/day + expenses, but contact a registrar for a quotation.
- The number of days is based upon the size and complexity of your operation
- Expenses include travel expenses for the auditor to your facility.
- Number of auditing days a CB can assess is regulated by ISO 17021
Choosing a Registrar
When choosing a certification body for any ISO certification, these are the aspects the organization needs to take into account.
- An independent QMS audit to confirm certification is a business decision:
- Does a customer or agency require it?
- Does it help with risk mitigation?
- Would it improve public relations?
- Cost is not the only consideration. Criteria to consider include:
- Evaluate several certification bodies using our Registrar Checklist
- Has the certification body has been accredited? Accreditation, in simple terms, means that a certification body has been officially approved to certify organizations.
- Is there accreditation Internationally recognized/accepted? there are some organizations who are not internationally recognized.
- Does the Certification Body follow ISO/IEC 17021:2006? ISO 17021 – Conformity assessment – Requirements for bodies providing audit and certification of management systems. Read who is accredited.
- Do the auditors have experience in your industry?
- Is the CB approved for certifications you may consider in the future?
The most important factor in choosing a Registrar is how well they can work with you. This includes how well they know your industry, how much experience they have with similar companies, and how well they communicate with you and your employees. There are many rules that a registrar must follow, issued by organizations like the ANAB. See ANAB Rules…
Interview 3 or more Registrars to get a good idea of the options available and differences between Registrars. Look locally if you have good choices, it will save on costs, but if you do not find a good fit look farther. The benefits of your relationship with your Registrar will pay off. Remember that these are experienced professionals that spend day after day evaluating how companies do business. The feedback you get from them is one of the best ISO certification benchmarking tools available.
View Questionnaire to help you select a registrar.
Recommended Registrars
Registrars should be accredited by an IAF approved body! Read more…
is the leading registrar and training organization offering services to the following standards: ISO 9001:2015, AS9100, ISO 14001, OHSAS 18001 and TS 16949:2002.
Complete list of Registrars
Here is a complete list of ISO Registrars for all of the major ISO standards:
- ISO 9001 Registrars
- ISO 14001 Registrars
- ISO 13485 registrars
- TS 16949 Registrars
- OHSAS 18001 Registrars
- AS9100 Registrars
- And more


text:
The addition of stringent industry guidelines for web application security is long overdue. With the escalating threat of web attacks, organizations must remain vigilant. Web applications are a special breed of living code -- always online, always accessible, always being modified, and always subject to attack. Diligent web application security demands frequent assessment/attack research and findings targeting specific web applications are posted daily.
Requirement 6.6 is currently the subject of debate due to confusing terminology and the objective has been veiled by clever vendor marketing campaigns promoting specific solutions.
What does PCI Requirement 6.6 really say?
Requirement 6 is about "developing and maintaining secure applications and systems." Requirement 6.1 requires that vendor-supplied security patches be applied within one month of release. Securing and fixing custom application code is not quite as easy as downloading a patch from your favorite software vendor. web application vulnerabilities must be identified, fixes developed, tested, and deployed. In short, you're on your own for the entire process.
Specifically, PCI Requirement 6.6 mandates the following:
PCI DSS version 1.1 Requirement 6.6: Ensure that web-facing applications are protected against known attacks by applying either of the following methods:
- Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security.
- Installing an application layer firewall in front of web facing applications.
- Verify that custom application code is periodically reviewed by an organization that specializes in application security; that all coding vulnerabilities were corrected; and that the application was re-evaluated after the corrections.
- Verify that an application-layer firewall is in place in front of web-facing applications to detect and prevent web-based attacks.
- Requirement 6.6 is not just for "level ones."
- It does not specify service providers or merchants.
- It does not specify either source code reviews or web-application firewalls.
What does PCI 6.6 really want?
The spirit of 6.6 can be met objectively and systematically. The ultimate goal is to ensure secure web applications. For applications developed or customized in-house, the following process must be continually performed: Identify vulnerabilities (find), correct them (fix), and test to confirm that the correction is effective (prove). Find, fix, prove, find, fix, prove.
Some security vendors have marketed that PCI Requirement 6.6 may be met through either installing a web Application Firewall or outsourcing expensive source code reviews. This marketing distracts from what the PCI Council is seeking in Requirement 6.6.
The intended outcome of Requirement 6.6 is the establishment of a web application vulnerability lifecycle – leading to the effective elimination of risk. Vulnerabilities must be detected, communicated, and corrected.
This can be done through various measures such as:
- Black box testing (run-time assessment)
- White box testing (source code review)
- Binary analysis
- Static analysis
- Remediation by developers
Web application firewalls
Requirement 6.6 also requires separation between the developers and the security testing team. Clarification released by the PCI Security Standards Council states the testing must be objective.
Application security testing is complex, and resource intensive. The tools and expertise required to perform safe and accurate testing can be costly. Keep in mind both hard and soft costs associated with finding vulnerabilities -- hard costs for tools, training, consulting, employees, etc.; soft costs such as resource outages, development meetings, production outages, resources required to work outside hours, manual validation and elimination of false findings, among others.
How to comply with Requirement 6.6
Requirement 6.6 is about protecting web applications, plain and simple. Given our modern threat landscape, it is no wonder that PCI Requirement 11.3.2 dictates "application penetration tests" be performed after every "significant change." Meaningful web application security management requires frequent assessments as code and threats evolve continually. Requirement 6.6 is about developing a repeatable methodology that connects the "Find" (the vulnerability detection) process to the "Fix" process for the systematic, efficient elimination of vulnerabilities from web applications.
1) Find vulnerabilities in web-facing applications
Regardless of your classification as a Merchant or Service Provider, if you have a web-facing application, it must be assessed. This will be far more exhaustive than a network vulnerability scan, and will require authentication to access the majority of application functionality. This testing requires human expertise to exercise the application, validate findings, and test for logical vulnerabilities and other threats a testing tool cannot identify.
The PCI Council has not asserted itself as an authority on application security; it leaves the verification of compliance to approved auditors. What the PCI Auditors seek is evidence of due care.
Demonstration of due care in testing requires:
- Thorough coverage. Automated tools alone only cover roughly half of the web Application Security Consortium's Threat Classifications. If an application is worth protecting, test it thoroughly with both automated and human means.
- Frequency of coverage. Web applications are continually changing, as is the threat landscape. Test the application, in production, as frequently as is meaningful, for example, with each code change.
- Efficient communication. Vulnerabilities identified become a known liability and must be managed. Vulnerabilities must be communicated clearly and effectively to groups tasked with remediation.
- Precision in testing. Testing custom application code must be done methodically, and retesting must follow the same processes where possible. Patch development, validation of remediation, and corrections will be simplified if you follow a consistent methodology.
Runtime assessments (referred to as "black box" testing), Source Code Reviews ("white box" testing), binary and static analysis, etc., are all effective methods to find vulnerabilities in web applications. There is a misconception that the detection techniques all try to achieve the same end goal and compete for the same budgetary dollars. The fact of the matter is that each testing ideology brings different benefits to the table at different price points, almost all of which are complementary and help paint a complete picture of application weaknesses.
2) Fix vulnerabilities
PCI Requirements 11.3.2 and 6.6 require this. For context, reread PCI requirement 6.1. Proving you have installed a patch to commercial applications and operating systems is easy. Proving you have corrected a weakness in custom application code is a little more complicated. This is where having a consistent testing and reporting methodology will come in handy. There are two approaches to code fixes:
- If you own the web application code -- fix it.
- If you do not own the code, or have valid business case or cost restrictions that are impediments to fixing the raw code, correct the vulnerability through other methods (e.g., a web application firewall).
3) Prove it
After significant investment in managing the web application vulnerability lifecycle, an auditor (SOX, PCI, or any other auditor) needs documentation to prove the fix worked. Ensure the mitigation applied does in fact correct the vulnerability in practice and in writing.
The PCI 6.6 compliance process of "Find, Fix, Prove" can be simplified further. If the "Find" process is done with sufficient precision and creates proper documentation, the "Find" process can be done in a continual or ongoing manner -- and will in turn document proof of the "Fix" actions as they occur. Auditors like to see trends, especially when they involve continual detection and removal of vulnerabilities -- this makes proving due care very easy.
Find, fix, prove(n)
With a clear understanding of PCI Requirement 6.6, compliance is not only achievable, but can provide great value to web application owners and users. This requirement creates a need for visibility into the lifecycle for vulnerability detection and correction, and will serve to mature web application security. Applying metrics to the efficiency of detection, the cost of producing vulnerable code, and the associated costs of correction will only serve to advance the goal of total web application security.
Trey Ford serves as director of solutions architecture at WhiteHat Security, a leading provider of website security services. Questions can be directed to firstname.lastname@example.com