text:
|History of the Office
Lancaster County was organized in the Nebraska Territory in 1855. The
first move for the organization of Lancaster County was in the fall of 1859. In
1861, Louis J. Loder was appointed the first sheriff and county clerk of the county.
The first elected sheriff of the county was William Pemberton in 1863. By the 1870s,
Lancaster County was growing rapidly. Since the establishment of the Office of the Sheriff
in Lancaster County, thirty-two sheriffs have held the office. In the early years, a number of prominent businessmen held the Office of the Sheriff. Two of those were Samuel McClay and Granville Ensign, both Civil War veterans and prominent Republicans.
Two former Lancaster County Sheriffs and one deputy sheriff have been honored by being inducted into the Nebraska Law Enforcement Hall of Fame. While the long history of the Lancaster County Sheriff's Office is punctuated by many incidents of great drama and import, there can be little doubt that the three most significant incidents in the history of the office have revolved around these three men: Sheriff Samuel M. Melick, Sheriff Merle C. Karnopp, and Deputy Craig D. Dodge. Those three memorable incidents are the lynching of Luciano Padillo, the murder spree of Charles Starkweather and Caril Ann Fugate, and the murder of Deputy Sheriff Craig D. Dodge.
Samuel M. Melick served as Lancaster County Sheriff from 1883 to 1891. On August 23, 1884, Melick was transporting a rape suspect, Luciano Padillo, from the jail to a homestead in the southwest part of the county. The purpose of the trip was to obtain an eyewitness identification from the victim, who was bedridden and not expected to live. Melick had set out by train but disembarked at Denton and proceeded on horseback in order to avoid a potential mob at the Burke Train Depot near the victim's home. The plan failed, however, when word of the strategy apparently leaked, and the sheriff was confronted by a mob of some fifty masked riders bent on a lynching. After a lengthy horseback pursuit and a considerable period of attempted persuasion, the sheriff was downed by the mob and Padillo lynched in the timber along Cheese Creek.
After serving four terms as sheriff, Sam Melick was twice appointed Lincoln Police Chief under two different mayoral administrations. He also served as the postmaster of Lincoln, as a detective for the Nebraska Banking Association, and as a Deputy United States Marshal. In 1912, a riot at the State Penitentiary resulted in the death of the warden, two deputy wardens, and a prison usher. The National Guard was called in to restore order, and Governor Chester Aldrich appointed Sam Melick to serve as the interim warden. Educated at Marshall College in Iowa, Melick completed an unprecedented law enforcement career before returning to private life and becoming a successful real estate developer.
Merle C. Karnopp, also a member of the Nebraska Law Enforcement Hall of Fame, held the office of Lancaster County Sheriff for 28 years, from 1951 to 1979. He was a Lancaster County Deputy Sheriff for eight years prior to his first election. Karnopp was prominent in a number of civic and professional organizations. In 1978, he was named president of the 50,000-member National Sheriffs' Association, the only Nebraska sheriff to hold that honor.
The Lancaster County Sheriff's Posse was formed under Sheriff Karnopp in October of 1955, with twenty original members. Each man owned his own horse and equipment, consisting of uniform, gun and the necessary riding paraphernalia, at an approximate cost of $1,000. All members were sworn in as special deputies and were subject to call to assist the sheriff whenever necessary. Posse members were assigned to work with regular deputies, and their training consisted of traffic control, firearms, protection of crime scenes, and riot control.
Although his seven terms saw many accomplishments, the most enduring public memory of Merle Karnopp's career as Lancaster County Sheriff was the mass murder spree of Charles Starkweather and Caril Ann Fugate in 1957-58. For a few days in January, 1958, Lincoln and Lancaster County residents were terrorized by the repeated discovery of Starkweather and Fugate's eleven victims. Four of the eleven murders occurred in rural Lancaster County and were investigated by Sheriff Karnopp and his deputies. Governor Victor Anderson had called out a National Guard unit to assist in the search for the killers; however, before they were fully mobilized, the Sheriff learned that Starkweather and Fugate had been arrested near Douglas, Wyoming, following the roadside murder of a traveling shoe salesman and a harrowing high-speed chase. After Starkweather's capture, Karnopp and his wife Gertrude made the arduous 900-mile round trip to Wyoming to bring Starkweather and Fugate back to Lincoln to stand trial. Charles Starkweather died in the Nebraska electric chair on June 25, 1959. Caril Ann Fugate was sentenced to life imprisonment and paroled in 1976 after serving 18 years of her sentence.
The third member of the Lancaster County Sheriff's Office to be inducted into the Nebraska Law Enforcement Hall of Fame was Deputy Craig Douglas Dodge. Deputy Dodge had served as a United States Marine, a Lincoln Police Officer, and a Reserve Deputy Sheriff for both Lancaster and Adams Counties prior to becoming a Lancaster County Deputy Sheriff in 1985. He was also a co-founder of Eastern Ambulance Company in Lincoln.
At 5:21 a.m., on March 14, 1987, Deputy Dodge was dispatched to a report of a domestic assault at an apartment building in Hickman, Nebraska. Deputy Dodge arrived within minutes and heard the victim pleading with her husband. Knowing that backup was many minutes away, Deputy Dodge made contact at the door to the apartment and was trying to stabilize the situation until assistance arrived when the suspect suddenly shot and killed Deputy Dodge with a .38-caliber revolver, then stole Deputy Dodge's revolver, and ran from the scene.
The killer, Terry Reynolds, was apprehended a short time later by a nearby creek bed. Deputy Dodge's weapon was recovered from the water where Reynolds had thrown it. Terry Reynolds was subsequently convicted of first-degree murder and is currently serving a life sentence.
Deputy Dodge's funeral was attended by Governor Kay Orr, U.S. Senator Robert Kerrey and many other dignitaries. His widow, Barbara Dodge, later became a prominent national advocate for survivors of law enforcement line-of-duty deaths. She was elected president of the national organization "Concerns of Police Survivors" and spoke at the 1991 dedication of the National Law Enforcement Officers' Memorial in Washington, D.C., sharing the dais with President George Bush. Craig Dodge's memory still burns brightly in the hearts of his co-workers, family and friends. The example of his life and sacrifice will continue to inspire generations of Nebraska law enforcement officers.
Although he was not inducted into the Nebraska Law Enforcement Hall of Fame, the death of Sgt. Franklin Furrer on November 16, 1973, is still commemorated by his coworkers. Sgt. Furrer was involved in a narcotics raid at a residence near the town of Walton when he was stricken with a heart attack. Twenty days after suffering the heart attack, Sgt. Furrer died. In 1995, Sgt. Furrer's death was determined to be a line-of-duty death, and his name was added to the National Law Enforcement Memorial in Washington, D.C.
The last few decades have witnessed the evolution of an office stretching to meet the public
expectations of training and professionalism, service and response to the rural community,
and burgeoning responsibilities to the Courts and public safety. In less than the time line
set out below, the Sheriff's Office has moved from posses to radios, from index cards to
national data bases, from carbon paper to computers to GPS. Every sheriff in the last 5 decades put something in motion to better position his office for what was waiting ahead.
A traumatic period for the Sheriff's Office began January 11, 1994, when Sheriff Thomas K. Casady resigned to become Lincoln's Chief of Police. This left a void to be filled, as Sheriff Casady's term did not expire until January 1, 1995. The County Board, given the arduous task of replacing Sheriff Casady during an election year, advertised for applicants, and several applications were received. Following a diligent search, including interviews and background checks, the Board appointed John Packett, the Chief of Police from LaVista, Nebraska, to fill the remainder of Sheriff Casady's term and then run for sheriff. Sheriff Packett was sworn in on February 1, 1994, introductions were made and tours given. In an unusual and controversial move, the next morning Sheriff Packett called Chief Deputy William E. Jarrett and announced that he was resigning. Sheriff Packett has since become known as "Sheriff For A Day."
Following Sheriff Packett's resignation, the County Board decided it would be in the best interest of the Sheriff's Office to appoint retired District Court Judge Samuel Van Pelt to fill the remaining 11 months of the term. Sheriff Van Pelt took office March 18, 1994, but declared that he had no intention of running for the office of sheriff in the November election. Therefore, it was agreed that Van Pelt would resign in mid-November, obviating the need to attend law enforcement certification training. The County Board agreed to appoint whoever was elected by the voters on November 8, 1994, to take office immediately rather than waiting until January 1, 1995, to do so. LSO Sgt. Terry T. Wagner was elected sheriff and was sworn in November 22, 1994, to fill the unexpired term of Samuel Van Pelt, effective November 24, 1994, thus ending an unsettled time for the Sheriff's Office.
Over the decades, the Lancaster County Sheriff's Office has had several homes. In 1873-74, a substantial masonry jail was built at 9th and K Streets in Lincoln. The sheriff's quarters and administrative offices in the jail were supplemented by office space in the Lancaster County Courthouse, constructed in 1887. In 1967-68, construction was completed on a County-City Building to replace the Courthouse and jail, and the Lancaster County Sheriff's Office relocated to space on the lower level of the new building. Since the late 1970s, the Board of Commissioners, sitting as the Board of Corrections, has administered the jail through an appointed director.
In 1997, a massive renovation of the County-City Building into a new Justice and Law Enforcement Center was begun. The Sheriff's Office moved to the first floor of Gold's Galleria located at 11th and N Streets, with a satellite office in the Old Federal Building. The satellite office was established to house the Special Services Division in charge of movement of prisoners and providing security for the County and District Courts, which had also been moved into that building. Headquarters for the Sheriff's Office in the Gold's building consisted of the Administrative Support, Criminal Investigations and Civil Divisions, along with the main reception and records areas, while the Patrol Division remained at 1000 Oak Street.
November 15, 1999, the Lancaster County Sheriff's Office returned to the newly-renovated Justice & Law Enforcement Center, occupying the southwest corners of the first-floor and ground levels. Finally, the entire Sheriff's Office was under one roof back on the two blocks occupied by the first jail and courthouse. The Justice & Law Enforcement Center, along with a newly constructed adjacent County-City Building, was dedicated in a Grand Opening and Ribbon-Cutting Ceremony on May 5, 2000, with many local dignitaries in attendance.
In recent years, the Lancaster County Sheriff's Office has continued its tradition of emphasizing the importance of training and education. The office has successfully sought and recruited college graduates as the primary applicant pool and conducts an extensive program of in-service training for deputies. The office developed a Statement of Mission, Values and Goals and an excellent Standard Operating Procedures manual. The Sheriff's Office has excelled, in particular, in policy and practice pertaining to the investigation of child sexual assault and domestic violence cases. Service and enforcement of Protection Orders and investigation of child abuse and neglect are paramount in our service to the community.
The Lancaster County Sheriff's Office prides itself on supplying state-of-the-art equipment for its deputies, from mobile data computers in cruisers to computer mapping for crime analysis. The Sheriff's Office has a state-wide reputation for excellence and has provided technical assistance and instructional materials on various topics to sheriffs throughout the State of Nebraska.
The Office of Sheriff of Lancaster County has been held by a number of exemplary citizens of the community since 1861, but its accomplishments have been made possible only through the dedication and hard work of the deputy sheriffs and civilian employees who have served the Sheriff's Office with honor. These men and women have committed themselves to public service, sometimes at considerable peril, and have distinguished themselves by innumerable acts of courage, integrity, intelligence, and determination. Their contribution to the quality of life enjoyed by the citizens of Lancaster County cannot be overstated.
Currently, the Lancaster County Sheriff's Office is comprised of five divisions; Administrative Support, Criminal Investigations, Patrol, Special Services and Civil. The office has 76 commissioned law enforcement personnel, including the sheriff and chief deputy, along with 7 certified Building Security Officers and 18 civilian employees.
The Office of the Sheriff is held by Terry T. Wagner. Sheriff Wagner was first elected sheriff in November, 1994, and was re-elected in 1998, 2002, 2006, 2010 and 2014. The Lancaster County Sheriff's Office is the sixth largest law enforcement agency in Nebraska, with an operating budget of approximately eleven million dollars.

subset: commoncrawl


text:
Thanks to everyone's favorite recession, movie studios don't do it up the way they used to. The days of over-the-top theme screenings, filled with goody bags and stars, are as dead as disco. But Wednesday night, Overture pulled out all the stops to debut "The Crazies" with one of the best events in recent memory.
Arriving in the light mist of a chilly (by L.A. standards) February night, we were greeted by flashlights shining in our faces, while machine gun-toting soldiers in fatigues and gas masks barked orders.
Ushered onto a school bus with blacked out windows, we were taken on a wild goose chase of a ride, only to be dumped out and forced to walk a gauntlet of bloodied patients, twitching dead bodies and more screaming soldiers.
Imagine a ride at Disneyland, but with spittle-spewing drill sergeants and the threat of death around every corner. It was awesome.
Once inside the theater, an announcement promised us we were all "safe—afe—afe—afe." On the heels of the echoes, commandos burst in shouting "Security breach!," grabbed one "infected" audience member from his seat, his girlfriend shrieking in panic, as they were both dragged off, legs flailing. The entire theater burst into applause. But the fun was just getting started.


text:
Louisville Bridges and Traffic Reports
Bridge Construction Updates, Traffic and Highway News Courtesy BridgeLouisville.com
Monday, April 23, 2018
Louisville Weather Forecast; April 23, 2018 at 05:00AM
Morning Weather Forecast: Rain with a temp of 58F.
Todays forecast calls for 60F and a low of 54F.
UV Index: 0
Humdity: 53
Pollen Count: 2
img src="https://ift.tt/2DqXVK0
No comments:
Email This
Share to Twitter
Share to Facebook
Share to Pinterest
Newer Posts
Older Posts
Subscribe to:
Posts (Atom)


text:
Follow RFF News on your cell phone. Text follow rff to 40404 you will receive txt messages with RFF News
0 Members and 1 Guest are viewing this topic.
There's no other quotes that beat these two.My Ox is BrokenWe have a BADDDDDDDDDDDDD Elephant.
Great quotes, AmazingRace! Almost everything Charla & Mirna ever said was memorable!
It's pretty much anonymous - Brent
"That's why I hate China, it sucks!" - Jaime <333333
"Baby there's NO MORE MIIIILK!" Lorena"I may be the brawn of the team, but she's definitely the brains... and boobs" Tiffany"I need to go to the doctoro" Charla
"You're gonna have two redheads coming through, they're gonna look pretty good in this outfit dont worry!" - Mallory after the Frog of Luck detour in Japan
Mirna: donde es el discotechCharla: no cono?Mirna: nvm she's a prostitueCharla: but a prosititue would kno were the disco tech is wuldnt she
" If we don't know anybody's name on the race...We know Brian's, coz we heard lot of BRIAANN!! BRIAANN!! " - Flight Time a little later...Brian : "hey, the clue is right here, come on.."Erika : " BRIANN!! "
Page created in 0.111 seconds with 32 queries.


text:
Jonathan Fineberg
Art History
Art Criticism
Child Art
Creative Practice
The Phillips Collection
The University of the Arts
Media Scrapbook
CAA interview on the new Ph.D. in Creativity
Guest Editor, Critic's Page,
The Brooklyn Rail
, March 2018
2017 interview with Joseph Nechvatal about
Art at the Border of Mind and Brain
Fineberg named Distinguished Visiting Professor
at University of California – Irvine,
beginning January 2015
Modern Art at the Border of Mind and Brain
(University of Nebraska Press, 2015)
Zhang Xiaogang: Disquieting Memories
(Phaidon Press, 2015)
Robert Rauschenberg: Anagrams, Arcadian Retreats and Anagrams (A Pun)
(New York: Pace Gallery, 2015)
Picasso & Jacqueline: The Evolution of Style
(N.Y.: Pace Gallery, 2014)
Wins 2013 AICA-USA (International Association of Art Critics) 2013 "Award for Excellence" for Alice Aycock Drawings: Some Stories are Worth Repeating, Grey Art Gallery, NYU and Parrish Art Museum
(Yale University Press)
A Troublesome Subject: The Art of Robert Arneson
University of California Press, March 2013
listed by
The Brooklyn Rail
as one of the 10 best art books of 2013
Curriculum Vita
A Personal Account
of My Career
One of my early mentors, the painter Robert Motherwell, once said that the task of modern art "was to find a language that would be closer to the structure of the human mind...to reflect the nature of our understanding of how things really are." The particular art theory that has been evolving in the corpus of my writing over some forty years is a social history of art grounded in psychoanalysis as a means of understanding the dynamics of creativity and how societies use and interact with works of art. This inquiry drew me to the study of child art, where I could see the mechanisms of visual thinking and its uses in a simpler form. My limited foray into computer science helped me think about the languages of systems and how they structure what we see and think. Neuroscience, which I have only begun to investigate, has helped me begin to understand the physiological mechanisms of vision, memory, and cognition. Meanwhile, I have always maintained a personal creative practice first in sculpture, then in film and writing, and continue to undertake creative projects like the PBS film
Imagining America
and the Center for the Study of Modern Art at The Phillips Collection.
All images and text herein © 2013 Jonathan Fineberg, All Rights Reserved Worldwide
design and maintenance by
Huang Li
Lisa Ma


text:
Pulsedrive will be a single-player experience of high speed.You will be able to choose between three different ships, which are accelerated by the pulse of music. Because the music becomes faster and faster it will be more and more difficult to steer your ship through the courses. The longer you are able to control your ship without crashing into the wall the higher will be your score. Your ship is limited in stability. Passing gates activate a multiplicator for points, which is increased when you pass gates one after the other.
Only registered members can share their thoughts. So come on! Join the community today (totally free - or sign in with your social account on the right) and join in the conversation.
Current timeline of development. For more information visit www.wtechportal.com


text:
Product Positioning
Incident Response
Triage: Initial Analysis and Response
Worm Mitigation Reaction Methodology
Tools and Techniques
Arbor Networks Peakflow
Routing Techniques
Networkwide ACL and VACL Propagation (Rapid Deployment)
Private VLANs
Applying the Tools to an Enterprise Environment
Detection Phase
Containment and Isolation
External Attacks
IP Telephony: Cisco CallManager
Appendix A - Aggregated Bogon List
Appendix B - Freeware Tools
SNMP: net-snmp Toolset
SNMP: Multirouter Traffic Grapher
SNMP: Round Robin Database Tool
OSU Flow-Tools
NetFlow Visualization: FlowScan
Internet worms have had a severe impact on many enterprise customers. Recently developed tools and architectural techniques can be employed to assist with the mitigation of worm activity in an enterprise environment.
This paper provides:
- A conceptual overview of worm mitigation techniques
- Details for deployment of these techniques into an overall solution for enterprise customers
This document has been written from a solution standpoint. It is primarily designed to provide a tool kit for dealing with the issue of Internet worms within an enterprise environment. Although this is the primary motivation of this document, the overall solution has application well beyond this primary purpose and additionally provides capability for detecting and responding to other security incidents.
Product Positioning
Cisco Security Agent - Cisco Security Agent provides significant protection from many worms at a workstation or server level. Cisco Security Agent requires a controlled deployment and a degree of tuning for any uniqueness in a specific customer environment, both of which take time. Therefore, Cisco Security Agent should be seen as strategic solution and not as a tactical solution when preparing for malicious activity.
Network Admission Control - Network Admission Control (NAC) is similar to Cisco Security Agent. At the time of first writing (August 2004) NAC was in its first stage of release. A more comprehensive solution will be provided in subsequent stages. For these reasons, NAC should also be seen as a strategic solution and not as a tactical solution.
The techniques described in this document can be deployed today.
The techniques described in this document were originally developed for large Internet service providers (ISPs) and have been adapted for use in enterprise environments. They are well-understood and mature technologies, now applied in a new way to solve a new problem.
Cisco uses the techniques in this paper on its own network to defend against a range of malicious activity, including worms and other security incidents. Many customers have asked for information on how Cisco deals with these typical day-to-day threats, which has been part of the motivation for this solution.
Incident Response
An organization's internal operational processes are a critical aspect of dealing with any security incident. Although sophisticated software can isolate possible security incidents, there is still a significant degree of human intervention required, making the establishment of reliable incident response procedures vital.
This document has a technical focus and is not intended to provide a detailed overview of incident response procedures. However, because these concepts are an integral part of the overall solution, a high-level overview of incident response is presented. Figure 1 illustrates the overall framework and process.
Figure 1: General Incident Response Guidelines
The overall goal of an incident response process is to maintain business operations.
Although preparation is not part of the formal incident response process, this document presents techniques that must be in place prior to the occurrence of a security incident. Having response procedures in place facilitates efficient response during an actual incident.
The Cisco Network Consulting Engineers suggest the following preparatory steps:
- Develop a clear understanding of the organization's primary business and IT resources.
- Arrange for 24x7 access to someone who can authorize business decisions during a security incident.
- Establish open lines of communication. Operations groups need to know the key contacts within the organization.
- Collect links to Internet sites that provide up-to-date and reliable details of security threats and Internet worm activity, such as www.dshield.org, www.securityfocus.com, and bugtraq.
- Maintain updated contact details for your ISP or ISPs.
Triage: Initial Analysis and Response
The first phase of incident response is to verify that the event is an actual security incident, such as an attack or worm event. In some cases, an incident could be the result of scheduled maintenance activities.
After the event is confirmed, take quick action to limit the damage. Doing so might entail steps such as turning off a device or removing a device from the network. However, any actions taken need to be in line with maintaining business continuity.
During the process, communicate with other relevant parties within the organization. For example, stay in touch with relevant management and legal contacts.
The second phase is the analysis phase. A key part of this process is incident classification, which involves understanding the type of attack and the damage it is causing. It is important to perform the analysis with as little impact as possible on business functions.
Next, determine the scope of the incident-the number of devices, data, and other resources affected. It is important to look beyond the initially identified target, because the event might be more widespread than initially thought.
In some cases, it might be necessary to perform a traceback to the origin of the attack; this activity might involve working through your ISP. In other cases, restoration of business operations might require priority over any traceback activities.
Measure the impact-what are the resulting effects of the incident on the organization? Has the event caused a minor problem or has it caused a major impact to the business?
The results of this analysis will help determine the most appropriate reaction techniques for the specific incident.
The reaction phase involves some action to counter the attack. Each situation will dictate the action to be taken, such as widely deploying access control lists (ACLs) in a worm event; restoring a device to normal operation by reloading the OS from the original media and restoring data from backups in a server compromise; or changing any static passwords because they might have been compromised-and an entirely reasonable response in some situations might be to do nothing.
Generally, the highest priority is to regain full business operations. In many cases it is often less important to spend time finding the perpetrator of the attack.
A post-mortem involves a full, in-depth analysis of the event and the response to the event. The goal is to determine what can be done to build resistance and prevent this type of attack from happening again-essentially, learning from the experience. As a simple example, if a network penetration occurred, it would be prudent to identify what vulnerability was used to obtain access, and then fix all occurrences of that vulnerability. Additionally, it should be determined if the incident was detected in an acceptable time; if not, measures should be deployed to speed detection in the event of further incidents.
The post-mortem is a step that is often ignored. It is critical that it is not forgotten.
Worm Mitigation Reaction Methodology
The procedure outlined in this section should be followed when responding to a worm incident.
The first stage of the reaction process is to contain the spread of the worm inside the network. Compartmentalization, a core principle of the SAFE Blueprint from Cisco, is key because it allows isolation of parts of the network that are not yet infected. Figure 2 shows containment options.
The inoculation phase involves patching all systems. If the appropriate signature files or plug-ins are available for tools such as NESSUS, it is worthwhile to start scanning the network for vulnerable systems. This activity might allow operations staff to find vulnerable systems before they become infected.
During a worm crisis, there are three types of systems in your network:
- Patched systems
- Unpatched systems
- Infected systems
Figure 2: Containment Options
Inoculating uninfected systems is imperative and usually happens in parallel with the quarantine and treatment phases.
The quarantine phase involves finding each infected machine and disconnecting, removing, or blocking them from the network to prevent them from infecting other unpatched machines on the network. To achieve this goal, the infected systems need to be isolated and quarantined.
Later sections of this document will outline tools such as remote-triggered black hole routing. This technique allows the rapid isolation of infected machines, limiting their capability to spread the infection.
The treatment phase involves the cleaning and the patching of each infected system. Some worms might require complete reinstallations of the core system to ensure that the machine is clean.
All of this activity requires planning prior to a worm event. When these events occur, reaction time is critical, and these processes need to be in place. It is strongly recommended that every organization plan the reaction methodology ahead of the next crisis.
Tools and Techniques
It is important to view the following techniques as a tool kit. There is currently no simple guaranteed solution for dealing with these types of security incidents. As such, it is recommended that customers become familiar with the tools and techniques in this document.
The main tools discussed in this document include:
- ACLs
- NetFlow and NetFlow export
- Unicast Reverse Path Forwarding (uRPF)
- Routing protocols such as remote-triggered black hole filtering, also known as remote-triggered black hole routing
- Cisco routers and switches
- NetFlow collectors
- Arbor Networks Peakflow X and Peakflow DoS
There are many other products and features that can be used as security tools. This document focuses on a subset of these so that an effective solution can be deployed for worm mitigation.
ACLs as Security Tools
ACLs serve a dual purpose as security tools. They provide:
- A mechanism to permit or deny traffic
- A mechanism to detect certain traffic types
The use of ACLs to permit or deny traffic is a well-understood and well-documented security feature. In terms of worm mitigation, ACLs are likely to play a key role in preventing the spread of a worm by blocking its attack vector, usually a TCP or UDP port.
Using ACLs as a Detection Tool
The most common technique when using ACLs as a detection tool is to configure the router as a pseudo packet sniffer. To do so, use an ACL with a series of permit statements to provide a view of the traffic flow (Figure 3). The counters in the ACL entries can then be used to find which protocol types are potential culprits.
Figure 3: ACL Entries for Detection
Extended IP access list 169 permit icmp any any echo (21374 matches) permit icmp any any echo-reply (2 matches) permit udp any any eq echo permit udp any eq echo any permit tcp any any established (150 matches) permit tcp any any (15 matches) permit ip any any (45 matches)
VLAN ACLs
VLAN access control lists (VACLs) operate somewhat like router-based ACLs. They are a means to apply access control to packets bridged within a VLAN or routed between VLANs. In terms of worm mitigation, VACLs allow access control to be applied directly to the access port.
VACLs use the same Access Control Entry (ACE) format used by router-based ACLs. The permit and deny statements based on Layer 2-4 header information are used to determine what traffic to permit and to deny. VACLs have no sense of direction, unlike router-based ACLs, which are applied on either an inbound or outbound basis. VACLs apply to traffic at both ingress and egress.
The configuration of a VACL differs for switches running Cisco Catalyst OS and native Cisco IOS Software. Figure 4 and Figure 5 illustrate the difference.
Figure 4: VACLs in Cisco Catalyst OS
Console> (enable) set security acl ip filter_http permit ip any host 10.1.1.1 filter_http editbuffer modified. Use 'commit' command to apply changes. Console> (enable) commit security acl filter_http ACL commit in progress. ACL filter_http successfully committed. Console> (enable) commit security acl map filter_http 55 Mapping in progress. VLAN 55 successfully mapped to ACL filter_http.
Figure 5: VACLs in Native Cisco IOS Software
6500 (config#) vlan access-map filter_http 6500 (config#) access-list 101 permit tcp any host 10.1.1.1 eq 80 6500 (config#) vlan access-map filter_http 6500 (config-access-map#) match ip address 101 6500 (config#) vlan filter filter_http vlan 45
NetFlow Overview
NetFlow is used as the foundational technology for obtaining traffic flow information across a network. A flow is defined by seven unique keys: source IP address, destination IP address, source port, destination port, Layer 3 protocol type, ToS byte (Differentiated Services Code Point [DSCP]), and input logical interface (ifIndex). By observing traffic flows across the network, it is possible to see events that might be malicious. Some events might cause high traffic volumes, such as a denial of service (DoS) attack; others might be more subtle. In any case, observation of the flow information can detect these events. The NetFlow documentation is available at the following links:
NetFlow has the capability of performing a flow export function. In this case, all expired flow information is sent to a collector. Collectors could be a number of devices, including a Cisco NetFlow Collector, CFLOWD tools, OSU flow-tools (CFLOWD Successor), or the Arbor Networks collector, which is used as a key component of this solution. Export packets are approximately 1500 bytes and typically contain 20 to 50 flow records. Figure 6 illustrates this concept.
Figure 6: Collection of Flow Information
The current NetFlow information is also available via the command-line interface (CLI) of the router. The sample output in Figure 7 shows two clients infected with the Blaster worm that are scanning for other systems to infect. Note: 0x87 equals port 135 (illustrated in pink below).
Figure 7: NetFlow Output
Router>show ip cache flow | include 0087 SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Fa2/0 XX.XX.XX.242 Fa1/0 XX.XX.XX.119 06 0B88 0087 1 Fa2/0 XX.XX.XX.242 Fa1/0 XX.XX.XX.169 06 0BF8 0087 1 Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.63 06 0E80 0087 1 Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.111 06 0CB0 0087 1 Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.95 06 0CA0 0087 1 Fa2/0 XX.XX.XX.204 Fa1/0 XX.XX.XX.79 06 0C90 0087 1
NetFlow Deployment
NetFlow monitors an interface's ingress traffic only. Therefore, to obtain a full picture of bidirectional flow information, NetFlow must be deployed such that all ingress and egress flows are captured. Figure 8 illustrates a possible deployment scenario.
As part of the flow record, NetFlow exports the subinterface information.
Figure 8: NetFlow Deployment for Capturing Bidirectional Flow
Performance Impact
NetFlow will have some performance impact, particularly on software-based routers. NetFlow is not a switching path; it is a companion feature that works with both fast switching and Cisco Express Forwarding. In all cases, the use of NetFlow with Cisco Express Forwarding switching is recommended. The largest dependency from a performance perspective is the number of flows. A Cisco 7200 Series NPE-300 or NPE-400 router will have its maximum forwarding rate (that is, no-drop rate) fall from somewhere between 20 percent (at 4 flows) to 50 percent (with 256,000 flows). This performance impact needs to be assessed on a case-by-case basis. In worst-case scenarios, router upgrades might be required.
Collection Tools
There are many options for collecting exported NetFlow information. A commercial option is the Cisco CNS NetFlow Collection Engine. This can be deployed on a number of platforms, including Solaris, HP UX, and Linux.
The daily archival of flow data allows in-depth analysis of any security incidents. For example, if an infected machine is found to be participating in an outbound DoS attack, it is possible to analyze the NetFlow information for a command and control channel. If outbound DoS activity is detected, the information can be passed to the appropriate network operator.
Exporting and Analyzing Flow Information for Anomalies
Arbor Networks Peakflow provides further details of how the Arbor Peakflow products integrate into the overall solution. From a NetFlow perspective, the flow information needs to be exported to the Arbor collector as well as the NetFlow Collector. This is performed using either dual NetFlow export statements or a separate device to perform the export function for the Arbor collector and the flow archive collector.
Additional NetFlow Information
The NetFlow Services Solutions Guide is available at the following link:
Caveats at the Time of Writing
The Cisco Catalyst 6500 Series Supervisor Engine 2 and Supervisor Engine 720, prior to the PFC3BXL, do not export the ToS bits, and neither will export the TCP flags.
In many cases, these restrictions will not be an issue, particularly for the analysis of traffic on internal networks, and especially for internal anomaly detection purposes. In other circumstances, visibility of the TCP flags is important, particularly for the detection of certain external attacks such as SYN flood and RST attacks on external Internet interfaces (outside the firewalls). In these cases, NetFlow export from a dedicated Cisco router platform such as a 7500 Series or 12000 Series would be the preferred option. The above restrictions do not exist on these platforms.
Arbor Networks Peakflow
Peakflow Overview
The detection and recognition of an attack or a security event is a critical component of any security solution. To successfully mitigate an attack, it is essential that it is accurately detected and the appropriate alerts are quickly raised to security operations staff.
Although IDSs provide detection capability, at the time of writing they are also signature-based, and therefore of limited benefit in these situations. Cisco itself has used the Arbor Peakflow DoS anomaly detection system to successfully detect and mitigate several worms. As such, it is included as a key part of this worm mitigation solution.
IDSs do have a significant role in the detection of many attacks and, as such, are still strongly recommended to complement an anomaly-based system. However, in the case of a worm mitigation solution (and some other security events), the Arbor anomaly-based approach has proven to be more effective.
Arbor offers two solutions to this problem. From the outset, it must be noted that Arbor's capabilities go well beyond what is discussed in this document. Any organization deploying an Arbor solution will gain far more than just tools for worm mitigation.
Peakflow DoS
The primary application of Peakflow DoS is the detection of external threats and events, making this product widely deployed by ISPs. For enterprises, using Peakflow DoS to detect the presence of an external security event (an event outside the firewall) is key to being in a position to quickly secure the network "internally" from the threat.
In the context of this solution, Peakflow DoS would be used as a tool used to monitor traffic outside an organization's firewall.
Peakflow X
The primary application of Peakflow X is the detection of internal threats and events. Peakflow X provides an internal anomaly detection solution through relational modeling of the enterprise's internal network.
In the context of this solution, Peakflow X provides a detailed visualization of the application-level conversations inside an enterprise network.
Placement of the Arbor Collectors
Both Arbor Peakflow X and Peakflow DoS use a collector and controller architecture, illustrated in Figure 9. The Arbor collector receives the flow records exported from the routers. Multiple routers can export flow information to a single collector. A controller provides a Web interface, sits in the hierarchy above the collectors, and generally consolidates the information from the controllers.
Figure 9: NetFlow Deployment for Capturing Bidirectional Flow
Design Recommendations
NetFlow Data Export (NDE) needs to be reliable. It is UDP-based, so a fast, reliable path between the exporting routers and the collector is strongly recommended.
If NDE is being performed over a WAN link, it will produce approximately 1 to 1.5 percent of the saturated interface bandwidth in NDE traffic. Using a hub-and-spoke network as an example, it is best to collect the NetFlow information on the ingress interfaces of the central (hub) router as opposed to collecting it from the spoke routers, particularly if low-speed WAN links are involved. The consequence is the loss of visibility of any inter-interface traffic on the remote (spoke) routers, but the approach conserves expensive WAN bandwidth. This might or might not be an issue.
Traffic from the collectors can be "Td" to avoid the need for the routers to perform a dual export function. The Arbor collector is capable of passing the original NDE source address or rewriting it.
Routing the NDE traffic back through a monitored interface should be avoided.
Peakflow Design Parameters
The Arbor Peakflow DoS 2.3 software release supports:
- 14 collectors per controller
- Up to five (GSR 12000) size routers per collector
Smaller routers produce a smaller amount of export traffic; these design figures could be increased. However, at the time of writing, no other design recommendations were available from Arbor.
Introduction to Sinkholes
A sinkhole is a multifaceted security tool-essentially, a portion of the network that is designed to accept and analyze attack traffic. Sinkholes were originally used by ISPs to engulf attack traffic, in many cases drawing attacks away from a customer or other target. In more recent times, sinkholes have been used in enterprise environments to monitor attacks, detect scanning activity from infected machines, and generally monitor for other malicious activity.
This document illustrates how a sinkhole can be used in diverting attack traffic, monitoring for worm propagation, and monitoring other potentially malicious traffic.
Traditional Sinkhole - Diverting Attack Traffic
In the first sinkhole application, a publicly accessible Web server is the target of either a DoS or DDoS attack. Figure 10 illustrates how server WWW1 is unavailable due to the attack. Additionally, the extremely high traffic volume has saturated links and routers, making server WWW2 unavailable as well.
Figure 10: Traditional Sinkhole - The Attack
Figure 11 illustrates how a sinkhole can be used to pull attack traffic destined for WWW1 away from the target. Although this technique does not restore connectivity to WWW1 for legitimate users, it can be used to alleviate the collateral damage to other servers at the same site that might have been disabled due to link congestion caused by the attack, such as WWW2. This is a fairly drastic step. In an ISP/hosting environment, this would require customer consent.
Figure 11: Traditional Sinkhole - The Diversion
A sinkhole is also a useful tool for analyzing an attack. The sinkhole router can be used to forward the attack traffic to a back-end switch where a network analyzer, such as a sniffer or Ethereal, can be used to look at the details of the attack.
Sinkhole - Monitoring for Worm Propagation
Figure 12 illustrates how a sinkhole can be deployed to monitor for worm propagation internally within an enterprise. In this example, a host has become infected and is scanning for other hosts to infect. In this case, the sinkhole "sucks in" any internally originated traffic destined for both bogon[1] addresses and the dark IP address space[2]. As a result, a worm's scanning activity can be rapidly detected at the sinkhole.
In enterprise applications, it is particularly important to monitor the dark IP address space as opposed to only a block from the bogon address space. Future worms might be written to purposely ignore these address blocks to improve scanning and propagation efficiency.
Figure 12: Sinkhole - Monitoring for Worm Propagation
Sinkholes-Detecting Other Malicious Activity
Although this example specifically illustrates the application of a sinkhole for detecting worm propagation, monitoring the bogon and dark IP address space can also detect other usually malicious activity. Under normal operational conditions, there is little reason any user or host should be attempting to access these address ranges. For example, scanning activity on these address ranges might be an internally compromised host performing recognizance activity to look for other internal targets. As such, any activity seen on the sinkhole should be investigated.
Backscatter Traffic
Packets with unreachable destinations, including the router null0 interface, will have an Internet Control Message Protocol (ICMP) unreachable message sent back to the source address. This "unreachable noise" is known as backscatter (Figure 13). A sinkhole is likely to draw in a substantial amount of backscatter traffic. This is particularly true for Internet-based sinkholes.
Figure 13: Backscatter Traffic
Backscatter traffic on the Internet is often the result of large-scale DoS or DDoS attacks in which spoofed source addresses have been used. As a result, backscatter traffic is sprayed randomly over the Internet address space, possibly to both assigned and unassigned addresses. There might be a high increase in backscatter traffic seen on the Internet during a large-scale worm event. It is often this backscatter traffic that will give the first sign of a new worm's release.
Deployment of a Sinkhole
Figure 14 and Figure 15 present two possible sinkhole design options. A sinkhole does not need to be expensive, but it is recommended that it be connected with a high-speed interface into the core network. A sinkhole can be as simple as a Linux system running a routing daemon such as Zebra and a sniffer package such as Ethereal. However, a minimum recommendation is a dedicated router and an Ethernet switch to allow the attachment of various monitoring tools.
The first design option is illustrated in Figure 14. In this scenario, the target router on the right might be a low-cost device, possibly a Cisco 2600 or 3600 series router. Its primary purpose is to gather and export NetFlow information. Depending on the desired sophistication of the sinkhole, the NetFlow information might be exported to either a NetFlow Collector or an Arbor Peakflow collector.
Routing announcements for the bogon and dark IP address space can be made from either the target router or the sinkhole gateway. Announcing the address blocks from the sinkhole gateway, possibly via the redistribution of static routes, is preferred. It is also preferable to configure a static Address Resolution Protocol (ARP) entry for the target router. If these two items are configured, traffic will continue to flow onto the sinkhole network even if the target router becomes overwhelmed and fails to process the traffic load.
Figure 14: First Sinkhole Design Option
The second design option uses some form of dedicated high-speed router. This router should be of sufficient capacity to handle a high traffic load while performing NetFlow. Although it will normally be idle, it needs to be sized to accommodate an attack scenario. A second Ethernet interface should be available on this router for both NetFlow export and dedicated Simple Network Management Protocol (SNMP) polling. This approach keeps any malicious or attack traffic separated from the monitoring segment, making analysis of the attack traffic a far easier task.
Figure 15: Second Sinkhole Design Option
As in the first option, bogon and dark IP address space is announced from the sinkhole router, preferably via the redistribution of static routes. The static routes will use a bogus next hop and a static ARP entry to push traffic onto the switched network. Figure 16 illustrates the partial configuration example.
Figure 16: Sinkhole Static ARP Configuration
! ! Static route to 188.8.131.52 /3 network ip route 188.8.131.52 220.127.116.11 192.0.2.200 ! ... ! ip arp 192.0.2.200 00.00.0c.12.34.56 arpa !
Care must be taken from a routing protocol perspective to ensure that any address blocks announced from the sinkhole do not conflict with other production address ranges in the network.
Sinkholes and Packet Analyzers
The introduction to this section briefly mentions the use of a sniffer within a sinkhole. The ability to capture and analyze a new worm is a useful exercise. For example, SQL Slammer functioned on UDP port 1434 and used a 376-byte packet. This is valuable information that can be used, for example, to formulate ACLs, should that be the most appropriate action. Other information, such as the use of spoofed source addresses, IP options, a specific IP precedence, or specific DSCP is also valuable. The more the worm is understood, the more easily it can be mitigated.
Sniffers such the open-source tool Ethereal or a commercial version such as the Network General Sniffer would be excellent solutions.
Routing Techniques
Overview of Routing Techniques
Previously we have shown how a sinkhole can be used in an attack scenario to draw the attack traffic away from a target host. As explained previously, this does not help to restore service to customers wishing to access the host under attack, but it does alleviate the collateral damage, particularly if links or routers are congested as a result.
Again using an attack scenario as an example, there are many cases where it will not be desirable or feasible to shift the attack stream to a sinkhole. In these cases, it might be preferable to simply drop the stream as close to ingress as possible.
As such, a technique called remote-triggered black hole routing (also known as remote-triggered black hole filtering) can be used. Although the technique was originally developed for dealing with attacks in ISP environments, it can also be used effectively in an enterprise network for preventing worm spread. Additionally, this technique can be used for "black holing" any internal hosts participating in outbound DoS attacks, in the event that a host (such as a roaming laptop) has been compromised in this way.
This technique performs multiple functions:
- Black hole traffic at the line rate
- Provide remote trigger capability to multiple routers
- Process a large number of addresses if required
- Drop traffic based on both destination and source address, if required
To explain the technique, we will initially illustrate how it is used to mitigate an Internet-based DoS or DDoS attack. We will then explain how it can be adapted in an enterprise network.
Black Hole Routing
A black hole routing scheme is based on the concept of forwarding traffic to null0. The technique achieves a similar result to an ACL based on destination address. However, because the technique occurs directly in the forwarding (or Cisco Express Forwarding) path, it achieves a dropping function with no performance impact. Figure 17 illustrates the concept.
Figure 17: Black Hole Routing
Remote-Triggered Black Hole Routing
Although black hole routing is an effective technique for dropping traffic at line rates, we need to add remote trigger capability. This is achieved with two steps. The first step is to configure an unused route to null0. This needs to be configured on all routers that will act as remote-trigger black hole routers.
For example,
ip route 192.0.2.0 255.255.255.0 Null0
192.0.2.0 /24 is an unused address block called the Test-Net. As such, it is not publicly allocated and is often used for this application.
In the second step, Border Gateway Protocol (BGP) is used to propagate information about a prefix we want to black hole. BGP is the only routing protocol that is capable of propagating a nondirectly connected next hop. Because BGP cannot carry a next hop of null0, we must use an intermediate step. This is achieved by announcing the prefix we wish to black hole with a next hop of 192.0.2.1 (from Step 1). From here, any black hole routers know this as a route to null0 and will drop any traffic with this next-hop address.
This prefix is typically announced by a dedicated router, often known as the black hole announcement router or trigger router. The router does not need to be high-end; often, a Cisco 2600 Series device is adequate. The only requirement is that it has BGP connectivity into the provider's core and is capable of making announcements. Figure 18 illustrates the principle.
Figure 18: Remote-Triggered Black Hole Routing
After the trigger router is in place, a configuration like the one in Figure 19 is typically used to announce the prefixes that should be black holed.
Figure 19: Configuration for Announcing Prefixes to Send to Black Hole
router bgp 999 ... redistribute static route-map STATIC-TO-BGP ... ! route-map STATIC-TO-BGP permit 10 match tag 66 set ip next-hop 192.0.2.1 set local-preference 50 set community no-export 999:000 set origin igp ! Route-map STATIC-TO-BGP permit 20 ! ... ip route 171.xxx.xxx.1 255.255.255.255 Null0 Tag 66 !
Figure 20 and Figure 21 provide a more detailed diagrammatic explanation of the operation of the remote-triggered black hole process at the router level.
Figure 20: Mapping of a Prefix to Null0
Figure 21: Internal Routing Operation of Remote-Triggered Black Hole Routing (Filtering)
Dropping on Source Address
One of the criteria for remote-triggered black hole routing to be effective as a security tool is the ability to drop traffic based on both destination address and source addresses. For example, if a host is infected with a worm, it will be identified by its source address. To prevent the spread of the worm, it is necessary to have the capability to drop any traffic originating from that source address.
A second scenario requiring a mitigation technique is one in which spoofed source addresses are used. With recent worms, such as SQL Slammer and Blaster, the host's real IP address is used to propagate the worm. This is not to say that other worms might not use spoofed addresses. As such, the scenario needs to be accommodated. There is no reason that any host should ever send out a packet with an address other than what was assigned to it. Any packets being sent out with illegitimate source addresses should be dropped at the first router hop.
The feature that enables both of these requirements is Unicast Reverse Path Forwarding (Unicast RPF). Information about Unicast RPF is available at:
Figure 22 illustrates Unicast RPF in the traditional strict mode. If a packet is received on an interface, a route to that packet's source address must be available back through the same interface on which the packet was received. If this route does not exist, the packet fails the RPF check and is dropped. It is recommended that this technique be deployed on all user-facing interfaces. This technique is an effective way to drop any spoofed packets from hosts on the local network at the first router hop.
Figure 22: Unicast RPF in Strict Mode
Figure 23: Configuration of Unicast RPF in Strict Mode
! interface FastEthernet2/0 ip address 192.xxx.xxx.50 255.255.255.0 ip verify unicast reverse-path ... speed 100 full-duplex !
Figure 24 illustrates Unicast RPF in loose check mode, which is essentially a relaxation of the strict check mode. In the case of loose check, the only requirement is that the source address must appear in the router's Cisco Express Forwarding table. If the route does not exist or it has a destination of null0, the packet is dropped.
Unicast RPF with loose check is part of the mechanism that is used to perform remote-triggered black hole filtering based on source addresses. In the previous example, we saw how BGP (typically iBGP) can be used to distribute a prefix (or prefixes) to trigger the black holing of traffic for a destination address. The prefix of 192.0.2.1 was used as the next-hop address for this purpose. This, in turn, triggered the black hole operation at the network edge across a number of routers.
If Unicast RPF loose check is configured, any source addresses with a route to null0 will also be dropped. The same technique of distributing these prefixes with a next hop of 192.0.2.1, for example, is used. BGP as a protocol is capable of carrying hundreds of thousands of prefixes. This technique is scalable and can easily be used to black hole possibly thousands of individual (/32) source addresses of individually infected machines.
Figure 24: Unicast RPF in Loose Check Mode
Figure 25 illustrates the configuration of Unicast RPF in loose check mode.
Figure 25: Configuration of Unicast RPF in Loose Check Mode
! interface FastEthernet2/0 ip address 192.xxx.xxx.50 255.255.255.0 ip verify unicast source reachable-via any ... speed 100 full-duplex !
The previous sections on NetFlow and sinkholes provided a set of techniques for identifying infected machines and listed a variety of abnormal behaviors that might represent a security incident. When an infected machine or security event is identified, the operations staff has the option of black holing the device. For example, the configuration in Figure 26 would black hole the infected machines at xxx.xxx.xxx.242 and .204.
Figure 26: Configuration for Black Holing Addresses
! ip route xxx.xx.xxx.242 255.255.255.255 Null0 Tag 66 ip route xxx.xx.xxx.204 255.255.255.255 Null0 Tag 66 !
The result is illustrated in Figure 27. We now have the capability to use iBGP to selectively trigger the remote dropping of any traffic based on either source or destination address. Although this is a service provider example, it shows how attack traffic can be dropped effectively based on source addresses.
Figure 27: Selective Remote Traffic Dropping
Networkwide ACL and VACL Propagation (Rapid Deployment)
The ACLs as Security Tools section provided an overview of the use of ACLs as a blocking mechanism during worm events. Both router ACLs and VACLs have a place within a reaction methodology toolkit. Router ACLs can easily be deployed to prevent the spread of a worm from subnet to subnet. VACLs allow port-level filtering on a VLAN basis. This is a more effective technique for blocking the spread of a worm, because it can be applied directly on the switch port, allowing filtering on a per-host basis to prevent the possibility of intra-VLAN propagation.
Because reaction time is critical during a security event, a mechanism is required to apply ACLs on a widespread basis quickly. Each network is unique, so an ACL deployment scenario needs to be designed and tested as a part of a worm mitigation solution.
Option 1
Network management tools such as ACL Manager, which is an optional part of CiscoWorks Resource Manager Essentials (RME), are one type of mechanism that can be used for the widespread deployment of ACLs.
At the time of writing, ACL Manager had been extended to support VACLs and private VLANs. Information about ACL Manager 1.4 is available at:
Option 2
A second option for the widespread deployment of any configuration change is NetConfig, which is also part of CiscoWorks RME. Information is available at:
Although step-by-step details are not included in this document, some comments and suggestions for deployment are outlined here:
- Analyze the network topology and understand all VLANs, the devices that reside within them, and the traffic flows (if possible).
- Understand where the most critical resources reside. For example, on which VLANs do critical servers reside? Prioritize these resources so the most critical are the first to be protected in the event of a worm outbreak.
- Allocate a range of extended ACL numbers that can be dynamically used networkwide for responding to security events. For example, extended ACLs 180 to 189 might be a suitable range. Clearly document this range and possibly configure a dummy list on each device with a suitable comment so that all network operations staff will know that the range is reserved and will know its purpose. Dummy lists will also avoid any accidental conflict in ACL ranges when the extended ACLs are deployed during an incident.
- Create templates within NetConfig to assign one or more predetermined ACLs (for example, access list 180) to each VLAN on a networkwide basis. With these assignment templates in place, widespread deployment of configuration changes is accomplished by creating a suitable ACL (for example, access list 180), pushing it out to all devices, and performing a widescale assignment using the previously created scripts.
- Keep in mind that switches running Cisco Catalyst OS and native Cisco IOS Software have different configuration formats. Any strategy will need to incorporate router ACLs suitable for both routers and the multilayer switch feature cards (MSFCs). Likewise, templates will have to incorporate VACLs on both Cisco Catalyst OS and native Cisco IOS Software-based switches.
Private VLANs
Private VLANs are a technique for providing Layer 2 isolation of hosts within a VLAN. This technique can improve the security posture of a network by isolating servers that do not need to communicate with each other. From a security standpoint, if one server were to become infected with a worm, its inability to communicate with other servers would prevent the spread. In this case, each server would be attached to an isolated port.
Figure 28 illustrates the concept of private VLANs and the associated port types.
Figure 28: Private VLANs
From a general security perspective, private VLANs should be widely deployed, particularly for the attachment of servers. In many cases, servers within server clusters are only required to communicate with clients and not with each other. Using isolated ports within a private VLAN achieves Layer 2 separation.
Private VLANs do not provide perfect isolation. If a router is attached to a promiscuous port, it is possible to hop from one host or server device to another via the router, using the intended destination IP address with the router's MAC address. However, an ACL can be applied to the router port to prevent this behavior.
The use of private VLANs is explained extensively in the documentation for the SAFE Blueprint from Cisco. It is recommended that anyone deploying these techniques also be familiar with SAFE Blueprint best practices.
Applying the Tools to an Enterprise Environment
The previous sections have described the use of several security tools. In some cases, use was explained in the context of a traditional deployment in a service provider environment. This section discusses how these tools can be applied in an enterprise environment.
Although the primary aim of this solution is to mitigate a worm outbreak, the techniques have much wider application in responding to many other security incidents. The total solution provides response capability for the following situations:
- Mitigation of worm outbreaks
- Detection and mitigation of scanning activity from compromised hosts
- Detection and response to internally compromised machines participating in external DDoS or botnet attacks (zombies)
From a network design perspective, the integration of these techniques in specific customer environments will require a reasonable degree of independent judgment. Some networks are complex, with many interdependencies. Careful application of these techniques on a case-by-case basis is required.
The application and use of these techniques during a security incident will also require independent judgment. This section has been written based on experience. Although it is highly likely that the lessons learned can be reused with confidence, it is important to keep in mind that the security threat landscape continues to evolve.
Figure 29 illustrates a sample enterprise network, typical of many enterprises. The sample network and the examples are designed to illustrate the application of the various techniques. They are not intended to replace any of the architectural techniques recommended as part of the SAFE Blueprint architecture.
Figure 29: Sample Enterprise Network
Detection Phase
Three primary detection techniques (or tools) have been presented as part of this solution:
- (1) NetFlow, NetFlow export to a collection device
- (2a) Arbor Peakflow DoS and Peakflow X (using NetFlow export)
- (2b) Custom scripts, custom applications, manual analysis (cheaper alternatives)
- (3) Sinkholes
Remember that these are tools; it is their application that will determine the effectiveness of a solution. The tools should not be seen as mutually exclusive answers; each has a place in an overall solution, even if some overlap occurs across the various options.
Currently the most effective and readily automated solution of the three mentioned above is the Arbor Networks solution. When a new worm outbreak occurs, it is highly likely that its spread will be seen on the Internet side of firewalls first. For example, during the SQL Slammer outbreak a large amount of activity on UDP port 1434 was detected. Because this was anomalous, it was quickly detected and then determined to be malicious.
During the early stages of a new worm event, applicable IDS signatures are not normally available. This limits the usefulness of these devices in the initial stages of an outbreak. At such a time, anomaly detection is invaluable. On this basis, Arbor Peakflow (in conjunction with NetFlow export) is very suitable for use as the primary detection mechanism. Figure 30 shows how NetFlow information would be exported to an Arbor collector and analyzed for anomalies by the Arbor Peakflow system.
The Arbor solution is also extremely effective in the detection of a variety of other attacks against or within enterprise infrastructures. An example would be a DoS or DDoS attack against a large enterprise's Internet presence, whether it be a simple site providing a business overview or a large-scale e-commerce site. After the Arbor solution quickly and accurately detects the attack, the appropriate response can be applied.
Figure 30: Using Arbor Peakflow to Collect and Analyze NetFlow Information
There is a cost associated with the purchase of the Arbor product, which might not be acceptable to all clients. Although Arbor has been included as an integral component of this solution, it is certainly possible to build a solution without it. Alternative detection techniques (using NetFlow as the foundation) are possible; these include internally created scripts and other custom applications, or even manual analysis. If the cost of the Arbor solution is an issue, alternatives can be investigated.
Information on third-party or freeware tools is included in Appendix B.
Application of Sinkholes
A sinkhole is a valuable and complementary tool. At a minimum, a basic sinkhole should be deployed to monitor the client's dark IP address space. Any network activity in this space usually indicates some sort of security issue or misconfiguration. A more aggressive approach for a sinkhole is to announce a default route. This will engulf any traffic without an explicit route to the destination. This technique is more advanced and must be carefully planned in conjunction with the overall routing architecture.
Figure 31 and Figure 32 illustrate worm-infected laptops scanning for further targets. In the case of Figure 31, the infected laptop is within workgroup 1.
Figure 31: Worm-Infected Laptop Scanning for Targets (Internal Laptop)
Figure 32: Worm-Infected Laptop Scanning for Targets (Remote-Access Laptop)
The greatest danger has typically been the introduction of a worm through back doors, such as externally infected laptops. This scenario is illustrated in Figure 32. These machines are often connected to the Internet via a home or hotel connection, where it is easy to become infected. Subsequently, the machines connect to the internal network either when the employee returns to the office or when connecting through a remote-access solution such as an IPSec VPN. In any case, we must stress that this has been the typical experience; we cannot guarantee that future scenarios will occur in the same manner.
As previously explained, a sinkhole is one technique that can be deployed to detect infected machines. After a sinkhole is deployed, monitoring the traffic through it becomes the main issue. There are a number of approaches, but the desired outcome is to detect any rapid increase in traffic to the sinkhole.
The Arbor solution has the capability of monitoring traffic in the enterprise's dark IP address space. Using a sinkhole in conjunction with Arbor Peakflow is a complementary match.
Alternative Techniques for Monitoring the Sinkhole
The following list provides alternative techniques for sinkhole monitoring:
- SNMP polling of sinkhole egress interface, CiscoWorks for Switched Internetworks Device Fault Manager (monitor for sudden increase)
- SNMP polling of sinkhole egress interface, monitor with MRTG or Cricket
- Router-based Remote Monitoring (RMON) traps, monitor egress interface traffic
- NetFlow deployed on sinkhole ingress, monitor for changes
- ACLs with the log keyword
- Packet analysis
- Commercial tools such as Network General Sniffer
- Public domain tools, especially Ethereal
Containment and Isolation
When a worm outbreak is detected, it is necessary to move quickly to contain its spread. Under normal conditions, corporate firewalls should prevent worms from entering the internal network. However, every network is unique and different networks might have unique security holes where a worm (or other attack) might enter.
During the containment phase, keep in mind that the mitigation strategy might have a business impact. It is important to have access to someone who can quickly make a business decision if required.
Using ACLs
In the case of SQL Slammer, malicious traffic was detected on UDP port 1434. This port would normally be blocked by a properly configured firewall. However, because most infections enter by way of back doors, it would be necessary to block this port throughout the internal network to properly prevent the spread of this worm. In this case, the application of port-level ACLs was the containment mechanism. Figure 33 illustrates this concept.
Figure 33: Using Port-Level ACLs to Prevent Spread of SQL Slammer Worm
ACLs can be deployed as router ACLs or VACLs. Router ACLs are the simplest (or MSFC-based ACLs in the case of a Cisco Catalyst® 6500 Series system). VACLs are more complex to deploy, but are more effective because they can block any traffic entering the VLAN at port (host) level. VACLs are more effective at preventing intra-VLAN infection.
Figure 34 illustrates the difference in operation between a router ACL and a VACL in the prevention of worm propagation.
Figure 34: Using Router ACL vs. VLAN ACL for Worm Containment
In some cases, the port on which the worm is spreading might be critical to business operation. For example, when SQL Slammer was propagating, some organizations could not block UDP port 1434 because it was required for access to the SQL server for legitimate business transactions. In this case, some alternatives would need to be considered.
If the network devices using the service on the affected port are known, permitting selective access might be an option. For example, if only a small number of clients were using SQL server, an option might have been to open UDP port 1434 to critical devices. Selective access is not guaranteed to solve the problem, but it will certainly lower the probability of infection.
Using Arbor's Peakflow X provides useful baseline information about normal application-level conversations within the network. Having this baseline information available during a security incident aids in decision making and helps avoid the risk of inadvertently shutting down critical services.
Using Remote-Triggered Black Hole Filtering
A further and alternative containment technique (or tool) is remote-triggered black hole filtering. As explained previously, any traffic from an infected node can be dropped, based on its source address, on any appropriately configured router (or Cisco Catalyst 6500/4500 switch). The main advantage of this technique is the speed at which it can be activated. Because BGP routing is used to activate the drop, it can be activated on thousands of points across large networks in typically less than one second. This is a fast and effective technique for preventing the spread of the worm from an infected machine beyond its directly attached VLAN. During the SQL Slammer event, this proved to be an effective technique, with minimal intra-VLAN infection occurring. Figure 35 illustrates the concept.
Figure 35: Remote-Triggered Black Hole Filtering for Worm Containment
The later versions of Arbor Peakflow are capable of announcing the black hole route directly into iBGP. This feature will improve the response time when an infected or compromised device is located.
Detecting and black holing the infected machine should be viewed as a temporary fix. It is strongly recommended that further tracing of the machine be performed in order to isolate the machine at the switch port (quarantine phase). Following this, it is crucial that the owner be contacted and the machine properly treated (treatment phase).
Other Quarantine Techniques
Several other selective quarantine techniques are currently being developed. These techniques include:
Port control using scripting - It is not overly complex to construct a shell script (using TCL/Expect or Perl, for example) that identifies the attached port for an infected host from the IP address. After this port is identified, the host can be totally isolated from the network (shut down the port) or moved to a quarantine VLAN.
Policy-based routing - It is possible to use policy-based routing (PBR) to route all traffic from an infected host (based on source address) to a quarantine network. Typically, within this restricted network would be a server on which the infected clients could download tools for such tasks as treating the infection and patching the machine. The solution would require some level of scripting to activate the PBR.
Web Cache Communication Protocol - Using the same basic approach as PBR, Web Cache Communication Protocol (WCCP) can be used to divert traffic to a quarantine network.
MAC addresses - The first requirement is to know the MAC address of the infected hosts. These will soon be able to be identified, using an upcoming NetFlow enhancement in which the MAC address is exported. After the MAC address is known, it is possible to use some custom scripting (such as a Perl script) on the Dynamic Host Control Protocol (DHCP) server to grant an IP address from a quarantine pool. These addresses can then be routed via PBR or WCCP to the quarantine area.
802.1x - Through the use of 802.1x, an infected machine could be placed into a quarantine VLAN. In the same manner as above, this restricted network would contain a server where infected clients could download tools for such tasks as treating the infection and patching the machine. Alternatively, 802.1x can be used to apply a suitable ACL such that access is permitted only to the treatment server.
Remote access - Hosts dialing into the network or accessing the network using a VPN can typically have access restrictions applied using a RADIUS attribute. An ACL allowing access to the treatment server could only be applied universally on these remote-access points and then applied using RADIUS at login.
Remote Access
During a worm outbreak, it is critical to remember that infection might spread by entering the remote-access network. Often, machines that are connected to the Internet become infected and then connect internally using a VPN client. As such, any mitigation strategy needs to include the remote-access components of the network (both remote dial access and VPNs).
External Attacks
The primary intent of this document has been to describe response techniques for a worm outbreak. These same tools and techniques can also be used against external attacks on the corporate infrastructure, such as DoS and DDoS attacks on an e-commerce Website. In these cases, the response options are slightly different, but include:
Filtering (using ACL entries or ACLs) - Deny explicit sources, destinations, ports, services, and flags.
Rate limiting (via Committed Access Rate entries or class-based policing) - Throttle malicious traffic to maintain service availability.
Remote-triggered black hole routing using BGP - Drop explicit sources and destinations.
Diversion of attack traffic to a sinkhole - Redirect anomalous traffic to a sinkhole for analysis.
Diversion and scrubbing architectures - Assuming the attack traffic has not saturated the inbound link to the site, it can be diverted to a dedicated scrubbing device such the Cisco Guard XT (formerly the Riverhead Guard). This device provides sophisticated algorithms to remove attack traffic while allowing legitimate customer traffic to pass.
It is important to have a flexible response capability - different attacks will require different responses. For example, if the attack is an ICMP flood from a large number of fixed IP addresses, filtering using ACLs or remote-triggered black hole routing are the logical choices. In contrast, if the attack is a UDP flood or a SYN flood from spoofed addresses, rate limiting or diversion (to a Cisco Guard XT appliance) might be more appropriate.
IP Telephony: Cisco CallManager
Some of the most critical devices that must be protected during a worm outbreak are the Cisco CallManager systems. Compromise or infection of these devices could lead to a loss of telephony across the organization.
It is recommended that during a worm outbreak or other security incident that the nature of the event be assessed to determine its impact on the Cisco CallManager systems. It is beyond the scope of this document to provide full details for securing these systems, but it is strongly recommended that during normal operation, strict port filters be applied to restrict Cisco CallManager access to only the required ports.
Appendix A - Aggregated Bogon List
At the time of writing, the following prefixes are bogons. Details about bogons are available on the Internet at:
Appendix B - Freeware Tools
SNMP: net-snmp Toolset
Open-source SNMP command-line tools, library, trap generator, and agent are available at:
Perl modules are available from the Comprehensive Perl Archive Network (CPAN) at:
SNMP: Multirouter Traffic Grapher (MRTG)
MRTG, an open-source SNMP visualization toolset developed by Tobias Oetiker, is available on the Internet. Written in Perl, it has its own SNMP implementation.
SNMP: Round Robin Database Tool
The Round Robin Database (RRD) Tool is another open-source SNMP visualization toolset developed by Tobias Oetiker. It is available at:
RRD can be used in conjunction with MRTG. It does not perform its own SNMP collection. It can also be used with NetFlow using OSU flow-tools and FlowScan.
There are many HTML and PHP front ends such as Cacti, Cricket, and Big Sister.
OSU Flow-Tools
The OSU flow-tools package was developed and is maintained by Mark Fullmer. It is available at:
Command-line tools allow for display and sorting of specific criteria, such as source/destination IP, source/destination ASN, protocol, or port.
Data can be batched and imported into a database such as Oracle, MySQL, or Postgres.
Flow-tools can be combined with other tools to provide visualization of traffic patterns.
NetFlow Visualization: FlowScan
FlowScan is an open-source NetFlow graphing and visualization tool. It was developed and is maintained by Dave Plonka. It is available at:
FlowScan uses NetFlow data collected using OSU flow-tools to build traffic graphs. It supports reports such as top talkers by subnet and others, and uses the RRD Tool for graphing. Add-ons such as the JKFlow module allow more detailed graphing.
[1] Unassigned IP address space, i.e. 184.108.40.206/8.
[2] Address space allocated to this enterprise, but not assigned.
This document is part of the Cisco Security Research & Operations.
This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.


text:
If you missed the first round of showcase features you can find them {here} – All Furniture & Room Makeovers, Re-do's, and Updates
Here are more great showcases submitted this week:
Framed Stitched Love Note Submitted by
Beverly at Flamingo Toes
Knitted Cotton Heart Hanger Submitted by
Uruguay Life
Rolled Felt Heart Submitted by
Veronica at Life in the Thrifty Lane
Felt Heart Embroidery Hoop Hanger Submitted by
Birdie at These Moments of Mine
Conversation Heart Topiaries Submitted by
Lori at Our Forever House
Free Heart Printable Submitted by
Ellie at Less Cake {More Frosting}
Free Printable Submitted by
The Diary of Daves Wife
Free Holiday Printable Submitted by
Aimee at Sprik Space
Valentine's Specimen Art {made with stickers} Submitted by
Kyra at Racks and Mooby
Valentine Yarn Ball Garland Submitted by
Jo-Anna at A Pretty Life in the Suburbs
Valentine Ribbon Wreath Submitted by
Kristi at The Speckled Dog
Candy Cane Heart Wreath Submitted by
Heather at Our Life in a Click
Make Your Own Candy Conversation Hearts Submitted by
Suzy at Suzy's Artsy Craftsy Sitcom
Free Printable Classroom Pack {w/favors and cupcake toppers}
Submitted by Amanda at It's Always a Party at The Parkers
Cute Sucker Box Printables Submitted by
Diane at Pittypat Paperie
Gift Wrapping Station Submitted by
DaNita at Delightful Order
Gorgeous Colors in this Nature Inspired Vignette
Submitted by Paulette at Summerland Cottage
Decorative Moss Balls Submitted by
Trisha at The Sweet Survival
Fabulous Rolled Paper Sunburst Mirror Submitted by
Angie at The Country Chic Cottage
Cabinet Doors Turned Map Frames Submitted by
Ali at Honey and Maple Syrup
Washington Metro Subway Lines Wall Art Submitted by
Gaby at Give a Hoot {After but Before}
Teapot Lamp Submitted by
Autumn at Creative Little Daisy
Pottery Barn Inspired Bookcase Submitted by
Cynthia at Design Love
I love this genius idea for perfect chalkboard writing {using a stencil}
Submitted by Autumn at Creative Little Daisy
Vintage Book Cover {made with graphic printed paper} Submitted by
Lynda at Something Created Everyday
Adorable Hand Stamped Wooden Eggs Submitted by
Autumn at Creative Little Daisy
Dish Towel Belts {a genius way to keep your towels off the floor}
Submitted by Krystal at Sassy Sanctuary
T-shirt to Tote Bag Submitted by
Jacy at Bit O Whimsy
Turn a Shirt and a Skirt into an Adorable Dress Submitted by
Jenn at A Jennuine Life
Make Fleece Super Sledding Mittens Submitted by
Sarah at Sweet Pea & JoJo
Knitting Basics with Video Tutorials Submitted by
Malory at Snips & Spice
DIY Dog Leash Submitted by
Courtney at Red Heads Craft More Fun
Braided Fabric Bracelets Submitted by
Carla at Breathing Deep Where The Air is Thin
Repurposed Jewelry Submitted by
Betsy at My Salvaged Treasures
New Years Goal {made with recycled index cards} Journal Submitted by
Angela at Wray Sist3rs
Salad Garden Gift Basket {Love the chalkboard spoon plant markers}
Submitted by Christy at From Glitter to Gumdrops
Cars Birthday Cake {super cute – love the checkered flag} Submitted by
Stef at Girl.Inspired
Orange Creamsicle Cupcakes Submitted by
Amanda at Amanda's Cookin
Homemade Soft Pretzels {three different ways} Submitted by
Jillian at Food Folks and Fun
How to Make a Real Mint Julep Submitted by
Charm of the Carolinas
If you've been featured today feel free to grab a button if you like
A special thanks to Becky from Clean Mama Printables. You can find her Etsy shop {here} full of great printables to help you start off the New Year Right and on track. You can also follow her helpful tips and organization ideas along on her blog {here}. Right now 'January is Cleaning Month' and she has a free printable all ready for you to get started and join in the fun…there are also some great prizes too!


text:
To the north is Mount Soledad (52) Freeway and the sprawling southern fields of MCAS Miramar; to the east is the 5,800-acre Mission Trails Regional Park with its numerous hiking and mountain biking trails; to the west there are bluffs and the wide Interstate 15 corridor; and to the south there are steep canyons overlooking the San Diego River and Mission Valley. Homes range from newer and older, including everything from condos to Mediterranean-style ranches on large lots.
Residential, MLS# 190011986
Listing provided by Realty Executives All Area
Residential, MLS# 190009833
Listing provided by Redfin Corporation
Residential, MLS# 190007342
Listing provided by Berkshire Hathaway HomeService
Residential, MLS# 190007608
Listing provided by Real Estate eBroker, Inc.
Residential, MLS# 190007757
Listing provided by Coldwell Banker Res. Brokerage
Residential, MLS# 190005511
Listing provided by Pacific Sotheby's Int'l Realty
Residential, MLS# 190011268
Listing provided by Allison James Estates & Homes
This information is deemed reliable but not guaranteed. You should rely on this information only to decide whether or not to further investigate a particular property. BEFORE MAKING ANY OTHER DECISION, YOU SHOULD PERSONALLY INVESTIGATE THE FACTS (e.g. square footage and lot size) with the assistance of an appropriate professional. You may use this information only to identify properties you may be interested in investigating further. All uses except for personal, non-commercial use in accordance with the foregoing purpose are prohibited. Redistribution or copying of this information, any photographs or video tours is strictly prohibited. This information is derived from the Internet Data Exchange (IDX) service provided by Sandicor®. Displayed property listings may be held by a brokerage firm other than the broker and/or agent responsible for this display. The information and any photographs and video tours and the compilation from which they are derived is protected by copyright. Compilation © 2019 Sandicor®, Inc.


text:
Arnhem1618Paper PadsbySpeedball
BlickPencil Case
20% Off Orders of $35 or More + Free Shipping
Available Offers
Today's Deal
Free Shipping
On Orders of $35 or More**
20% Off
Orders of $35 or More*
Use Code: CEWZ *Exclusions apply**After discounts taken
On Orders of $45 or More**
**After discounts taken
Browse more:
It is available in more than 90 brilliant matte colors for a wide choice in sensitive graphic reproduction or fine art painting techniques. Its characteristics include covering power, opacity, and high tinting strength with fine flowing texture.
Color Swatches created using full strength/50/50 and were applied on cold press Bristol board (2 ply) material.
copper phthalocyanine
Phthalo Blues are pure and clean primary blues with superior covering power. They have a very high tinting strength and tend to overwhelm other pigments, but if color strength can be controlled, they make predictable mixed colors. In oil form, blues are very deep and slow drying. When mixed with other colors or if chlorine is added, Phthalo Blue quickly tends towards green. When using alone, mix with some white, as Phthalo Blue can be semi-transparent and almost black on its own. It is among the most compatible of modern colors with mineral colors and is considered more reliable than Prussian Blue, while sharing the same physical and color properties. Phthalo Blue is a good color for glazing.
Phthalo Blues are completely lightfast and stable and are permanent for all paint uses. They are currently used in inks, coatings, and many plastics due to their stability and are considered a standard pigment in printing ink and the packaging industry.
Phthalo Blues have no significant hazards, although those made before 1982 contained some PCBs (polychlorinated biphenyls).
Developed by chemists using the trade name Monastral Blue, the organic blue dyestuff now known as Phthalo Blue was presented as a pigment in November 1935 in London. Its discovery was accidental. The dark color was observed in a kettle where a dye was being made from a British dyestuff plant. The demand for such a pigment came from commercial printers who wanted a cyan to replace Prussian Blue.
Bocour Blue, Cyan Blue, Helio Blue, Heliogen Blue, Intense Blue, Monastral Blue, Phthalocyanine Blue, Rembrandt Blue, Thalo Blue, Winsor Blue.
organic, monoazo
This Hansa yellow is a transparent yellow. It has great brightness and tinting strength and its drying time ranges from average to slow.
Hansa Yellow makes more intense tints and cleaner secondaries than Cadmium Yellows, especially when mixed with other organic or modern colors like Phthalo Blue and Green. Because they are more transparent, they have great value as glazing colors.
This Hansa Yellow has fair to good permanence, particularly in the lighter shades.
Hansa Yellow has no significant acute hazards, though its chronic hazards have not been well studied.
Hansa Yellows were first made in Germany just before WW1 from a series of synthetic dyestuffs called Pigment Yellow. They were intended to be a synthetic replacement for Cadmium Yellow.
Arylamide Yellow, Arylide, Arylide Yellow, Azo, Brilliant Yellow, Monoazo, Monolite Yellow, Permanent Yellow.
Your cart is currently empty.
Your cart currently contains N item.
Material Safety Data Sheet
® Daler-Rowney is a registered trademark.


text:
What's your favorite kid-friendly app?
It's so hard to say! With new apps developed each and every day, there are always great ones being developed for each age group. As mom of kids ages 6 and 9, some of their favorites include Temple Run and anything featuring Angry Birds. A new favorite is LeapFrog's My Robot which teaches early programming and focuses on reinforcing STEM subjects (science, technology, engineering, and math) in ages 6+.


text:
The selling season is here—is your team ready? Take advantage of it, and your HVAC business could grow dramatically. Prepare your leaders with successful sales management training, and give your profits the opportunity to flourish. These five actions will help create more concrete customer relationships and thereby increase your profits.
- Collect the prospect information. Each customer should be documented, and each document should be organized. This includes customers who call into the office, have service work done, or have signed a maintenance agreement.
- Schedule the sales appointment. It's important to respond to the customer in an expedited fashion, preventing any opportunity for the competition to step in.
- Dispatch the sales appointments. Distribute the leads to the salespeople in a controlled and organized manner. Do not leave the distribution to chance—it should be controlled by your criteria.
- Follow up on the sales presentations. Many companies don't follow up for several days, and others, not at all. More often than not, this simple move will score you the sale, because you were the only dealer to call back.
- Generate sales and lead reports. Evaluate the effectiveness of your sales team—this data is power and can be used to help determine where your sales team needs training and development.
Implement these steps and see how it affects your entire sales process overall. Read more HVAC sales tips on my blog, and don't forget to tweet me what you think of this article at @HVACLearning.
Mike Moore is the HVAC Training Director at HVAC Learning Solutions, HVAC industry experts in sales, technical, and business training. Visit Mike's blog for more insights. Mike can be reached on Twitter @hvaclearning or on Google+ at gplus.to/hvactraining.


text:
Views: 511
My wife and I are separated and heading for divorce for precisely this reason. When we were dating, we both declared our intention to remain child-free. Mine was philosophical, hers was based on disgust with the biology of childbirth and child-rearing; and she perceived herself as a sort of child, whence having kids would be inappropriate. We never reached closure on the philosophical justification, but were happily child-free for over 8 years of marriage. Now we are both in our late 30s. Last summer, my wife suddenly announced that a couple without children is not a "real family", and that her life would be meaningless unless she experiences motherhood and child-rearing. If she doesn't leave behind a biological legacy, then her life amounts to a waste and an idle travesty. Years ago, she endorsed and supported my decision to take medical steps against fertility. Now she says that because of that, we must divorce, so that she could become a single mom, or find another man. Several months ago, she left me, moving out of our house to an apartment somewhere in town (she won't divulge her address to me). We meet maybe once a week in parking lots or restaurants, conversing about what to do. I've given up trying to reason with her, trying to offer her alternatives such as us volunteering in community activities involving children. She's determined to reproduce - and I'm only a few divorce-papers away from losing her.
So sorry to hear about your situation Michael. I'm sorry you guys couldn't reach an agreement about remaining child-free.
I'll confess to agreeing with her on one single point: "a couple without children is not a "real family". As firmly as I am against breeding, I am also against the institution of marriage. Until we procreate, we ought to all simply be free individual humans. Free to "hang-out exclusively with one another for years at a time", or not! Monogamy serves no purpose other than providing a second steady adult to supply food to offspring. I think offspring need parental contracts to protect them from irresponsible breeders. But I don't think child-free adults need binding monogamy contracts.
Sounds to me like you'll be better without her. By the few writings I've read of yours, it seems like you have your head screwed on in a very thoughtful way. You will quickly bounce back from this sadness of loss. I realise I'm several months late in responding, so you may have already accomplished this.
Do come and hang out here and write some more :)
Yours truly,
This is why I want to get a tubal before I get into a long-term marriage.
So they will know that I'm serious and so it won't be a birth control sabotage away from him having legal binding claim to me forever.
Also, I hate children. Have always loathed children, and for me it's not a philosophy thing so much as....I have shit I want to do. I want to own a massive garden, I want to travel the world and go to dangerous places and go backpacking across Europe.
You can't do that with a toddler in tow.
Also sometimes it's the people you're around--if suddenly all your friends are having kids/getting engaged/getting married...you tend to react in some way. When I had an ex who's friends all got engaged to their long-term girlfriends, I got dumped so he didn't have to bring me to any of the weddings. I imagine if she's seeing all the attention that pregnant women/women with children are getting, her reaction was suddenly that she has to leave a "legacy" so she can have attention for it/get praise for it. It's also ingrained in a lot of religious doctrines, that women who aren't homemakers are "lesser".
I honestly am nothing of the sort, and I still have my sights set on owning a tiny apartment in the city, a small cottage in country with a massive orchard and garden, and then maybe, one day, setting up a series of halfway houses for atheist kids/cult victims who need help getting out of their bad situation. I have a lot of dreams, pipe and otherwise, that I'd like to see or try to get to fruitition.
If my biological clock starts ticking I'll probably adopt a brown kid around age 13 because those kids never get adopted. Not brown kids, not kids over the age of 3 months or so--most of those "pro life" people give zero fucks about children who need a chance if they're brown or not a newborn.
Still, I'll never get the "oh no, I haven't produced shitty progeny of my own, thus my life is ruined" idea. I have SHIT genetics. I'm fat, I'm considered ugly, do I WANT to bring a kid into the world that will be subsequently bullied and told that they should kill themselves? NOPE.
I was so happy when I turned 40 because now I don't have to worry about a perfect stranger bugging me about having kids. I still have to worry about perfect strangers bugging me about marriage, though.
I agree agree agree :)
I hope I don't encounter this situation however I make it PERFECTLY clear before I begin dating a man that I don't EVER want children. You can image that my dance card isn't that full, lol.
Nether is mine <fistbump>
It usually tends to be because I bring up the "nope, never want kids, and I fucking hate suburbs" on the first date or while we're still in the chatty stage.
Really weeds out the people who'd otherwise assume I want kids by default.
Also, have you had to deal with the creepers who've already picked out the names of "their future kids" and want like, 4-6 womb invaders and automatically assume they'll be naming the children but not doing any of the actual child care?
FUCK it is creepy. Women who design their wedding dresses are designing dresses for themselves. It's almost like me picking out plastic surgery I want my future husband to get. The choice has nothing to do with me! How do guys get off choosing names/exactly how many kids they want?
I'm getting health insurance soon and that means I'm going to get fixed. He hasn't tried to stop me.
© 2019 Atheist Nexus. All rights reserved. Admin: The Nexus Group. Powered by


text:
Moderator: Moderators
boogieman wrote:I've had the bloodbath bug reoccur once on pirate giving him the usual 4k hp and +300 damage. I forgot to save the replay but I've only seen this happened once in 10+ games with 1.21.
Cassiel wrote:Nah, unselectable units just aren't picked up by Blueshift. I may add Juju Bees, Fireflies and Dead Can Dance to it for the next version.
set factor = charge / MAX
set damage = factor * 100.
set life = factor * u:MaxLife
call UnitModifyDamage (target, damage)
call UnitModifyMaxLife(target, life)
set multiplier = factor
Cassiel wrote: It's also worth noting that a) the Life and Damage bonuses were out of sync--+870 Damage means a factor of 8.7, while 8092 life from a base of 825 means a factor of 9.8--and b) the bonus to Spell Power wasn't off like Life and Damage were.
theboogleman wrote:Make a test map where you can set the blood meter to any amount and we can test it.
Users browsing this forum: No registered users and 4 guests