text:
Review Group Week 206 - JOE THE BARBARIAN #1
Hey you! Reader! Want to be a part of the GREATEST COMIC BOOK AND GEEK COMMUNITY on the web?! Well, they're not accepting new members, but we'll take anyone here, so why not sign up for a free acount? It's fast and it's easy, like your mom! Sign up today! Membership spots are limited!*
*Membership spots not really limited!
Hey you! Reader! Want to be a part of the GREATEST COMIC BOOK AND GEEK COMMUNITY on the web?! Well, they're not accepting new members, but we'll take anyone here, so why not sign up for a free acount? It's fast and it's easy, like your mom! Sign up today! Membership spots are limited!*
*Membership spots not really limited!
by thefourthman » Thu Jan 21, 2010 12:04 pm
I'm not talking about tripping balls, I am talking about him eating candy bars to fix his sugar levels, that seems incredibly dangerous to me - unless they are those special candy bars, but there is nothing said about that.
by thefourthman » Thu Jan 21, 2010 12:17 pm
I know this, but she told him to be sure he ate it, which means she was medicating him with it. It was odd.
by Kerny » Thu Jan 21, 2010 12:20 pm
She didnt exactly strike me as a good mom
by Chubbles » Thu Jan 21, 2010 12:31 pm
I got the same exact sentiment when i read the book. She was on her cell while driving and not really paying attention to him also she blamed their current lifestyle on the dad which is not what a good parent does.
by ****** » Thu Jan 21, 2010 12:33 pm
I don't know the context and the phrasing sounds a little weird, but I don't think it's totally off base. The kid would need to be taking in some carbs if he's active and insulin dependent.
Although, if the kid is supposed to be tripping due to his diabetes maybe Morrison meant to make the mother bizarro.
by Chubbles » Thu Jan 21, 2010 12:35 pm
ya i didn't really care if it was 100% accurate, i just understand he's got a medical problem and it somehow leads to him entering this other world. Diabete's or not the point got across.
by Arion » Thu Jan 21, 2010 12:43 pm
It's quite good .
by thefourthman » Thu Jan 21, 2010 12:49 pm
the dad is dead.
She is a single mom. She would be distracted... she may not be the best,.
like I said I need to give it another read, but there were some oddities that I wanted to discuss.
by thefourthman » Thu Jan 21, 2010 12:52 pm
see, the only reason I know that is from reading other shit. Otherwise I would think I was just reading I Kill Giants again, which this is very similar to.
by Chubbles » Thu Jan 21, 2010 12:59 pm
I agree the solicit wasn't the best in terms of meshing with the story but that's probably why I liked it more than you. I didn't read the solicit, I just saw Morrison and 1 dollar so it's a buy. Plus like i said in my review I Kill Giants was one of my favorite reads so if this is similar it's already got a leg up with me.
by thefourthman » Thu Jan 21, 2010 1:10 pm
see, normally I don't read solicitations, but after the preview (which I also don't normally read, but it was so pretty) - I was like what the hell was that? and then I find out the kid is diabetic and then I read the issue.... it's like reading Countdown and then getting Final Crisis...
Also, I like I Kill Giants and was kind of upset at how much this apes it. This is like most things I have read by Grant Morrison, I want to like it, but it just doesn't do it for me. But my biggest problem with the issue is the weird phrasing and typos, it is literally difficult to read in a few places - and not because it is like Toni Morrison and more difficult than an average book, but because it goes in and out of making sense.
by Eli Katz » Thu Jan 21, 2010 1:15 pmJoe the Barbarian
So, as a $1 comic, Joe the Barbarian is an amazing book. The art by Sean Murphy is rich and textured and beautifully detailed. He draws a number of full-page panels and demonstrates in them his ability to illustrate complex scenes with a perfect blend of realism and dynamic stylization. The page with the kid walking to his house as the bus drives off is simply amazing. A real masterpiece in a technical sense. Murphy has been on fire artistically since he did two issues of Hellblazer about a year ago. So I am very pleased that he will have the chance now to draw a long story and show off his considerable talents.
But that said, as an introductory chapter to an eight-issue story, I'm not sure what to make of Joe the Barbarian. We are introduced to Joe, a sickly teenage kid who is the cliched artist-type tormented by the cliched school bullies. We see that Joe comes from a broken home and that he considers his attic-bedroom a refuge from the ugliness of the outside world. And we also see Joe suffering a brief hallucinatory break from reality, where his toys come to life and introduce him to a nightmarish world. But we don't know where this story is headed or what this book is really about. In other words, there are a lot of introductions but not much action or development or even basic foreshadowing.
On one hand, it's difficult to rate Grant Morrison's story so far, because it's unfair to expect too much from the first chapter in an eight-chapter story. But on the other hand, aside from a few snappy lines ("This fairytale's on a one-way trip to hell"), nothing in the story made me want to read issue two. Joe is not particularly interesting as a character. Hallucinations are not particularly novel (especially in Grant Morrison stories). And talking toys have been done before. So, to be honest, if the art weren't so damn good, I don't think I'd make any effort to pick up future issues. It's especially hard to be enthusiastic about this book because it's poorly edited; it has typos, repeat words, and some very choppy dialogue in one key scene.
Joe the Barbarian may turn into a wonderfully written series. But the first issue is a very, very, very slow start.
Story: 6
by Starlord » Thu Jan 21, 2010 1:23 pmI thought the mom was written to be kind of a poor paternal institute. She's obviously wrapped up in her own world and barely gives Joe a second thought. Kind of like what I see in the courthouse all the time.
by thefourthman » Thu Jan 21, 2010 1:29 pm
See the one thing I really like about Morrison is that his stuff is always his. ASS, New X-Men, Batman, Seaguy, Final Crisis... he does it his way. I absolutely love his Batman although I think RIP is clumsy. I like the ideas of FC but hate the execution. New X-Men is the only run of mutant books besides X-Factor that I like. He isn't afraid to do things and for whatever reason editorial lets him have a free hand. It makes his books exciting, you never know what is gonna happen.
Then you take someone like Hickman who had a brave, new voice at Image only to be neutered when he came to Marvel. Sure he is better than the other people that have written FF for a while and Secret Warriors is awesome, but they don't feel like his previous work. I have the same problem with Remender (outside of Frakencastle) and Fraction to an extent (although he has become a better writer, if a weaker voice).
Morrison isn't afraid to try things. Sometimes he fails (Final Crisis), sometimes it is clumsy but admirable (Batman), sometimes it is brilliant (All Star Superman)... but it is always interesting and new.
leave a comment with facebook
Who is online
Users browsing this forum: Belle-Tain Summer, Stephen Day and 23 guests


text:
Security management is the process by which security controls are implemented and security managers are subject to control. Some of the elements of this architecture — the management of passwords and accounts, authorization controls, legal issues, privacy, and so forth — are discussed in their own chapters. The following additional elements also form part of the structure:
- Acceptable use enforcement
- Administrative security
- Accountability controls
- Activity monitoring and audit
Acceptable Use Enforcement
One of the best things that a company can do is to have an acceptable use policy (AUP) that dictates what employees can do with the computers they use and the networks and data they have access to. Many early AUPs only addressed Internet access; they either told subscribers of an ISP what was deemed acceptable or listed company policies created to reduce bandwidth demands. Now, however, AUPs are attempting to specify the entire panorama of computer use, from what subjects employees are allowed to read about on the Internet, to what's okay to say in an internal e-mail, to whether a personal music CD can be inserted in the CD-ROM drive of the office desktop.
A problem with many of these AUPs is that they do not have compliance enforcement written into them or do not evenly and fairly apply their own rules. One thing is certain: if an AUP is not enforced, it's not worth having. Before proposing potential enforcement rules, let's look at some typical enforcement statements.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Examples of AUP Enforcement Wording}
Early enforcement policies for AUPs primarily consisted of withholding or canceling service. If, for example, copyright or trade secret infringement were violated or a subscriber harassed or intimidated another user, knowingly released a virus, or unlawfully accessed someone else's information, the ISP simply dropped that customer and refused to provide them service. This type of policy is still in use by many ISPs today. Example enforcement policies of this type are those of Focal Communications, MOREnet, and Plain Communications.
The following examples of AUP enforcement statements are taken from public website statements. Similar statements exist in private AUPs. The examples are provided in hopes they may provide some impetus to write strong enforcement statements and sound AUPs.
- From www.focal.com/policy/abuse.html:
"Focal may in its discretion, without liability, and without notice terminate or suspend service based on it(s) determination that a violation of the Policy has occurred."
- From www.more.net/about/policies/aup.html:
"Reported and perceived violations of the Acceptable Use Policy will be reviewed by the MOREnet Executive Director. Violations that are not promptly remedied by the member institution or project participant may result in action including the termination of MOREnet service or the forfeiture of MOREnet membership.?"
- From www.plain.co.nz/policy/enforcement.html:
"Upon the first verifiable violation of one of these policies, and a single formal letter of complaint, Plain will issue a written warning to the customer. Upon the second verifiable violation of one of these policies, and formal letters of complaints from three different sources, Plain will suspend the customer's service until the customer submits to Plain, in writing, an agreement to cease-and-desist. Upon the third verifiable violation of one of these policies, and one more letter of complaint, Plain will terminate the customer's service."
As organizations learn more about the types of abuse that regularly occurs, and the need to have strong enforcement, many ISPs and others are taking an even stronger stance. They are defining monitoring steps that they take, imposing penalties on employees and stating full cooperation with appropriate authorities. Examples of such enforcement statements can be found at Empowering Media, Cafe.com, Efficient Networks, the University of Miami School of Law, Ricochet Networks, and the University of California, Davis:
- From www.hostasite.com:
"Violators of the policy are responsible, without limitations, for the cost of labor to clean up and correct any damage done to the operation of the network and business operations supported by the network, and to respond to complaints incurred by Empowering Media. Such labor is categorized as emergency security breach recovery and is currently charged at $195 USD per hour required."
- From www.cafe.com:
"If we suspect violations of any of the above, we will investigate and we may institute legal action, immediately deactivate Service to any account without prior notice to you, and cooperate with law enforcement authorities in bringing legal proceedings against violators."
- From www.speedstream.com/legal_use.html:
"In order for Efficient Networks to comply with applicable laws, including without limitation the Electronic Communications Privacy Act 18 U.S.C. 2701 et seq., to comply with appropriate government requests, or to protect Efficient Networks, Efficient Networks may access and disclose any information, including without limitation, the personal identifying information of Efficient Networks visitors passing through its network, and any other information it considers necessary or appropriate without notice to you. Efficient Networks will cooperate with law enforcement authorities in investigating suspected violation of the Rules and any other illegal activity. Efficient Networks reserves the right to report to law enforcement authorities any suspected illegal activity of which it becomes aware. In the case of any violation of these Rules, Efficient Networks reserves the right to pursue all remedies available by law and in equity for such violations. These Rules apply to all visits to the Efficient Networks Web site, both now and in the future."
- From www.law.miami.edu/legal/usepolicy.html:
"In addition, offenders may be referred to their supervisor, the Dean, or other appropriate disciplinary authority for further action. If the individual is a student, the matter may be referred to the Honor Council. Any offense that violates local, state, or federal laws may result in the immediate loss of all University computing privileges and may be referred to appropriate University disciplinary authorities and/or law enforcement authorities."
- From www.ricochet.com/DOCS/P_Acceptableusepolicy.pdf:
"RNI may involve, and shall cooperate with, law enforcement authorities if criminal activity is suspected, and each User consents to RNI's disclosure of information about such User to any law enforcement agency or other governmental entity or to comply with any court order. In addition, Users who violate this AUP may be subject to civil or criminal liability. RNI SHALL NOT BE LIABLE FOR ANY LOSSES OR DAMAGES SUFFERED BY ANY USER OR THIRD PARTY RESULTING DIRECTLY OR INDIRECTLY FROM ANY ACT TAKEN BY RNI PURSUAL TO THIS AUP."
- From www.ucdavis.edu/text_only/aup_txt.html:
"Any offense which violates local, state or federal laws may result in the immediate loss of all University computing privileges and will be referred to appropriate University offices and/or law enforcement authorities."
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Developing AUP Enforcement Policy Text}
It may seem that the first logical step to take when developing an enforcement policy is to decide what the proper response to noncompliance should be. However, writing enforcement language that states what your company will do is more important. Putting strong enforcement statements into an AUP because you think they will deter abuse is foolhardy. Enforcement statements should not be written in the hopes that their language will prevent it; they should be written to define the punishment for noncompliance. More harm than good can be done if a strong enforcement policy is not applied when violations occur.
NOTE For additional information on AUPs, see www.cert.org/security-improvement/practices/p034.html.
In addition to writing statements that accurately reflect the actions that will be taken, the following items should be considered when writing AUP enforcement text:
- Consult with your legal representation. Laws may require your cooperation with law enforcement, the reporting of certain violations, treatment of those accused, punishment meted out, and disclosure of private information. How enforcement policy is stated may also have legal bearing. It is best to have legal advice from those with legal background and knowledge in this area.
- Ensure management agreement on the consequences listed. Without management agreement, you may find yourself with a tough enforcement policy that no one is willing to actually use. Think of things that may cause problems; for example, discontinuing services such as network access may not be a valid, in-house rule if network access is required for the employee to do their job. Discontinuing Internet access, or restricting access to specific site and/or specific network servers, may be a more enforceable policy.
- Invite participation by all stakeholders. Just as the policy itself should be developed in total with everyone's input, so should enforcement be discussed with them. Although it's true that laws and management policy may dictate what must be stated in certain parts of your enforcement document, you'll get more voluntary participation if the people to whom a policy applies have some say in its development.
- Develop the policy and its enforcement rules as part of an overall security policy. Other parts of the security policy may have enforcement clauses, too, and you will want to coordinate them.
- Develop enforcement rules for each variation of the AUP. There is no single AUP; instead, there should be an AUP for different IT products and/or roles. The most common AUP will be a broad policy that covers workstations, as well as access to the network and Internet by most employees. You will also want to have a separate AUP that addresses the practices of IT administrative staff. For example, IT pros have a higher level of access to systems than others and might not be held to the same restrictions of use as most employees. So a separate AUP should dictate what constitutes acceptable use of systems by them. Likewise, a more severe enforcement clause will lay out punishment for noncompliance. IT pros can do damage without having to illegally hack systems, so the consequences for their irresponsible actions should be appropriate.
- Where possible, enforce the policy by using filtering technology. Use a product that blocks site access and records access attempts and access and report violations.
- Consider a stepped enforcement rule. On the first violation, perhaps dependent on the type of violation, a lesser punishment such as increased monitoring and more restricted access may be appropriate. After a second violation, something stronger may be in order. At some point, perhaps dismissal.
- Determine when and if you will bring in law enforcement. Laws are laws, and you are obligated to follow them, but there may be gray areas. For example, if an attack is stopped before it is successful and you learn it was carried out by the son of the Vice President, do you smile and shrug? Call in the FBI? What if the attack was successful? Would it matter what the nature of the attack was? Before you chastise me for not recommending a zero-tolerance strategy, do you have employees arrested for stealing a few paperclips? You should always obtain legal guidance in this area.
- Designate who in the organization will be responsible for enforcement. This individual should have the authority to enforce the policy. The Chief Information Officer (CIO) may be the appropriate choice in some organizations.
- Let everyone know the rules. Employees should be informed of the policy and have the opportunity to discuss it and understand its meaning and the consequences of noncompliance. The policy should be reviewed with them when they join the company and at least once per year thereafter. Have them sign off that this was done and provide a contact person for them so they can ask questions at a later time if they want to. If possible, place the policy online and remind employees of their required cooperation. Some organizations state the existence of and provide a link to the policy in the system logon banner.
- Review the policy periodically. Laws, people, processes, and times change. Your policy may, too. Keep the policy and its enforcement section up-to-date.
- Be prepared to mete out the punishments outlined in your policy. The worst possible thing you can do is have a harsh enforcement policy and then do nothing to carry it out.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Enforcement Processing}
AUP enforcement is not just a matter of writing strong words and meting out punishment. Enforcement also means detecting the abuse and proactively stopping infractions from occurring. Products such as Websense (www.websense.com) and SurfControl (www.surfcontrol.com) use filtering technologies to block access to sites or even to block keywords that an organization has deemed unacceptable. Filtering products may also filter e-mail for regulated topics. Other products may take a more passive approach such as simply recording every page visited and allowing reports to track user activity on the Internet. In either case, all Internet access must pass through a control point such as a firewall or proxy server. A product is integrated with these control points and configured to meet the demands of the company. Attempts and successes are logged, and if the product is set to block, access is blocked.
NOTE A 90-page document on the effectiveness of these types of filtering products can be found at
The Websense product is backed by a constantly updated master database of more than four million sites organized into more than 80 categories. This database makes it possible, for example, to block access to gambling, MP3, political, shopping, and adult content sites. An additional Websense product can manage employee use of media-rich network protocols, instant messaging, streaming media, and so forth, allowing access when bandwidth permits and blocking access when the organization needs that capability for business-related activity.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Administrative Security}
When considering controls that determine the availability and integrity of computing systems, data, and networks, consider the potential opportunities an authorized administrator has as compared to the ordinary user. Systems administrators, operators who perform backup, database administrators, maintenance technicians, and even help desk support personnel, all have elevated privileges within your network. To ensure the security of your systems, you must also consider the controls that can prevent administrative abuse of privilege. Remember, strong controls over the day-to-day transactions and data uses of your organization cannot in themselves ensure integrity and availability. If the controls over the use of administrative authority are not strong as well, the other controls are weakened as well.
In addition to directly controlling administrative privilege, several management practices will help secure networks from abuse and insecure practices.
Preventing Administrative Abuse of Power
Two principles of security will help you avoid abuse of power: limiting authority and separation of duties.
Limiting Authority
You can limit authority by assigning each IT employee only the authority needed to do their job. Within the structure of your IT infrastructure are different systems, and each can be naturally segmented into different authority categories. Examples of such segmentation are network infrastructure, appliances, servers, desktops, and laptops.
Another way to distribute authority is between service administration and data administration. Service administration is that which controls the logical infrastructure of the network, such as domain controllers and other central administration servers. These administrators manage the specialized servers on which these controls run, segment users into groups, assign privileges, and so on. Data administrators, on the other hand, manage the file, database, web content, and other servers. Even within these structures, authority can be further broken down? — that is, roles can be devised and privileges limited. Backup operators of file servers should not be the same individuals that have privileges to back up the database server. Database administrators may be restricted to certain servers, as may file and print server administrators.
In the large enterprises, these roles can be subdivided ad infinitum: some help desk operators may have the authority to reset accounts and passwords, while others are restricted to helping run applications. The idea, of course, is to recognize that all administrators with elevated privileges must be trusted, but some should be trusted more than others. The fewer the number of individuals that have all-inclusive or wide-ranging privileges, the fewer that can abuse those privileges.
Separation of Duties
Another control is separation of duties. In short, if a critical function can be broken into two or more parts, divide the duties among IT roles. If this is done, abuses of trust would require collaboration and, therefore, will be less likely to occur. The classic example of this separation is the following rule: developers develop software, and administrators install and manage it on systems. This means that developers do not have administrative privileges on production systems. If a developer were to develop malicious code, she would not have the ability to launch it, on her own, in the production network. She would have to coerce, trick, or be in collusion with an administrator. She might also attempt to hide the code in customized, in-house software; however other controls, including software review and the fact that others work on the software, mean that there is a good chance of discovery, or at least, perhaps, enough of a chance to deter many attempts.
Even on the administration side, many roles can be so split. Take, for example, the privilege of software backup. Should these individuals also have the right to restore software? In many organizations these roles are split. A backup operator cannot accidentally or maliciously restore old versions of data, thus damaging the integrity of databases and causing havoc.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Management Practices}
The following management practices can contribute to administrative security:
- Controls on remote access, and access to consoles and administrative ports Controls that can enhance administrative security are the controls placed on out-of-band access to devices such as serial ports and modems, and physical control of access to sensitive devices and servers. Limiting which administrators can physically access these systems, or who can log on at the console, can be an important control. Limiting remote access is another effective move. Just because an employee has administrative status doesn't mean their authority can't be limited.
- Vetting administrators IT admins have enormous power over the assets of organizations. Every IT employee with these privileges should be thoroughly vetted before employment, including reference checks and background checks. This should not hamper employment. Clerks who handle money are often put through more extreme checks.
- Using automated methods of software distribution Using an automated method of OS and software installation not only ensures standard setup and security configuration, thus preventing accidental compromise, it also is a good practice for inhibiting the abuse of power. When systems are automatically installed and configured, there are fewer opportunities for the installation of back door programs and other malicious code or configuration to occur.
- Using standard administrative procedures and scripts The use of scripts can mean efficiency, but the use of a rogue script can mean damage to systems. By standardizing scripts, there is less chance of abuse. Scripts can also be digitally signed, which can ensure that only authorized scripts are run.
Accountability Controls
Accountability controls are those that ensure activity on the network and on systems can be attributed to an actual individual. These controls are things such as:
- Authentication controls Passwords, accounts, biometrics, smart cards, and other such devices and algorithms that sufficiently guard the authentication practice
- Authorization controls Settings and devices that restrict access to specific users and groups
Administrative Power Should Be Delegated
In the Windows world, subadministrative groups are defined, each with their own sets of privileges, and custom groups can be created and provided a list of privileges as well. In the classic Unix system, the power of the 'root' account cannot be diminished, and no such natural segmentation of power exists. Additional groups for users can be created, and they can be given distinct rights on resources, but it doesn't provide the same level of granularity. There are, however, third-party products, such as Symark PowerBroker, that delegate the powers of the root account to trusted users. These users will not need nor have the root password, and an audit trail can be created that details the actions taken by these different accounts.
When used properly, accounts, passwords, and authorization controls can hold people accountable for their actions on your network. Proper use means the assignment of at least one account for each employee authorized to use systems. If two or more people share an account, how can you know which one was responsible for stealing company secrets? A strong password policy and employee education also enforce this rule. When passwords are difficult to guess and employees understand they should not be shared, proper accountability is more likely. Authorization controls ensure that access to resources and privileges is restricted to the proper person. For example, if only members of the Schema Admins group can modify the Active Directory Schema in a Windows 2000 domain, and the Schema is modified, then either a member of that group did so or there has been a breech in security. Chapter 6 explains more about authentication and authorization practices and algorithms.
There are exceptions to the one employee, one account rule:
- In some limited situations, a system is set up for a single, read-only activity that many employees need to access. Rather than provide every one of these individuals with an account and password, a single account is used and restricted to this access. This type of system might be a warehouse location kiosk, a visitor information kiosk, or the like.
- All administrative employees should have at least two accounts: one account to be used when they access their e-mail, look up information on the Internet, and do other mundane things; and one that they can use to fulfill their administrative duties.
- For some highly privileged activities, a single account might be assigned the privilege, while two trusted employees each create half of the password. Neither can thus perform the activity on their own; it requires both of them to do so. In addition, since both may be held accountable, each will watch the other perform the duty. This technique is often used to protect the original Administrator account on a Windows server. Other administrative accounts are created and used for normal administration. This account can be assigned a long and complex password and then not be used unless necessary to recover a server where the administrative account's passwords are forgotten or lost when all employees leave the company or some other emergency occurs. Another such account might be an administrative account on the root certification authority. When it is necessary to use this account, such as to renew this server's certificate, two IT employees must be present to log on. This lessens the chance that the keys will be compromised.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=Activity Monitoring and Audit}
Monitoring and auditing activity on systems is important for two reasons. First, monitoring activity tells the systems administrator which systems are operating the way they should, where systems are failing, where performance is an issue, and what type of load exists at any one time. These details allow proper maintenance and discovery of performance bottlenecks, and they point to areas where further investigation is necessary. The wise administrator uses every possible tool to determine general network and system health, and then acts accordingly. Second, and of interest to security, is the exposure of suspicious activity, audit trails of normal and abnormal use, and forensic evidence that is useful in diagnosing attacks and potentially catching and prosecuting attackers. Suspicious activity may consist of obvious symptoms such as known attack codes or signatures, or may be patterns that, to the experienced, mean possible attempts or successful intrusions.
In order to benefit from the information available in logs and from other monitoring techniques, you must understand the type of information available and how to obtain it. You must also understand what to do with it. Three types of information are useful:
- Activity logs
- System and network monitoring activity
- Vulnerability scans
System and Device Logging
Each operating system, device, and application may provide extensive logging activity. There are, however, decisions to be made about how much activity to record. The range of information that is logged by default varies, as does what is available to log, and there is no clear-cut answer on what should be logged. The answer depends on the activity and on the reason for logging.
NOTE When examining log files, it's important to understand what gets logged and what does not. This will vary by the type of log, the type of event, the operating system and product, whether or not there are additional things you can select, and the type of data. In addition, if you are looking for 'who' participated in the event or 'what' machine they were using, this may or may not be a part of the log. Windows event logs prior to Windows Server 2003, for example, did not include the IP address of the computer, just the hostname. And web server logs do not include exact information no matter which brand they are. Much web activity goes through a proxy server, so you may find that you know the network source but not the exact system it came from.
Determining What to Log
In general, the following questions must be answered:
- What is logged by default? This includes not just the typical security information, such as successful and unsuccessful logons or access to files, but also the actions of services and applications that run on the system.
- Where is the information logged? There may be several locations.
- Do logs grow indefinitely with the information added, or is log file size set? If the latter, what happens when the log file is full?
- What types of additional information can be logged? How is it turned on?
- When is specific logging activity desired? Are there specific items that are appropriate choices for some environments but not others? For some servers but not others? For servers but not desktop systems?
- Which logs should be archived and how long should archives be kept?
- How are logs protected from accidental or malicious change or tampering?
{mospagebreak title=A System and Device Log File Example (Windows)}
Not every operating system or application logs the same types of information. To know what to configure, where to find logs, and what information within the logs is useful requires knowledge of the specific system. However, looking at an example of the logs on one system is useful because it gives meaning to the types of questions that need to be asked. Windows and Unix logs are different, but for both I want to be able to identify who, what, when, where, and why. The following example discusses Windows logs.
NOTE Performing a security evaluation or audit on one operation system can be daunting. Imagine the situation when one operating system hosts another. Today's mainframe systems often do just that, hosting Unix or Linux. For insight into auditing such a system, see the paper "Auditing Unix System services in OS/390" at http://www-1.ibm.com/servers/eserver/zseries/zos/racf/pdf/toronto_03_
Windows audit logging for NT, XP, and Windows 2000 is turned entirely off by default. (Log activity is collected for some services, such as IIS, and system and application events are logged.)
Windows Server 2003 has some audit logging turned on by default, and those settings are shown in Figure 8-1. An administrator can turn on security logging for all or some of the categories and can set additional security logging by directly specifying object access in the registry, in a directory, and in the file system. It"s even possible to set auditing requirements for all servers and desktops in a Windows 2000 or Windows Server 2003 domain using Group Policy (a native configuration, security, application installation, and script repository utility).
FIGURE 8-1 Windows security audit policy
(Windows Server 2003 default)
Even when using Windows Server 2003, it's important to understand what to set because the Windows Server 2003 default policy logs the bare minimum activity. Needless to say, turning on all logging categories is not appropriate either. For example, in Windows security auditing, the category Audit Process Tracking would be inappropriate for most production systems because it records every bit of activity for every process — way too much information for normal drive configurations and audit log review. However, in a development environment, or when vetting custom software to determine that it only does what it says it does, turning on Audit Process Tracking may provide just the amount of information necessary for developers troubleshooting code or analysts inspecting it.
Audit events are logged to a special local security event log on every Windows NT (and above) computer that is configured to audit security events. Event logs are located in the %windir%system32config folder. In addition to security events, many other events that may provide security or activity tracking information are logged to the application log, the system log, or, on a Windows 2000 and above domain controller, the DNS Server log, Directory Service log, or File Replication Service log. These logs are shown in Figure 8-2. In addition, many processes offer additional logging capabilities. For example, if the DHCP service is installed, it, too, can be configured to log additional information such as when it leases an address, whether it is authorized in the domain, and whether another DHCP server is found on the network. These events are not logged in the security event log; instead, DHCP events are logged to %windir%system32dhcp.
FIGURE 8-2 Windows Server 2003 domain event logs
Many services and applications typically can have additional logging activity turned on, and that activity is logged either to the Windows event logs, to system or application logs, or to special logs that the service or application creates. IIS follows this pattern, as do Microsoft server applications such as Exchange, SQL Server, and ISA Server. The wise systems administrator, and auditor, will determine what is running on systems in the Windows network and what logging capabilities are available for each of them. While much log information relates only to system or application operation, it may become part of a forensics investigation if it is necessary or warranted to reconstruct activity. A journal should be kept that includes what information is being logged on each system and where it is recorded.
Many of the special application logs are basic text files, but the special 'event logs' are not. These files have their own format and access to them can be managed. While any application can be programmed to record events to these log files, events cannot be modified or deleted within the logs.
NOTE Some time ago, a utility was developed to delete an event from the security log, but when it was used, log files were corrupted. This provided evidence that an attack had occurred, at least.
Event logs do not automatically archive themselves, must be given a size, and may be configured, as shown in Figure 8-3, to overwrite old events, halt logging until manually cleared, or in Security Options, stop the system when the log file is full. Best practices advise creating a large log file and allowing events to be overwritten, but monitoring the fullness of files and archiving frequently so that no records are lost.
FIGURE 8-3 Log file configuration
Auditable events produce one or more records in the security log. Each record includes event-dependent information. While all events include an event ID, a brief description of the event and the event date, time, source, category, user, type, and computer, other information is dependent on the event type. Figure 8-4 shows the successful Administrator account local logon to the domain controller. Note the inclusion of the Client IP address, represented in Figure 8-4 as the local address.
FIGURE 8-4 Viewing an event
Log File Summarization and Reporting
Early security and systems administrator advice emphasizes that logs must be reviewed on a daily basis and assumes that there is time to do so. We now know that except in unusual circumstances that does not happen. Today's best practice advises that the following actions be taken:
- Post log data to external server.
- Consolidate logs to a central source.
- Apply filters or queries to produce meaningful results.
Posting log data to an external server helps to protect the log data. If a server is compromised, attackers cannot modify the local logs and cover their tracks. Consolidating logs to a central source makes the data easier to mange — queries only need to be run on one batch of data. The Unix utility syslog, when utilized, enables posting and consolidation of log data to a central syslog server. A version of syslog is available for Windows.
The downside, of course, is that network problems may prevent events from being posted, and a successful attack on the syslog server can destroy or call into question the validity of security events for an entire network.
Four other techniques for log consolidation are listed here:
- Collect copies of security event logs on a regular basics and archive them in a SQL database such as Microsoft SQL Server, and then develop SQL queries to make reports or use a product such as Microsoft's LogParser to directly query this database or any log type.
- Invest in a third-party security management tool that collects and analyzes specific types of log data. Examples of such tools are Microsoft's MOM (Windows) and NetIQ.
- Develop a Security Information Management (SIM) system or an integrated collection of software that attempts to pull all log data from all sources — security logs, web server logs, IDS logs and so forth — for example, Guardnet's neuSECURE, netForensics, or Itellitatics' Network Security Manager (NSM).
- Use or add the log management capabilities of systems management tools such as IBM's Tivoli or Enterasys Dragon.
Choosing a Consolidator
Choosing a log consolidator, or creating one, can be a study in frustration and exasperation. Products in this space are new, expensive, and painful to integrate into your environment. Answering the following questions may help you determine what's best for you:
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).
{mospagebreak title=System and Network Activity Monitoring}
In addition to log data, system activity and activity on the network can alert the knowledgeable administrator to potential problems. Just as systems and networks should be monitored so that repairs to critical systems and bottlenecks in performance can be investigated and resolved, knowledge of these same activities can mean that all is well, or that an attack is underway. Is that system unreachable due to a hard disk crash? Or the result of a denial of service attack? Why today is there a sudden surge in packets from a network that is too busy?
Some SIM tools seek also to provide a picture of network activity, and many management tools report on system activity. In addition, IDS systems, as described in Chapter 14, and protocol analyzers can provide access to the content of frames on the network.
Vulnerability Scanning
No security toolkit is complete without its contingent of vulnerability scanners. These tools provide an audit of currently available systems against well-known configuration weaknesses, system vulnerabilities, and patch levels. They can be comprehensive, such as Retina Network Security Scanner; they can be operating system-specific, such as Microsoft's Security Baseline Analyzer or the Center for Internet Securities' scanners for Windows, Cisco, Solaris, and other systems; or they can be uniquely fixed on a single vulnerability or service such as eEye's Digital Securities Retina SQL Sapphire Worm tool. They may be incredibly automated, requiring a simple start command, or may require sophisticated knowledge or the completion of a long list of activities.
NASA Improves Security
Federal government offices have been notoriously lax in promoting and implementing sound security practices. The efforts of the National Aeronautics and Space Administration (NASA), however, prove how use of a simple, manual vulnerability scan can improve information security. The NASA CIO used known vulnerability lists and made a list of 50 of the most serious ones. The CIO deployed third-party products that tested NASA systems for these vulnerabilities in the summer of 1999. After scans, systems administrators were informed of any weaknesses in their systems and informed how to fix them. The goal? Fewer than one listed vulnerability per four computers scanned (or 0.25 vulnerabilities per scanned system). Initial scans did not meet this rate, but improvement was noted every quarter. The list was updated and scanning continued. By the end of the fiscal year 2001, the ratio was 0.097. NASA had exceeded its own goal.
The use of a vulnerability scanner can improve the security posture of a network. The interesting thing about this operation is that NASA concentrated on top vulnerabilities, rather than 'all' vulnerabilities. This made the project manageable, but also was a sound decision, because it's documentable that a small percentage of vulnerabilities is responsible for most successful intrusions.
Before using a vulnerability scanner, or commissioning such a scan, care should be taken to understand what the potential results will show. Even simple, single-vulnerability scanners may stop short of identifying vulnerabilities. They may, instead, simply indicate that the specific vulnerable service is running on a machine. More complex scans can produce reports that are hundreds of pages long. What do all the entries mean? Some of them may be false positives, some may require advanced technical knowledge to understand or mitigate, and still others may be vulnerabilities that you can do nothing about. For example, running a web server does make you more vulnerable to attack than if you don't run one, but if the web server is critical to the functioning of your organization, then it's a risk you agree to take.
While vulnerability scanning products vary, it's important to note that a basic vulnerability assessment and mitigation does not require fancy tools or expensive consultants. Free and low-cost tools are available, and many free sources of vulnerability lists exist. Operating system-specific lists are available on the Internet from operating system vendors.
The use of a freely downloadable "Self-Assessment Guide for Information Technology Systems" from the National Institute of Standards and Technologies is specified for all government offices. While some of the specifics of this guide may only be applicable to government offices, much of the advice is useful for any organization; and the document provides a questionnaire format that, like an auditor's worksheets, may assist even the information security neophyte in performing an assessment. Items in the questionnaire cover such issues as risk management, security controls, IT life cycle, system security plan, personnel security, physical and environmental protection, input and output controls, contingency planning, hardware and software maintenance, data integrity, documentation, security awareness training, incident response capability, identification and authentication, logical access controls, and audit trails.
The security management architecture of your network is important because it reinforces, controls, and makes whole the rest of your security framework. If security management is not properly controlled, it obviates all of the data and transaction controls placed elsewhere in the system. Security management controls span acceptable use enforcement, administrative security, accountability controls, logging, and audit — a range of activities that has an impact on the entire network infrastructure.
Remember: this chapter is from Network Security: The Complete Reference, by Mark Rhodes-Ousley, Roberta Bragg and Keith Strassberg (McGraw-Hill/Osborne, ISBN 0-072-22697-8, 2003).

subset: commoncrawl


text:
Stulz Golf Tri-Edge 80 Series .350 Wood Shaft:
Stulz Golf's high-tech Tri-Edge shaft design conforms to USGA rules and incorporates carbon nanotube material to ensure consistency, uniformity and strength. The unique triangular shape of the lower end of the shaft improves stability and energy transfer at impact. The three edges also reduce vibration and clubhead twisting to further promote solid contact.


text:
Growing the next generation
A lot has been written lately about the shortage of candidates for positions in the process control field and how we're going to grow the next generation of process control engineers and technicians. As with a lot of other careers, companies have grown accustomed to being able to pick and choose between candidates in recent years. That is coming to an end as more and more of my contemporaries finally decide to retire and as more and more of the installed base of control systems become terminally obsolete. Corporations have also gotten used to doing more with fewer people. The problem is that those they kept have their hands full just keeping things running. There's no time to teach new people how to do the work.
We'd like to believe that if we just hire from the right engineering disciplines that we won't have to train, but the reality is that the curricula in our universities do not teach much of what's needed in the practical application of process control to a single discipline. Chemical engineering grads have been exposed to process design, so they have the tools to do some of the work, but if they've been exposed to process control, it is generally a theoretical approach. If the ChEs have been exposed to the electrical engineering curriculum, it amounts to just that, exposure. Electrical engineering grads are to some degree even more disadvantaged because if they've taken a controls course, it has focused on servo control and again the theoretical approach of Laplace transforms and Bode plots. The EE grads often have the added disadvantage of very little exposure to industrial processes. They may or may not get exposed to high voltage devices, thermodynamics, and fluid mechanics, though they may take survey courses of these topics. Mechanical engineers are in a similar boat as EEs since they may or may not get any process engineering along with their courses in fluids and thermodynamics and will have only taken an EE survey course and a freshman chemistry course.
Being a mechanical engineer, I had to learn how to design control circuits properly including motor control circuits. That included understanding issues around proper grounding techniques, which became even more problematic with the early DDC and DCSs because of their sensitivity to noise. I also had to learn proper methodology for installing instrument impulse lines, something no conventional curriculum teaches, nor do they teach how to select measuring devices. Which curriculum teaches you why you should always start large fans against a closed damper? Which teaches you why the pressure and flow measurements in the boiler's main steam line should always come off the side of the pipe? Which teaches the advantage of a thermocouple over an RTD that has nothing to do with accuracy or range? (Hint: which one can be "fixed" with a hammer at 2:00 am?) Which teaches the design of failsafe circuits? These are the kinds of things that I mean when I speak of the practical application of process control. Such things can only be taught effectively on the job and, in some cases, through direct experience of what happens when you do it wrong.
So, what are your arcane bits practical process controls that you've learned over the years? What do you think is the best way to impart those gems of knowledge to the next generation? How can you convince your company that they have to train new grads on more than the company culture and HR policies?
This post was written by Bruce Brandt, PE. Bruce is the DeltaV technology leader at MAVERICK Technologies, a leading system integrator providing industrial automation, operational support, and control systems engineering services in the manufacturing and process industries. MAVERICK delivers expertise and consulting in a wide variety of areas including industrial automation controls, distributed control systems, manufacturing execution systems, operational strategy, and business process optimization. The company provides a full range of automation and controls services – ranging from PID controller tuning and HMI programming to serving as a main automation contractor. Additionally MAVERICK offers industrial and technical staffing services, placing on-site automation, instrumentation and controls engineers.


text:
- Social:
- Contact:
- firstname.lastname@example.com
- 310-581-5880
- Website
Host, Art Talk
Since 1988, Edward Goldman has been the host of KCRW's weekly art review, Art Talk. Both fearless and fun, Edward offers a unique "accent" on art. Formerly employed by the famed Hermitage Museum in St. Petersburg, Russia, and a favorite on-air presence, he offers impassioned views on what he sees in the galleries and museums and at events throughout the world, and he isn't afraid to "speak truth to power."
From 1998-1999, Goldman served as Arts and Culture Editor for Life & Times Tonight on KCET, the LA-based public television station.
In 2005, he began teaching a seminar on art collecting at Otis College of Art and Design. Due to popular demand, that seminar evolved into an ongoing series Goldman calls his "art gypsy caravan." The New York Times featured his class in an article titled The (Art) World According to Edward Goldman (March 28, 2007). More recently, Private Eye: Edward Goldman was featured in Artillery Magazine. (July, 2014)
Goldman also contributes articles to numerous art publications, including a weekly Huffington Post feature based on his radio reviews and recommendations, and serves as a panelist, moderator and speaker for various museums and arts organizations.
An essay by Edward Goldman was published in The Beat and the Buzz: Inside the L.A. Art World, edited by Richard Hertz (Ojai, California: Minneola Press: 2009)


text:
There are however some minor disadvantages, nothing that should discourage the use of latex, more the need for a little common sense and preparation. Before applying latex to the body it is necessary to patch-test a small area of the skin to check for any allergic reactions. It is quite rare, most people are not allergic to latex, but a small percentage of users have reported skin irritation after coming into contact with this kind of body paint.
On occasions where liquid latex has been applied to the skin over hair it can be both difficult and painful to remove. Wet latex will bond permanently to hair as it does to fabric. The only way to remove latex with hair stuck to it is to pull it off, which of course also rips the hair off the skin. Anyone who has experienced body waxing will be familiar with the level of discomfort. The best preparation when applying liquid latex is to first remove hair from areas of the body to be painted. However, it is not always necessary as liquid latex can be removed from moderate amounts of body hair with little effort and minimum discomfort. Body hair may also be trimmed very short instead of shaving.
When buying liquid latex it is important to read the label and avoid any brand that does not specify 'for cosmetic use' or 'suitable for use as body paint'. Liquid latex is used in many other industries and you need to make sure you buy latex that does not contain toxic chemicals. Purchasing from a reputable body paint supplier is the safest way to ensure you're getting non-toxic latex suitable for skin application.
For the reasons stated above, children should be supervised by a responsible adult at all times when using this type of body paint.


text:
It was late in the afternoon of July 7, 1893, when the eastbound train slowly went out of sight and all that remained was black smoke in the distance. As the train disappeared, a lone horseman rode west along the tracks toward the station.
In an overly warm room of the train depot eight men sat discussing the topics of the day, as they did a few times every week. The main topic this day started out with the collapse of the price of silver. As a bottle was passed around however, the talking became more heated. Uncle John, the oldest of the men, raised his voice and said, "Back in the tough and tumble days I was hired to protect the Wells Fargo Express Company somewhere in Wyoming and the first time out I killed three stage robbers. Now its time I leave this civilized town of Mancos and go where I can slap my eyes on train robbers, draw my six-shooter and convince them they chose the wrong way of life."
Young Ed Caviness smiled and asked, "Didn't you find killing off bandits a rather risky way to live?"
"Naw, all I needed to do was to get them to look me in the eye and I would commence."
Uncle John's comment was cut short when a stranger walked into the room. He was dressed like a cowboy with a long overcoat. In addition he had a large sock drawn over his head that concealed the features of his face. He held a six-shooter in each hand and calmly said, "Throw up your hands and be quick about it."
Uncle John had obviously not caught the stranger's eye because his hands went up as quickly as the seven other men. The calm highwayman then pointed to Henry Sprague, dressed like a station manager, and said, "Open that safe, Mr. Agent." Then, pointing to Ed Caviness he said, "Take this bag and put all of the money in it."
At that point a salesman, who had come in on the eastbound train and had walked over to the section house looking for a hotel, made the mistake of walking into the room. The bandit said, "You're just in time, mister. Get in line and raise your hands. Now, agent man hand me that bag."
It quickly became obvious the robber was not satisfied for he said, "Turn your pockets inside out. And you", pointing to young Ed Caviness, "put the boodle in this here bag." With the bag in hand, the stranger backed out the door and as he did so said, "Don't even think about lowering your hands for two minutes."
The nine men couldn't hear a sound and decided to lower their hands and check to see where the calm bandit had gone.
Back in the room strode the stranger, who said rather loudly, "I told you to keep your hands in the air for two minutes. Don't any of you make the same mistake again." Nearly two minutes went by before the men heard the clatter of hoofs off to the east.
The aftermath of this Mancos Times-reported heist will come next week.


text:
In questa pagina è possibile cercare per università, college e scuole di business in Taiwan. Potete facilmente trovare tutte le informazioni sulle migliori università classifica in Taiwan. Clicca su "Leggi tutto " per una descrizione dettagliata delle università e una panoramica dei programmi di studio offerti.
Trova università in Taiwan e navigare attraverso i loro programmi per trovare quelli che si adattano meglio. Tutte le informazioni sulle varie opzioni di studio in Taiwan e confrontare le tasse di iscrizione e la durata dello studio. È possibile risparmiare tempo e le università di contatto in Taiwan direttamente: compilare il "Richiesta informazioni gratuite " la forma, che vi metterà in contatto con l'ufficio di ammissione.
Avviare la ricerca per la vostra formazione futuro subito!
Be a leader. Build productive and compassionate organizations. Be a force for positive change in the world.
The University's students and faculty are among the most excellent in the nation, and its motto of "Integrity, Diligence, Fidelity, and Compassion" have served as the bedrock in its pursuit of educational, research, as well as administrative excellence.
Over the past 40 years, Rotterdam School of Management, Erasmus University has firmly established its reputation as one of Europe's leading business schools.
As Taiwan's top international university, MCU welcomes students from all over the world. Whether you are interested in pursuing a degree in Communications, Design, Management, Technology, Languages, Law, or Tourism, MCU offers a unique world class educational experience. Here, we believe in building creative and innovative global citizens who are ready to become world leaders of tomorrow.
Located in Chiayi, Taiwan, Nanhua University was founded in 1996 by Venerable Master Hsing Yun. Through the support of millions of Fo Guang Shan worshippers, the first comprehensive university of Fo Guang Shan was funded. The school is also a member of "Fo Guang Shan's Associated Universities," the country's first cross-nation university system. Currently, the school has about 5,200 students and a strong faculty of 220 full-time teachers. The proportion of assistant profess… [+] ors to full-time teachers above is more than 96%, and the proportion of doctorates among them is 91%, which means the school ranks among the top private universities.
Embracing the philosophy of holistic education, we are dedicated to cultivating students' practical skills. Currently, we have three colleges which are the Colleges of Finance, Management and Informatics, four graduate schools, 12 departments, 1 departmental team (1系組) and 1 degree program. Additionally, we established an on-the-job Master program in 2010. In order to enhance the quality of our teaching staff, professors such as Lee Chia-Tung, Chen Ming-Zhang, Chen Guang… [+] -Xian, Xu Sheng-Hsiung, Lin Wei-Yi, Pan Zhao-Xian, Luo Neng-Qing, Hua Ming-Shu, Chen Wen-Xian have been recruited.
CTBC Financial Management College equips students with international financial knowledge in theory and practice, and to develop the characters of becoming future international financial experts.
The College of Management will be recognized as one of the preeminent private business schools in Taiwan. Our primary goal is to encourage faculty and students in areas of innovation, excellence in teaching, research, and service. Our students will be capable of responding to a changing environment in an ethical, professional and sustainable manner.
At English Training Lounge we understand that the modern world does not stop simply because we need it to! This is why ETL offers an English language school that is as flexible as you need it to be. We deliver English language training at a time and location of your choosing! We are not a 9 to 5 English as a second school because we know that life is 24 hours a day, 7 days a week.
AUIA International Summer School is a professional platform collaborating with universities, providing quality summer credit program in English. Established in 2011, AUIA currently works with National Taiwan University of Science and Technology (NTUST) in Taipei, Hankuk University of Foreign Studies (HUFS) in Seoul.
Since 1895, National Taipei University of Education is the cradle of training elementary school teachers.
Tunghai University was established in 1955 and it is located on the level plateau of Taichung's Tatu Mountain. Tunghai University, a liberal institution is full of scholarly elites and abundant resources and is well-known for its beautiful campus. Tunghai has 9 colleges, 34 departments and 35 Master's programs (1 independent Master's program and 13 In-Service Master's programs) and 14 PhD programs.
The first public University founded after Taiwan's economic boom in the 1980′s, National Chung Cheng University broke ground after the Executive Yuan passed the plan to build the university in 1986 in honor of the late president CHIANG Kai-Shek and to develop higher education in the Yun-lin, Chia-yi, and Tainan areas.
Chang Jung Christian University (CJCU) is a private university located in southern Taiwan. Affiliated with the Presbyterian Church in Taiwan, CJCU is committed to developing the God-given gifts and abilities of each student within a culture of love, respect, and service.
National Central University was originally founded in Nanjing, China in 1915. NCU had later developed into a renowned academic institution with comprehensive programs and outstanding faculty, enjoying a high reputation equal to that of Peking University. In 1962, the Graduate Institute of Geophysics was founded in Miaoli, Taiwan as the re-establishment of the University. The campus was relocated to Zhongli in 1968, and today it has become a home to more than thirteen thousand… [+] students and teachers.
Welcome to Shih Chien University College of Management, "the College of Management for Business". USC is increasingly recognised as one of the pioneer schools in Taiwan with English Taught Programme (ETP). We offer International Business in Undergraduate and Postgraduate degrees at an excellent international standard for the development and teaching that are highly relevant to your future career needs...
Jinwen University of Science and Technology (JUST) was originally established and named as Jin-Wen College in 1980.
National Tsing Hua University was established in Beijing in 1911 as "Tsing Hua Academy." In 1956, National Tsing Hua University was re-established at its present location in Hsinchu, Taiwan.
Established in 1927, National Chengchi University (NCCU) is noted for its humanities and social sciences disciplines and currently housing 9 colleges, including liberal arts, science, social sciences, law, commerce, foreign languages & literature, communication, international affairs and education;
In 2010, the College was one of the only two business colleges in Taiwan to receive a two-year "professional business school" project grant from the MOE.Currently, the College of Management has around 70 full-time faculties and 25 administrative staff and offers a comprehensive array of BBA, MBA, MS, PhD, and EMBA programs to about 2,500 students.
National Sun Yat-sen University (NSYSU) was founded in 1980 in Kaohsiung and became one of the fastest growing universities in Taiwan and in Asia. NSYSU has endeavored to pursue excellence in teaching and research
STUST was founded in 1969. As of the 2007 academic year, we have a total of four colleges—College of Engineering, College of Business, College of Digital Design, College of Humanities and Social Sciences—25 departments, 11 graduate institutes (which offer 12 Master's programs and 3 doctoral programs), 4 teaching centers and 18 research centers. STUST has over 800 faculty members, and we currently have approximately 18,000 students enrolled, of which over 170 are international stu… [+] dents. Our campus is located in the north-eastern suburb of Tainan City on an area of 16 hectares. To our west is Tainan City, and to our east is Yung-Kang City. Our campus is less than 4 km from Tainan's Railway Station. Our school is truly located in an area with the beauty of the countryside and the convenience of metropolitan life.
The College of Commerce at National Chengchi University (CNCCU) is highly regarded nationally and internationally as the best business school in Taiwan. Our reputation is based on the cabliber of our academics and students.


text:
The potential of these new technologies is enormous. Accenture research reveals that by 2035, AI will double economic growth rates in 12 developed countries and boost labor productivity by up to 40 percent1.
More and more companies are harnessing the power of these new technologies today. Take "chatbots," for example. A wide and growing range of special purpose intelligent bots are driving a shift in how products and services are designed, delivered and consumed.
We're seeing companies use them to engage with both established and potential customers via messaging platforms, enabling in-message purchases and other calls to action as they do so. And within the business itself, bots are being deployed to bring unprecedented operational efficiencies by augmenting human capabilities.
A chatbot is a digital service that can hold natural sounding conversations with human beings with the aim of accomplishing particular tasks, such as answering questions or enabling product purchases. Powered by a set of simple rules and varying degrees of AI, these bots converse with real people via messaging apps such as Facebook Messenger and Telegram.
And those conversations—and the platforms which support them—are now key for consumers. Not so long ago, mobile applications and social media presence were the must-have capabilities for any forward-looking brand. But texting has continued to be a staple of mobile communication. And now consumers, and younger age groups in particular, are rapidly switching their attention to messaging platforms.
Messaging apps now have the largest numbers of active users, having overtaken social media apps in 2015. For example, Facebook Messenger has a one billion strong user base, while Telegram's is already over 100 million (worldwide, over 50 million people spend an average 50 minutes a day on messenger apps2). Able to exploit the network effects of their platforms, these apps have far better retention, too: Twelve months after download, they show a retention rate almost six times higher than the average for apps3.
As fewer and fewer other types of app are downloaded—nearly three quarters of all smartphone users download fewer than three apps each month, and almost half download nothing at all—brands are coming to realize that the app business is a tough business. The good news? The consumer shift towards messaging platforms, and the new functionality those platforms are offering, can present extraordinary new opportunities for business. And chatbots are going to be an essential component in exploiting them.
We know that nine out of 10 consumers globally want to use messaging to interact with businesses.4 And in customer support, as the telephone loses its primacy as the preferred channel of communication, mobile apps, social media and web chats are taking over. This shift points to an explosion in the global market for chatbots. Already estimated at over US$1 billion, the market is forecast to be worth US$1.86 billion by 2020 and is set to triple in size in a decade.5
Few sectors stand to benefit so much from chatbots as the travel industry. Faced with unprecedented competition from traditional rivals and disruptive new entrants, airlines, airports and hospitality companies urgently need to grow their business across a shifting and increasingly demanding (and connected) customer base. To stand out from the crowd, they also need to provide excellent customer service.
Chatbots can bring travel companies game-changing opportunities for rethinking the passenger experience and developing new channels of customer interaction in three key areas:
The travel experience can be very stressful. Of course, parts of the journey are enjoyable, but certain stages can be the exact opposite.
Late for their flight, an airline customer needs to know how long they'll have to queue to pass through security. Arriving at their destination, they're unsure where to change money, pick up a taxi or meet their driver.
Or at the hotel, they're finding it hard to locate the best neighborhood restaurants, or access certain in-room services. At every point, chatbots can be used to minimize stress. Because most people already have a messaging app downloaded on their smartphone, they're close at hand. And they're available 24/7. There's no need to make a call and wait in line for customer service.
Customers are become increasingly demanding.
They expect their travel company to be instantly available in all the micro-moments that matter throughout their journey. And if they're not, they quickly become frustrated. If that means responding to a query at 3 a.m., it's obviously much more efficient for the travel company to do so via a chatbots, rather through a 24/7 call-center.
By using chatbots, companies can extend their footprint across the traveler's journey.
With open APIs, it's easy to create a vertical platform for linking to additional services (Airbnb or Uber, for example) from a vertical platform.
Accenture is already working with its partners in the industry to leverage the opportunities that chatbots offer. A great example is Carla, a Facebook Messenger chatbot that we developed recently for Avianca Airlines.
The watchword for any company planning to introducing chatbots is relevance. This technology is truly breakthrough in the range of opportunities it creates, but if chatbots aren't providing customers with relevant conversations, their usefulness is rapidly destroyed (and customers will simply delete them).
Get it right, however, and the benefits soon accumulate. We know from recent Facebook IQ research that the convenience of chatbots brings customers closer. On top of that, messaging makes commerce personal. When questioned, 63 percent of people say being able to chat with a business make them feel more positive about the relationship. Fifty-five percent of them are more likely to trust the business as a result.6
The key to chatbot success? Concentrate on one core functionality and make sure the chatbot can do it really well. With Carla, the focus from the outset was on domestic flights. Developed in just six weeks, Carla has six core functionalities: domestic check-ins, itinerary checking, flight status checks, weather, simple translations and user reminders.
All of them make the domestic travel experience less stressful and more seamless.
Carla makes Avianca's customers' lives easier by focusing on their most common needs. Speaking with Carla feels like a natural conversation, and tasks can be achieved quickly and seamlessly without the need to download a proprietary app. For passengers who, for example, find the airline check-in process frustrating, Carla offers a simple and natural way of receiving a boarding pass via a quick conversation over a familiar messaging platform.
In this way Avianca is using Carla to delight its customers at a lower cost and with minimum effort from its customer relations teams. Avoiding the challenge of attempting to persuade customers to download a corporate app, it takes advantage of the pre-installed Facebook Messenger apps that are so commonplace. And, once in use, it keeps on getting better. A complex dashboard measures all interactions and uses findings to improve conversations.
Helping to improve the customer experience and boost loyalty, Carla will be one of the company's key differentiators as it positions itself as an innovative airline in the Latin American market.
Chatbot services have enormous potential. But, as with any new technology, companies need to carefully consider what implementation challenges might lie ahead. Here are five proposed principles to keep in mind in getting started:
Don't get lost in the crowd. As the number of chatbots is set to explode, how do you ensure yours stands out? What are the discoverability issues? What makes your service essential compared with your competitors?
Don't misunderstand your customers. Ensuring simple interactions and simple tasks are completed seamlessly is critical. Customers will quickly turn away from chatbots that can't comprehend straightforward questions. But even the most advanced chatbots will encounter some complex scenarios they won't be able to handle. What are your fallback procedures when this happens? How quickly can you shift customers to a human interaction?
Keep it simple. Completing a task through a chatbot inevitably requires greater effort from your customers than simply clicking or tapping through a menu on a website or app. So, chatbot interactions need to be as efficient, short and painless as possible. New user experiences will be required.
Keep it consistent. Customers expect a seamless experience across all communication channels. A chatbot service needs to be fully integrated into your mobile and web services. What dependencies does your chatbot service have? What new communication paths and protocols need to be established?
Keep it secure. As with all customer-facing technologies, privacy and security are critical. Customers won't use services they don't trust with their data. Security issues should be front of mind from the outset.
Of course, the rise of chatbots isn't limited to travel companies. Their disruptive power is set to be seen more widely across all industries. There are three areas in particular where businesses can feel the impact of chatbots:
Customer interactions at twice the speed and a fraction of the cost
Companies are under pressure to reduce the cost of customer service. Labor currently makes up nearly two thirds of the total costs of call center operations. And with high staff turnover bringing additional expenses, enterprises are looking for solutions to increase efficiency and reduce the volume of calls handled by their staff. Chatbot-based customer support has the potential to be almost twice as fast as voice-based support over the telephone. And it will come at a lower cost.
Helping your sales and marketing teams work faster and more effectively
Chatbots are beginning to impact sales teams and marketing campaigns. Take Kit, the business-facing virtual marketing assistant recently purchased by Shopify. It leverages messaging platforms to help companies market their online stores. It's capable of sending email campaigns, posting updates, and running ads on platforms like Facebook and Instagram.
GrowthBot is another example. It's a sales and marketing chatbot that professionals can interact with on Slack and Facebook Messenger, as well as through SMS and social media. It uses Wit.ai's natural language technology to answer general questions about people, brands and technologies, and connects to tools like HubSpot and Google Analytics to reply to web-traffic queries and other business-specific questions.
Automating business operations for visible efficiency gains
Business functions are also set to be disrupted in the chatbot age. Wanda is a digital assistant from enterprise software-maker Unit4 which can complete timesheets and edit other basic paperwork. It can be programmed to carry out multiple follow-on tasks triggered by any event. So, for example, a request for leave submitted by an employee can trigger a calendar invitation to a meeting with a line manager.
And Mya is an AI recruiting assistant from FirstJob which can automate up to 75 percent of a company's screening and qualifying processes. It engages with candidates over messaging platforms, asking contextual questions relating to job requirements, and offering personalized updates, feedback and next-step suggestions. Mya is estimated to improve recruiter efficiency by 38 percent and candidate engagement by 150 percent.
Remember, chatbots are still in their infancy. New capabilities and opportunities are sure to emerge. Some messaging platforms already offer voice recognition, in-message purchases and other functionality. New chatbot marketing strategies will appear. And integration with connected home devices like Amazon Echo and Google Home, as well as other components in the IoT, won't be far away.
Using machine learning, we'll see more sophisticated chatbots developed that can learn about users, based on existing conversations and all the other data held on that individual within the business. An airline customer, for example, might ask about available flights to Madrid three months ahead. Nearer the likely travel date, the chatbots would use that information to initiate a relevant conversation and prompt a booking.
Exciting developments will also come from techniques enabling chatbots to "plug" augmented reality into the conversation. A traveler making a hotel booking, for instance, could use this to inspect rooms before making their selection. Or once at the hotel, they could use this application to explore the neighborhood and check out local restaurants.
The Accenture Mobile Apps Studios are part of a network of design studios to help clients develop and deliver disruptive innovations, and to scale them faster.
In a co-located studio environment, clients have access to the latest technologies and can use the established processes, tools and infrastructure needed to rapidly ideate, design and prototype solutions ready for deployment.
In addition, Accenture's XaaS framework is a set of modular and intelligent business services that can be plugged into disparate back-end services. These components can be leveraged to develop a bot controller for dispatching messages and user requests between a messaging server and back-end business applications. The controller uses artificial intelligence and natural language processing to infer the meaning of user requests.
The proposition is vendor agnostic, so leading-edge solutions can be leveraged for both front-end messaging and back-end cognitive engines. The XaaS framework enables chatbot services to be easily integrated with other business services (location, notification, access management, for example). The solution offers faster time to market and can be configured for industry-specific requirements.
In this fast-moving technology landscape, decisions will be driven by a sense of experimentation, analysis and learning. The market is forming and will continue to evolve. There are still competitive advantages for companies agile enough to move quickly and capture them.
Accenture and Accenture Institute for High Performance, "Why Artificial Intelligence is the Future of Growth," 2016.
TechCrunch, "Users average 50 minutes per day on Facebook, Messenger and Instagram," 2016. https://techcrunch.com/2016/04/27/facediction/
BI Intelligence, "Messaging apps are now bigger than social networks," 2016. http://www.businessinsider.com/the-messaging-app-report-2015-11
TechCrunch, "Twilio study: most consumers now want to use messaging to interact with businesses," 2016. https://techcrunch.com/2016/09/12/twilio-study-most-consumers-now-want-to-use-messaging-to-interact-with-businesses/
Chatbot Insider, "Global Chatbots Market to Witness Exponential Growth by 2023", 2016. http://www.chatbotinsider.ai/industry-news/global-chatbots-market-witness-exponential-growth-2023/
facebook IQ, "More Than a Message: Messaging Means Business," 2016. https://insights.fb.com/2016/12/01/messaging-means-business/


text:
JCB has unveiled a host of new machines as it heads into 2008, expecting increased growth worldwide despite the current global credit crunch.
Chief operating officer Matthew Taylor said that although there was nervousness and uncertainty in the market and significant falls expected in the American construction sector, JCB's success in the emerging markets - particularly India and Russia - would see its figures grow in 2008, albeit at a slower rate than this year.
It built over 70,000 machines last year, a 30 per cent rise on 2006, which Mr Taylor said had outpaced the overall market increase by 18 per cent.
JCB unveiled new models across its range, from mini exc-ava-tors to telehandlers, as well as announcing its largest excavator yet, a 52 tonner that will appear in concept form at the Conexpo show in Las Vegas.
The JS520 is six tonnes bigger than its current flagship excavator and will enable the company to have a wider offering for the quarrying sector.
At the other end of the scale, it has launched new mini excavators, including the 2 t 8020, which it claims is the largest mini on the market that can be towed by a crew-cab vehicle. It is also producing its first 5.5 tonne machine, available in zero tailswing and reduced tailswing models, which it will shortly follow with a six tonner, the 8065.
According to compact products specialist Paul Hoptroff the six tonner will create a new weight class, with smaller dimensions than rivals.
He said: "It's a new size. None of the big manufacturers have anything in the six tonne bracket, they all start at seven tonnes, but I am willing to bet it will hold its own against any of the seven tonners."
JCB is shipping all the European mini excavators with a unique key linked to an electronic immobiliser.
Better manoeuvrability
A keypad ignition is available as an option for hire companies who don't want the hassle of lost keys.
JCB is claiming another major breakthrough with its HiViz Loadall range of telehandlers, which have seen the boom pivot point lowered and rear overhang cut by 90 mm for improved rear visibility. Axle angles have also been improved to increase the machines' manoeuvrability.
The company is pressing ahead with major expansions to keep pace with demand for heavy products.
The firm is opening a £7 million attachments factory in April and is hopeful that it will be able to start production of excavators at a new Uttoxeter factory later in the year. But it is currently wrangling with the planners over the redevelopment of its current factory in the middle of the town.
At the same time it is scaling up its New Delhi excavator factory to double production to fuel the Indian demand. Sales in India outpaced those in JCB's home UK market last year, with 17,000 machines. "I would like to see it top 20,000 this year," Mr Taylor said.
According to its India boss, Sandeep Singh, the phenomenal growth in the country has actually been constrained by supply of big machines.
He said: "The major growth in the future will come from the heavy line. Our factory workers are now volunteering to work six days a week to cope with the demand."
The next logical step is likely to be a factory for the burgeoning Russian market, where demand leapt 73 per cent last year. The prospect of JCB building in Russia itself is dependent on a number of factors, according to well-placed sources.


text:
You are hereHome ›
Narrow Search
Now showing results 1-3 of 3
This Flash-based interactive provides access to illustrations, visualizations, videos, and near-real time images of the Sun from a variety of NASA satellites. Learners can access this information to supplement other materials related to the Sun and... (View More) heliophysics. A scale tool with the size of the Earth is also presented with the solar images. (View Less)
Materials Cost: Free
This program uses NASA data and resources to promote authentic classroom research experiences. These two complementary guides lead students through the process of conducting their own inquiry-based research on an Earth-focused topic. In their... (View More) guidebook, students read content and answer questions about each step in the research process- from formulating a question to sharing results. The separate guide for teachers provides explicit instructions, lists the standards addressed, and includes additional hints, resources and websites. (View Less)
Math skills are applied throughout this investigation of windows. Starting with basic window shapes, students determine area and complete a cost analysis, then do the same for windows of unconventional shapes. Students will examine photographs taken... (View More) by astronauts through windows on the Space Shuttle and International Space Station to explore the inverse relationship between lens size and area covered. This lesson is part of the Expedition Earth and Beyond Education Program. (View Less)