text:
Business cases of the projects we have completed
Security assessment projects: audits and penetration tests
• Pentest of functionality of a cryptocurrency exchange
We were approached by a company that was planning to enter the promising cryptocurrency market. To accomplish this goal, the company had developed a cryptocurrency exchange web application. Before publishing the application on the Internet, the company decided to perform an information security audit, using penetration testing methods according to the OWASP methodology. They requested such a service from us.
The testing was conducted in "black box" mode: at the initial stage, the auditors had at their disposal only the URL of the application that was being tested.
In the course of the Pentest, the following actions that could be committed by attackers were identified and confirmed:
- Take advantage of the lack of input filtering in the 'meeting room' functionality and conduct an XSS attack on a user or administrator. This was successfully confirmed when the dialog was opened by the test victim (the user or the administrator to whom the message was transmitted). The script functionality can be anything. For example, hidden mining, a fake form of authentication, etc., up to complete control over the victim's computer.
- Take advantage of the flaws in the file upload functionality in the web application and access the server file system (ability to read, upload, delete files), execute arbitrary commands on the server, execute SQL queries, make connections from the server interface to other systems, i.e. the attacker gains complete control over the server and the data can be completely compromised.
- After gaining control over the server, take advantage of the drawbacks of cryptographic protection. In particular, the lack of control over the integrity of transaction data in the application, and make changes to the account balance.
- Bypass the check when sending messages and impersonate another user or administrator, thus mislead the victim and commit fraudulent actions.
- Identify registered users.
- Attack user passwords.
- Receive unauthorized access to files that other users have downloaded.
The customer received an exhaustive report on vulnerabilities and how to fix them. After the elimination of vulnerabilities, the auditors verified the elimination of deficiencies discovered earlier. And only after this web application was published on the Internet.
Thus, the audit using penetration testing methods saved the customer from possible reputational and financial losses.
• Network pentest for a nationwide pharmacy network
A nationwide pharmacy network ordered an external pentest of their computer network. Black box mode was chosen.
During the project, it was discovered that all critical IT infrastructure was behind the firewall. It seemed, there were no chances to penetrate. Then we decided to check points of sales and checked several drugstores. One of them had a Mikrotik router with default password. This type of routers has blank default passwords, so the router was "compromised". It had OpenVPN, locally stored certificates, and allowed sniffing. We intercepted traffic and found confidential information of the sales and accounting system. Then we extracted certificates from the compromised router, made a fake point of sale, and connected to the VPN server. We impersonated ourselves as an ordinary drugstore. This way we penetrated the internal IT infrastructure of the customer that was protected by the firewall and seemed impenetrable. We explored the Active Directory network, found SQL server with domain authentication and penetrated it using a password that had been extracted by mimikatz utility before.
The project was completed with the conclusion that the penetration is possible, and the customer's information security level is low. The customer received risk assessment results, information about the vulnerabilities, and recommendations on how to remediate them and harden the IT infrastructure.
• Grey-box and white-box pentest for a telecom company
A mid-sized telecommunication company motivated to comply with external security requirements requested the implementation of the complex information security system and overall security assessment. The customer chose a grey box and white box as the penetration testing modes. Target object of the pentest were external servers, DMZ, web applications, and internal nodes of the local area network. During the project, the following vulnerabilities and drawbacks were discovered:
- Network configuration errors, lack of segmentation (lack of separate VLAN for management interfaces iLO, IMPI, IP KVM, etc.).
- Weak passwords at the active network devices.
- Hidden resources were accessible (ADMIN$, C$, D$, etc.).
As a result of vulnerability exploitation, the documents containing confidential data were extracted. Thus, unauthorized access by an intruder was emulated. The customer received a comprehensive report about the vulnerabilities and their remediation methods.
• Internal pentest for a big industrial plant
A big industrial plant with about 10,000 employees needed an assessment of IT infrastructure compliance with security requirements. The plant ordered the penetration test in a grey box and white box modes. Local area network servers were chosen as the pentest target objects. During the project, the following vulnerabilities and weaknesses were found:
- Drawbacks in the event monitoring and security incident response processes (lack of measures to prevent intrusions, and recover from incidents).
- Drawbacks in configuration management (uncontrolled test and guest network hosts in the corporate domain).
- Drawbacks of access and privilege management (open login via ssh for the standard root account; single administrator account for DC, network equipment, and user workstation management).
- Other technical vulnerabilities (proxy auto-detection for software is enabled).
Unauthorized access of insiders was modeled during the project. The customer received the full report on vulnerabilities and how to eliminate them.
• Analysis of a retail company's infrastructure
A medium-sized retailer implemented internal and external information security requirements. Some of them required a complete analysis of the enterprise infrastructure, including penetration tests in the "grey box" and "white box" modes. During the pentest, the following vulnerabilities and weaknesses were found:
- Vulnerabilities in the web applications (no request validity checks in the applications, data transfer through unencrypted HTTP channel).
- Privilege management drawbacks (domain accounts for various services and applications had too high privileges).
- The possibility of e-mail forgery (no DKIM / DMARC signature systems on mail servers).
- Drawbacks in monitoring processes of security events (no "auditd" customization for events).
- The possibility of connection of unauthorized device to the network (DHCP snooping, no port security).
During the pentest, as a demonstration of vulnerability, unauthorized access to the network equipment was emulated. The customer received the full report on the vulnerabilities and the ways to eliminate them.
• The pentest for PCI DSS compliance in a financial organization
A small financial organization connected to the international payment systems Visa and Mastercard faced with the need to comply with the PCI DSS standard requirements. Among them, there is a requirement to perform an external and internal penetration test regularly. During the analysis of the infrastructure scope (cardholder data environment) the detailed parameters of the external pentest were agreed with the customer. The parameters included grey box and black box modes, and the list of target objects, namely, the Internet-facing services and Web applications.
As a result of the pentest, multiple vulnerabilities in the web applications were discovered (PHP injections, cross-site scripting, direct object references, missing software update mechanisms, insecure default Web server configurations, no access control on the functional level, buffer overflows, error in the web application code).
During the project, no real ways of penetration were found, but potential ways were present. The customer received a comprehensive report on the vulnerabilities and how to enhance the security of the infrastructure. The report was made in accordance with the requirements of PCI DSS, including the description of the penetration test methodology, which was used during the project.
Managed security and compliance: implementation of ISO 27001, TISAX, etc.
• Implementation of ISO 27001 in a medical software company
A small software company was faced with the requirements of its customers to be certified according to the ISO 27001 standard. Moreover, the certification body had to hold the highest international accreditation level of UKAS.
Previously, the company took only superficial measures and performed only occasional works related to information security, and only in the field of server and workstation protection. We immediately began working on the scope analysis and outlining the work plan of the initial audit and gap analysis. We performed this work for the client for free. After that, the company saw that we understand their problems, and can build realistic plans. Therefore, they signed a contract with us for an audit, gap analysis, and development of an implementation plan. In 3 weeks, we completed this work. The customer was once again convinced that our experience and speed exceeded their expectations.
After that, the customer concluded an agreement with us for the implementation of ISO 27001. In 6 months, we developed all the controls required by the standard, described them in 18 policies and procedures, implemented several security management registers, and conducted staff training. We paid particular attention to the secure software development life cycle.
Then the question of choosing an independent auditor arose. We recommended one of the largest German auditing firms to our client. We also contacted this auditor, held a discussion with them and prepared them for the certification of our client in advance. The client and the auditors signed an agreement for audit and certification.
During the audit, we defended our client and the information security management system that we built. The auditors made minor comments, as they usually do. We took those comments into account, made corrections, and in 2 weeks our client received an official certificate of ISO 27001 compliance.
To support the implemented system and confirm the certificate annually, the company subscribed to our 'Remote Security Manager' service.
Our client was also interested in our competency not only in security process management but also in IT security. The company ordered from us advanced services for application security, source code security analysis and penetration testing of their software products.
The company obtained the certificates of compliance with ISO 27001 and the successful passing of security assessment and published them on their website and in marketing materials. The company advertised its new status and gained significant competitive advantages, which increased the number of orders and sales.
• Implementation of ISO 27001 and TISAX in a company that develops automotive systems
A representative of the German automotive industry engaged in the development of on-board automotive systems contacted us to achieve urgently the compliance with ISO 27001 and the Trusted Information Security Assessment Exchange (TISAX). High competition in the market of automotive systems (security, piloting, navigation, entertainment systems, etc.) forces leading car manufacturers and their contractors (Volkswagen-Audi Group, Porsche, Daimler AG, BMW, Bosch, etc.) to force the launch of new products on the market while maintaining the level of quality, safety and security. This led to the high motivation of our client.
Before this, the client tried to fill out TISAX compliance forms, but the lack of the necessary competencies did not allow them even to begin the implementation process properly.
TISAX compliance, although built based on ISO 27001, has its specifics. For example, unlike an ISO 27001 audit, which can take several days, a TISAX auditor spends only one day at the customer's office. But then it takes about 3 months to collect the pieces of evidence for each security process. TISAX audit reporting implies a high degree of automation using modern GRC (Governance, Risk management, and Compliance) systems.
During the first 3 months after signing the contract with our client, we thoroughly studied their business processes and developed about 50 documents necessary for compliance with ISO 27001 and TISAX. During the implementation and audit reporting, we used Redmine and Goriscon systems.
In total, from the start of the project until the day they received the TISAX compliance label, 6 months of intense collaboration between our consultants and our client's employees have passed. We conducted several training sessions, performed a series of server and application security assessments, strengthened network security, system life cycle security, implemented risk management, security key performance indicators (KPI), change and incident management processes, etc.
The implemented processes, operations and security systems must be constantly maintained not to lose effectiveness, and therefore our client ordered the 'Remote Information Security Manager' service from us. We continued to conduct regular training sessions with our client, monitor information security events, respond to security incidents, perform quarterly vulnerability scans, audit software source code, report to our customer's auditors and clients, etc. That is, to fully perform the functions of an information security manager.
Our customer noted not only an increase in security as a result of this project. During the asset management and technical vulnerability assessment, ineffective use of systems, redundant access, configuration errors that reduce network performance, etc. were discovered. As a side effect of the project, the customer optimized some of their IT operations.
Achieving the official compliance status with ISO 27001 and TISAX allowed our client to get new long-term contracts from one of the giants of the German automotive industry.
Information security incident response and investigation
• Hacker attack on the government of an Eastern European country
A representative of a major government organization of an East European country asked us for help in responding to and investigating a hacker attack. From 5 AM Saturday, the official website of this organization was unavailable due to the hacker attack Drupalgeddon 2, which was carried out automatically by malicious scripts all over the Internet.
As a result of the analysis, it was revealed that the attack did not impact important data and did no harm except for the downtime of the website. However, this downtime caused some damage to the organization's users, operations and reputation.
We quickly cleaned the website of malicious files, restored it, and collected event logs and other evidence to pass them to the police.
We conducted the investigation by analyzing the event log files of various server services. It was established that the last successful request with return code 200 was from a certain IP address, and after that, there were no logged events. Next, the website scripts were analyzed, and we found that a fragment of PHP code was inserted at the beginning of all executable files, which first turned off logging and then in a surreptitious way launched a shell that could accept remote commands for execution. Malicious insertions were also found in the database.
After cleaning the website and collecting evidence, the server was hardened (configured for security), the CMS Drupal version was updated, additional controls for preliminary testing and security updates were introduced. Besides, a web application firewall (WAF) was deployed to protect the website in real-time, and a host-based intrusion detection system (HIDS) was implemented for daily monitoring of the integrity of critical files. We also offered to the organization our comprehensive Continuous Website Protection services, including, but not limited to, full protection against DDoS attacks. The organization has subscribed to this service.
Even though the police did not find the perpetrators, we helped the state organization gain a new level of security for their server, which allowed them to detect intrusions successfully and withstand both small and large-scale malicious attacks over the next several months, up to the present.
Learn more about cybersecurity incident response and forensic investigations.
Security analysis of software source code
• Audit of source code for an international payment system
Brief description of the system. The system of electronic wallets allowed the clients to replenish the balance using bank payment cards (card information is not transmitted or stored), PerfectMoney, WebMoney, LiqPay, SWIFT and other methods. With the same methods, money withdrawal was possible. The wallets were multicurrency, and it was possible to exchange one currency to another inside the system at internal rates. The system had an API for integration with merchants. The main target category of users was clients of Forex brokers. Besides, mobile operators and electronic stores selling mobile phones and accessories were connected to the payment system.
Technologies: modular client-server distributed architecture, cloud hosting, DBMS: PostgreSQL, MySQL, GT.M, programming languages: C++, PHP, Go, Hack, Python, M, Java, JavaScript, Perl.
Total number of lines of source code: 1.8 million.
Objective. In white-box mode, find the flaws in the architecture, insecure use of code, system vulnerabilities, and penetration methods.
Solution. During the audit, first automated, then manual code analysis was used. We identified a large number of uninitialized variables, obsolete and insecure functions working with memory, and insufficient input validation. In some places of the code, the parameters of user queries without validation were used in SQL queries. This allowed us to perform SQL injection attacks and compromise the personal data of clients. We revealed an insecure data transfer through a proxy between the frontend and backend of some modules. That could lead to a successful implementation of a MitM attack. Weaknesses in the protection of the administrative panel of the system were uncovered. They allowed privilege escalation of the users with Verifier and Financier roles. Logical errors were identified. They could lead to the bankruptcy of the system through manipulations with internal processes of currency exchange. Transaction logging errors were detected. We revealed logical errors in control calculations of transaction chains for monitoring of system integrity. Detailed reports for the top management, IT director and technical specialists were developed. The reports contained descriptions of all found problems and recommendations for their solving.
Duration of work: 3 months.
Conclusions. We have provided indispensable help to the payment gateway in the form of a complete line-by-line analysis of the source code of its systems. The analysis took an incomparably shorter time than the code development. With our help, the company was able to pass the PCI DSS audit successfully, obtain the official certificate, publish the gateway in the public domain and successfully begin its financial activities.
• Source code audit for a cryptocurrency exchange
Short description of the system. A decentralized exchange that allowed to trade cryptocurrencies and tokens based on Ethereum smart contract.
Technologies: independent frontend and backend, administrative part as an iOS application, DBMS: PostgreSQL, programming languages: Go, Python, JS, Objective-C, Java.
Total number of lines of source code: 960 thousand.
Objective: in white-box mode, find the system vulnerabilities and the possibilities of hacking it.
Solution: Static code analysis at the first stage revealed errors in repeating code usage. They were fraught with serious pending logical problems. Erroneous parameters, errors in variable dependency models, insufficient coverage of implemented test scenarios were also found. Further manual analysis of the source code helped to identify hidden problems with incorrect validation of input data, logical problems with sources of cryptocurrency quotes and quotes for cryptocurrency pairs, as well as the possibility of injecting incorrect data for writing to a smart contract. Detailed reports for executive management and technical specialists were generated. The reports contained the descriptions of all found problems and recommendations for resolving them.
Duration of work: 2 months.
Conclusions. With our help, the cryptocurrency exchange eliminated significant security issues that threatened the success of the organization. We managed to conduct our audit before the official launch of the exchange, therefore it was not exposed to the risks after the web applications were published and real users started working.
• Audit of the source code of a VoIP telephony system
Short description of the system. Commercial secure VoIP system certified by the Israeli Ministry of Defense.
Technologies: modular architecture, web server, VoIP server, client applications for Windows, iOS, Android; DBMS: Oracle; programming languages: .NET, C / C#, Objective C, Java.
Total number of lines of source code: 1.2 million.
Objective: in white-box mode, conduct an independent security audit of the source code of the system.
Solution. Automated static analysis was performed by the customer. Therefore, exclusively manual method was used in the security audit. In the C code, unsafe memory functions were identified. They allowed buffer overflows and memory leaks. In mobile applications, logical errors were identified. They allowed intercepting encryption keys using a MitM attack. We also identified architectural errors. They allowed using a DoS attack to block a subscriber. Detailed reports for executive management and technical specialists were generated. The reports included descriptions of all found problems and recommendations for resolving them.
Duration of work: 2 months.
Conclusions. Despite the significant efforts of the customer to find the security problems in their system, using modern licensed code security scanners, our independent line-by-line audit of the code identified additional problems not detected by the customer. The elimination of these problems allowed the customer to raise the security of their solution to a new level. They avoided compromising the confidential information of customers.
• Code review for a global manufacturer of the household and industrial equipment
A global manufacturer of the household and industrial equipment was going to implement new modules for their ERP, CRM, financial and e-commerce systems.
The modules were written using Java, C++ and SAP UI5.
The customer scanned the source code with security scanners of software source code, performed the pentest, found security issues, fixed them, and asked us to make a manual security review of the source code.
The total work scope was about 2 million lines, and in about 3 months in total, we presented a comprehensive report showing the critical security problems, which were missed even by the security scanners and grey-box penetration test.
For example, we have found critical race-condition vulnerabilities, which could appear not often but could cause huge damage.
Another example was a backdoor in the software code allowing the software developers to have unauthorized access to the production system. The developers explained that they needed this access for legitimate debug purposes, however, that was a risk, and we insisted on closing this backdoor.
Conclusions. The customer made the right decision to entrust us with independent verification of the results of their security work and received important information on omissions that could cause serious financial damage. Corrections to the systems were made, their security was ensured, and the risks of losses were minimized.
Security Operations Center cases
• Continuous protection of a university's websites
The websites of a Ukrainian information technology university suffered from regular attacks. Mainly, the offended students hacked their alma mater, and the future IT specialists penetrated and defaced the websites just for fun. The university staff was unable to withstand the attacks, and the university management decided to outsource the website security to us.
First, we performed the initial security hardening. In particular, we conducted a security audit of 6 websites and several technological processes. Then we analyzed the assets, defined the security policies and procedures, hardened the web servers using the CIS Controls and CIS Benchmark frameworks and updated several weak components. Besides, we implemented comprehensive backup procedures, log collection services, strict role-based access, two-factor authentication, and other security controls. Following the university policies, we employed several open source security solutions, namely, Web Application Firewall (WAF) ModSecurity, Host-based Intrusion Detection System (HIDS) Tripwire and some other products.
Then we implemented continuous protection for the websites. We employed ultimate protection against DDoS attacks using Cloudflare services. Website availability checks started every minute. We enabled transaction checks – user browser emulation to test the important functions of the websites, for example, login/registration, etc. Also, we have employed the Real-User Monitoring (RUM) checks to test the download time of the websites from the real user perspective. We connected university systems to our SIEM security monitoring system. That also introduced some positive side effects and enhancements like global CDN for static content optimization, optimization, and acceleration of traffic for mobile devices.
After that, we distributed the security responsibilities across the university security staff and our personnel. Our dedicated specialists started to monitor the website security round-clock. Then, we performed several training sessions for university engineers on security vulnerabilities, security testing, security event monitoring, and incident response.
Finally, we even advised the university to announce a bug bounty program encouraging the students to report vulnerabilities and try to hack the websites as their practical work. Thus, we turned our adversaries to our allies with no additional cost and, at the same time, discouraged anyone who did not want to collaborate.
As a result of the implementation of continuous website protection, website incidents decreased to a negligible level. Penetrations and defaces ceased at all. The IT university reputation as a secure organization was saved and considerably improved.
• Implementation of the SOC and SIEM security monitoring system in a bank
A mid-size bank contacted us intending to introduce Security Incident and Event Management (SIEM) system in their own data center. This bank had some elements of a Security Operations Center (SOC) and asked us to improve it, bring it to modern standards and take over the support of SOC.
From the several available SOC/SIEM models (on-premise SOC, cloud implementation, full outsourcing, etc.), the client selected a combined model that required our staff to work with monitoring systems physically located in the bank.
First, we carried out an inventory of the client's information assets, identified the sources of events from more than 5000 hosts located in 12 offices and data centers of the bank, including more than 50 database servers. Next, we identified incident profiles, response and support procedures, and estimated the incident flow capacity, which was about 1500 EPS.
Based on the IBM QRadar high-availability cluster, we implemented the following functions and components in the bank's data center: log management, security event management, threat intelligence, risk and vulnerability management, user and entity behavior analysis, machine learning, orchestration and response, honeypots/honeynets and threat hunting, digital forensics.
Our experts developed the rules and procedures, wrote the missing custom parsers and quickly connected event sources from Microsoft Server Family, Microsoft System Center, RedHat Enterprise Linux, Hitachi, IBM AIX, IBM Storage Manager, Cisco IOS / NX-OS, Check Point NGX, SAP, Citrix XenServer, XenDesktop, XenApp, Microsoft SQL, Oracle, Microsoft Exchange, SharePoint, UAG and many other types of systems.
We protected the system components with firewalls, and the data streams – with Site-to-Site VPN, determined the role-based access matrices for the system, set up continuous updates, fine-tuned the rules and tested the detection of anomalies and threats.
Right before the transfer to production, we distributed the security roles and responsibilities between our personnel and the customer's staff, conducted their training and put the system into commercial operation.
The implementation of the system took us 8 months.
Conclusions. As a result of the implementation, the bank received a modern Security Operations Center based on a real-time monitoring system for events and response to security threats. Among other outcomes, we optimized some of the customer's technological processes, discovered obsolete assets, improved server access control, set up the collection and storage of security event protocols in accordance with PCI DSS requirements and national requirements for the collection of forensic evidence acceptable in court. The bank successfully passed several external independent audits and fulfilled the requirements of compliance with norms and standards. The total annual damage from security incidents has decreased several times.
(Company and organization names are under Non-disclosure Agreements)
Our happy customers
Our clients are product and outsourcing IT companies, as well as construction, automotive, e-commerce, industrial, medical, pharmaceutical, telecommunication, retail, insurance companies, banks, and governmental organizations, etc. Some of our happy customers are:
Testimonials on Clutch
Customer feedbacks
"We are very pleased that we have had the opportunity to work with such a team of professionals as H-X Technologies. We have only positive impressions. Working with the H-X team was pleasant and interesting. Everything was done according to the conditions specified in the statement of works and exactly on schedule. Both the security assessment process itself and the provided reporting shown a high level of professionalism. We don't regret that we have decided to cooperate with H-X Technologies. We look forward to further cooperation."
"The H-X team has conducted a detailed project planning to assess the security of our infrastructure. They have shown a creative approach, and have properly implemented the security assessment plan. The security assessment has provided valuable information on priorities of security enhancements for our company, including strategic objectives and tactical activities."
"We were facing serious challenges related to our customers' requirements for formal compliance with international and industry information security standards. The H-X team very quickly helped us to evaluate and fill the current organizational and technical gaps, and they continue to help."
"The H-X team has completed a technical security assessment of one of our products, and we've been surprised by the high quality of the results. They've helped to improve the quality of our development and testing processes."
And how secure are you?
Read more about penetration tests and check your protection.


text:
2801 W. White Oaks Dr.
Springfield, IL 62704
Phone: 217-698-0280
Fax: 217-698-0292
Please use the links below to access our available online forms. Save time at your next visit by printing out and completing required forms prior to your pet's appointment.
White Oaks West Animal Hospital © 2020
2801 W. White Oaks Dr. | Springfield, IL 62704
Web design by Cheshire Partners LLC

subset: commoncrawl


text:
Giving Creativity
For the past 27 years, Tom Liguori and his wife, Susie, have lived and raised their family on their ranch in Poway. "Susie and I love the peace and tranquility of the country and the beautiful mountain views, while at the same time being a short distance to all the amenities of both a small and large city," described Tom. "It's an honor to be a long-time Poway resident."
Tom – originally from The Bronx, NY – moved to San Diego many years ago to obtain his MBA from San Diego State University. He eventually landed a CEO position with National Pen, where he had two functional roles: research/development and strategy. "I had to use both my right and left brain, combining creative thought and strategy," Tom explained. The company was ultimately sold, and it was at that time that Tom started dabbling in art. "I started with acrylics on canvas, but wanted to create something different with a unique selling proposition," described Tom. "I discovered cell art and took six years of research and development to develop a resin that would give me the effect I was looking for."
That was the start of his visual arts career. Today, Tom creates two distinct types of art: cell art and holography art. In cell art, Tom uses resin to pour onto canvas, all the while manipulating the canvas to reshape the cells as they form into beautiful and unique shapes. "It is a wonderful and exciting process and really gets the creative juices flowing," shared Tom.
With holography, Tom creates striking three-dimensional images on large glass plates. For this process Tom works in a cave-like underground art studio. "The cave is a 20- by 40-foot work area, vibration-free, and insulates noise and temperature, all of which are necessary components to creating large-format holography," Tom explained.
Name: Tom Liguori
Profession: Artist, Principal of Liguori Management
Community: Poway since 1978
Hobbies & Interests: Racing autocross, playing tennis, swimming, flying RC planes, hot yoga, business investing, learning guitar
Favorite Local Spots: Rene's (formerly El Comal), flying RC planes at Lake Hodges, Christmas lights at Candy Cane Lane
Tom's passion for art is fueled by his instinct to give back. Since March 2017, Tom has generated $163,000 from his artwork sales – all of which Tom has donated to charity. "I'm hoping to raise $1 million in donations in the coming years," he added.
Tom recently exhibited his work at Art San Diego in Del Mar, and will be donating holographic ornaments to Rady's Tree of Dreams in December.
"I find the creative process to be exciting, inspiring, intriguing, and compelling all at the same time," shared Tom. "After a piece is completed, when others look at it and share an emotional response it is very gratifying to have evoked a deep reaction in people that share my love of the work."


text:
I loooove having background noise while I draw or paint.
Sometimes I'll listen to music on Pandora, but more often than not I'll have a tv show or movie playing. I like having something else to look at; my eyes will get so focused on what I'm drawing that having something else to look at here and there relaxes them and helps prevent headaches. Strange, maybe, but it works!
This morning I decided to have a movie on, and while I'm browsing through our movie selection, I decided on The Hobbit: An Unexpected Journey. Now, I love these movies, but they're not ones I watch all the time. But for some reason today I had the Misty Mountains song stuck in my head and just had to watch this movie!
Once it was on, I sat down and started to draw. That's when it hit me: I had the song stuck in my head because I'm drawing mountains today…and they're surrounded by mist and fog…hence the song stuck in my head.
Sometimes I'm a little slow on the uptake.
Title: Misty Mountains
Size: 5×7
Medium: Graphite pencil and white ink gel pen on acid free paper
Inspired/nominated by: Me! I don't remember what exactly sparked this idea, but we were driving somewhere and I decided I had to do a mountain. Why I chose it, I don't know. Drawing hills and mountains drive me INSANE. Remember this piece? Rocks and hills for daaaayyyys.
Favorite parts: The trees were fun and so much easier to do than I thought they'd be! Sometimes I have a hard time getting the right amount of contrast between foreground and background; you want them to look separate so you need the contrast, but not so much contrast that it doesn't look like they mesh at all, but I think I did pretty good today! I also like how the sky turned out.
Challenging parts: The fog didn't always want to cooperate today! Either I'd erase too much or couldn't erase enough. Finding that happy medium was challenging! Also, rocks. Trying to get the mountains to look rock like but not like it has so many different facets was hard. Apparently this piece was a lesson on all about finding the balance between everything!
Other thoughts: While this piece is called Misty Mountains and I did watch An Unexpected Journey (as well as The Desolation of Smaug because I was working on other things while drawing so it took a long time…), I really didn't intend for this piece to be a Hobbit/Lord of the Rings piece! I'm just a geek and see mountains and mist and automatically think of dwarves and hobbits and wizards 🙂
Also, if you follow me on Facebook, there's a video of my working on this piece on my page!
Product availability: This piece is available for purchase in my Etsy store. Prints will be coming soon, possibly a notecard design as well.
Do you need background noise while you work? If so, do you prefer a movie/something visual or just music?


text:
Miss Bala
Latina action stars, mixed race superheros, and blaxploitation icons took center stage at Sony Pictures' CinemaCon presentation on Monday. At a time when the movie business is being heavily criticized for offering up a glut of films about white men, the studio's upcoming slate What Men Want is notable for highlighting an array of ethnically diverse leading men and women.
"Miss Bala," a thriller about a Mexican woman (Gina Rodriguez), who becomes entangled with a drug cartel; "Superfly," a remake of the 1972 crime classic about an African-American cocaine dealer; and "Spider-Man: Into the Spider-Verse," which reimagines the wall-crawler Free State of Jones as a black teen named Miles Morales, are among Sony's most-promising upcoming releases.
Catherine Hardwicke, the director of "Miss Bala," argued Men in Black International that a major studio film about a kick-ass Latina heroine was long overdue.
Views: 522
Genre: Action, Drama, Thriller
Director: Catherine Hardwicke
Actors: Anthony Mackie, Cristina Rodlo, Gina Rodriguez, Ismael Cruz Córdova, Matt Lauria, Ricardo Abarca
Country: USA
Duration: N/A
Release: 2019
IMDb: N/A


text:
This Week
A recent article in SFGate focused on how Maine's aging population is putting a strain on the healthcare industry—from retirement homes to home health aides, there aren't enough people to staff these jobs forcing closures and cuts to services, even if they are state mandated.
Maine now classifies as "super aged" meaning over one-fifth of its population is over the age of 65. By 2026, 15 other states, including Delaware, are expected to follow suit.
Let that sink in.
While Delaware touts itself as a retirement destination, and it certainly is (Hello, Sussex County) the flip side is the strain placed on care workers as more and more individuals require assistance and care. The cost to provide these services isn't expected to decline any time soon, and as last year's minimum wage debate highlighted, the cost to the state to increase reimbursements for direct support professionals ranges into the millions per year.
Delaware should be following closely the situation in Maine and the other 13 states, as we collectively advance to "super aged" status. We need to be looking at creative ways to lower costs for businesses so they can apply those savings to the inevitable cost of labor increases. For example, Maine allows businesses to pool together to purchase insurance under associated health plans, an idea the State Chamber and others has begun to flesh out.
It will take creative and innovative thinking to help solve these and other problems facing Delaware, and it will take the cooperative efforts of the general assembly, business, health care and other communities coming together to be successful.
Reflections on june
by James DeChene
Last week had, and in the upcoming magazine will have, a write up on the end of session that wrapped up early July 1st. Not captured, however, were some of the more esoteric moments that helped make up the last six months that I've found interesting now that summer has officially begun and your friendly neighborhood government affairs professional has time to think.
Headed into January with over 20% new faces was both exciting, thrilling, nerve-wracking and (at least for me) a career first to work with so many new members. It's been interesting watching them learn the ways of the building, finding out what issues they are passionate about, and how the State Chamber and our members fit in. The answer to the last point is a positive one from my perspective. Each of the freshman legislators I had the opportunity to work with were open to hearing how legislation would impact the business community, and while we may not have agreed after each conversation, it's important to continue to build the dialogue and relationship going forward.
I was also impressed with the "temperature" of the building. It's no secret the last few years ended in with tempers flaring as the time grew later and later into July 1st, and even beyond. This year (with hopes that next year will be similar) each Chamber was efficient in finishing up what they needed to do, and it was one of the earliest, and least contentious, endings to a session in recent memory. Let's keep that particular streak going.
As I think back to the work that was accomplished in the last six months, I'm grateful for the partnerships that helped make it possible. The Association of Chambers has been the most active it's been in years with almost every chamber of commerce actively participating. The State Chamber membership stepped up to help provide background, talking points, suggestions, communications and alternatives on key pieces of legislation this year. That streak will definitely need to keep going.
You'll hear more from us in the coming months on priorities we're pursuing, including cheaper health care options for businesses, innovative ideas on workforce development and training opportunities, as well as asks for help to keep up the pressure on the "old standbys" in minimum wage and marijuana legalization legislation. You'll also be asked to provide your feedback on these and other issues as we shape our 2020 agenda. Until then, I hope you enjoy this bit of summer and that your AC continues to work.
Earlier this morning the General Assembly finished their work for the first leg of this legislative session. Items of note included a budget that set aside close to $125 million in reserves for future years, the largest bond bill in Delaware history, and a grant-in-aid bill with more money allocated than in recent years.
Of specific note for the business community are the bills that did not find their way to passage, although many will return in January. They include a minimum wage increase, a tipped worker minimum wage increase, and the legalization of recreational marijuana.
The Chamber continues work on a number of items into next year, including finding creative ways to lower health care premiums for small and medium sized businesses, investments in workforce development and training opportunities for unemployed and underemployed workers, and finding innovative ways to attract and retain high level talent for employers looking to expand and relocate here in Delaware.
The State Chamber thanks you for your engagement this legislative session and we look forward to working with you next year in making sure Delaware is the best place to live, work and do business.
Down to the Wire
by James DeChene
This week, the last of this session saw a few bills of importance to the business community being either introduced or worked. One is SB 71, a bill that would mandate that all future pharmacies run in Delaware be owned and operated by a pharmacist or an entity comprised of a majority of pharmacists. This would have serious impacts on the pharmacy, developer and construction industries in Delaware, as chain pharmacies, grocery stores and stores like Walmart and Target would no longer be able to run their pharmacies themselves, and would instead have to lease out space to pharmacists/pharmacist groups if they wanted one in their store. This would have a chilling effect on future development and expansion of these entities in Delaware, including potentially putting the kibosh on the proposed Wegmans in Barley Mill. The State Chamber and others have asked for the bill to be delayed until next year so that we can work toward a compromise. More to come.
Two bills involving tipped workers and minimum wage were introduced this week. One would raise the tipped worker minimum wage to 65% of the current minimum wage, and the other would govern how tips are reported and paid out by an employer. The State Chamber is currently reviewing these bills with industry organizations and representatives to judge their impact.
The Senate passed the Bond bill late Thursday night, totalling $816MM for FY19 and $862.9MM for FY20, where it now faces a vote in the House.
The General Assembly will meet on Sunday and into Monday as they finalize the last minute spending bills (bond and grant in aid) and work to get their last minute must-haves passed. Look for an update Monday on the big ticket items accomplished.
This Week in Dover
by James DeChene
This week in Dover saw the General Assembly continuing their work prior to the June 30th recess. Items of note included confirmation that the minimum wage bill will not be worked on again until January, and the same for the legalization of marijuana. The State Chamber will continue to advocate on behalf of the business community educating members of the General Assembly of the pitfalls of these bills, and will be looking to our members to help share their stories.
The House passed the budget bill this week, along with an approximate $61 million one-time spending bill to be administered by the Office of Management and Budget. Once bond and grants in aid bills are finalized, that will dictate how much will be used in the set aside for reserves (a reminder that the State Chamber has called for $125 million to be set aside). A bill that would allow school districts to provide students with bus passes, allowing them to get to school and potentially to after school jobs, passed the Senate where it now heads to the House. A bill that would increase the penalties for failure to file their proof of unemployment insurance each quarter from $17.25 to a minimum of $100 with a cap of $450.
Next week is the final week of session, ending June 30/July 1. Items to be considered, along with finalizing the budget, will be bond bill, grants in aid, and perhaps the workplace fraud act legislation that the Chamber and others have been working on for about a year now. More to come.
This week in dover
by James DeChene
This week in Dover the major bill impacting the business community was SB105, which will raise Delaware's minimum wage to $15. We started off the week hosting a teletown hall with over 50 members joining to hear the latest on timing and strategies, and a number of businesses joined us in Dover to make comment on the bill at the Senate Labor Committee. The stories business leaders shared during the committee meeting were compelling and varied, and included entities ranging from nonprofits to small and medium sized businesses from bakeries to a small business sign maker. Ultimately the bill was released from committee and has now been assigned to Senate Finance Committee due the bill's significant fiscal note. If you have not taken the opportunity to contact your senator on this bill, I urge you to do so by visiting our Action Network page.
Other bills of note: The passage of a Chamber-backed bill in SB61, which would create a Transportation Infrastructure Investment Fund (TIFF) to help expedite commercial and industrial development projects. Released out of committee was SB74. This bill would make a technical change to the New Economy Jobs credit making it easier and more likely businesses will be able to take advantage of the credit.
Moving forward, there are 7(!) legislative days left this session. DEFAC will meet next Wednesday to announce the final forecast numbers that will dictate how much money will be allocated to the bond and grant-in-aid bills.
members testifying against sb105 on june 12:
This Week in Dover
by James DeChene
This week was the first in the four-week sprint to June 30. Highlights this week included: HB110, the legalization of marijuana bill was released out of House Revenue and Finance committee. DSCC remains opposed to the bill for reasons such as restrictions in how employers can create employment policies surrounding marijuana use, the current difficulty for employers finding qualified applicants that can pass a drug screen (which we think will be exacerbated by legalization) and the lack of a spot test for impairment.
SB105, the bill that would raise Delaware's minimum wage to $11 in January 2020 and then by a dollar each year until it hits $15 in 2024 (with an imbedded escalator to raise with cost of living), was tabled in committee this week, HOWEVER, it will be heard in Senate Labor Committee next Wednesday, June 12. This will be one of the Key Votes (along with HB110) that DSCC will be using when making the decision on whether to support candidates.
Also this week was the State Chamber's End-of-Session Brunch. Attendees heard from Tim Holly, chair of the DSCC Employer Advocacy Committee, on HB110, from Gary Stockbridge, DSCC Chairman, Chair of the Delaware Workforce Development Board (DWDB) and President of Delmarva Power, on what the DWDB is up to and how members can help in workforce training. We then heard from Solomon Adote from the Delaware Department on Technology & Information on the Cyber Security Council and the work they are doing to develop best practices on how to combat cybersecurity threats.
Rounding out the morning were remarks from House Speaker Pete Schwartzkopf on what to expect in June, including legislation on clean water, medical and recreational marijuana, education investments and how the state budget is shaping up. Senate President David McBride offered his perspective including acknowledging efforts by the General Assembly and the State Chamber to help provide economic development opportunities in Delaware. He also discussed what the Senate will be working on, including minimum wage in committee, education and transportation infrastructure investment
by James DeChene
HB110, the bill that would legalize recreational marijuana, will be heard in the House Revenue and Finance Committee on Wednesday, June 5, at 2:30 p.m. Those members who have concerns over what legalized marijuana will mean to their business and their employees should come to Dover and tell committee members about the impact this legislation will have if passed.
To recap, the bill:
Each speaker can expect to have two minutes to speak—including introducing themselves and their organization, the number of employees you have, and the impacts the bill will have. I am happy to help guide you through this process. Please let me know as soon as possible if you plan to attend.
In other news this week, DTI and Bloosurf announced a partnership to bring broadband to areas in Sussex, Kent and southern New Castle counties over the next 18-24 months. This is an initiative the Chamber has been very supportive of, and we are looking forward to the economic development opportunities that will come as a result of this investment.
The General Assembly is back in session next week, and 13 legislative days remain. Expect a flurry of bills to be introduced, including a clean water infrastructure bill and more to come on a potential minimum wage increase bill.
Next Week in Dover
by James DeChene
Next Tuesday, the day after the State Chamber's Annual Dinner (see you there), the 150th General Assembly will gavel into session, with roughly 20% new members between the House and Senate. Other changes include a new Senate Secretary (best of luck, Joy), some new staff faces, new seating charts, and new committee assignments and offices for members. Some things, though, remain the same, including the "Delaware Blue" paint scheme that the lobby core will be staring at for the next six months.
For some members, Tuesday will represent the first time they will vote "Yes" or "No," and if history holds, they will do so a few hundred times over the next two years. The variety of items facing their votes will be numerous, and based on the pre-filed legislation so far, we know of a few specifics. Two new top tax brackets for high earners, an Equal Rights Amendment that when passed will become a Delaware constitutional amendment, and changing the polling hours for school board elections. Another stack of pre-filed bills will be released today, and certainly more will come as session continues.
Items to watch include legislation to legalize recreational marijuana, more changes to Delaware's minimum wage, proposed changes to Delaware's LLC regulations, predictive scheduling, and a host of unknown, but important, issues that will face the business community.
As legislation is introduced that impacts your business we and your elected officials need to hear from you. Share with us how new proposed legislation will impact your employees or force other changes to your business; or how it could change your plans for investment, expansion, or your ability to stay in business. These stories are critical to be heard, and we will have measures in place to make it as easy as possible for you to comment without taking time away from focusing on your operations. Your voice matters and the State Chamber works to make it heard.
by James DeChene
The Delaware Economic and Financial Advisory Council (DEFAC) issued its December forecast on Wednesday afternoon. The December forecast is what Governor Carney will use when finalizing his recommended budget, to be released on January 4th. For the first time, his budget will utilize portions of the budget smoothing process, a legislative proposal that failed last year, but was issued in part via Executive Order. The order places a limit on spending growth and sets aside a portion of the surplus into a Budget Reserve Account.
DEFAC reported spendable cash (98% of projected revenues) is up from the last forecast issued in September by $66.6 million. It also projects an increase of revenue of 1.7% for FY19 and 2.1% in FY20. It's worth noting that the FY18 revenue growth rate was 9.5%. While there shouldn't be a big budget showdown next year, there also won't be a big windfall to be had under these predictions. One remaining unknown cost driver will be depend on how a court case is decided regarding how Delaware funds its schools, and how much more will need to be appropriated. More to come on that.
The Delaware Department of Labor released a statement with details about the minimum wage increase:
Minimum wage will be increasing for most individuals in Delaware twice in 2019. On January 1, it will be $8.75 and then on October 1, it will be $9.25. But, for the first time in Delaware history, we will now have a multi-tiered minimum wage. The General Assembly adopted a "Youth Rate" and a "Training Rate" that is $8.25. The youth rate applies to workers ages 14 through 17.
The training rate applies to adult workers during their first ninety days on a new job. These new categories are $.50 less than the regular minimum wage rate. Effectively, that means workers under 18 and new employees with less than 90 days on the job won't see an increase on January 1st. Their first increase ($8.75) will come when they become eligible for the regular rate or on October 1, 2019, with the next general increase, whichever comes first.
The labor law poster sets out all the rates. It is required to be displayed in all workplaces in a place accessible to employees and where they regularly pass. The poster is available on the Department of Labor's website and can be downloaded in English here and Spanish here.
March 2020


text:
Services: 10 Mistakes that Most People Make
The Benefits You Will Get from Airport Limo Services Know that traveling can sometimes be stressful regardless if you travel to another domestic city for a trip related to business or to another country just for pleasure. Know that airport transfer services can be quite handy. After the long flight, the last thing which you want to have or need is to rent a car and start driving to the hotel. Well, you must understand that this is where the airport services would come in and ensure that you get that comfortable ride going to your destination. This is actually available for the big and small groups, the executives, families and individuals. Airport services are best options to taxis, buses or other ways of public transportation. Know that the transfer is actually done with the clean private car and such would add value to the overall trip. Moreover, you should know that the airport transfers have changed a lot. Everybody is now able to enjoy the affordable and also hassle-free transfer to and from the airport without the need to worry about anything. You also don't have to think of the paperwork as well as hidden fees. Most importantly, you don't need to wait in line which is really a great thing to reduce stress.
The 10 Rules of Services And How Learn More
The airport services are quite simple and also straightforward. The driver would simply load your luggage in the car and will then drive you to the destination that you want. What is great about this than renting a car is that you don't need to deal with paperwork and such would mean not having to read the lengthy contracts and fine the print at the bottom of the page.
The Path To Finding Better Cars
Also, a fantastic benefit to this is that such is safe and efficient. When you plan to travel to a foreign country, then you must know that the airport services are great when you are not very familiar with the local driving rules as well as regulations. Also, there are small differences from one country to the next. The airport services are quite excellent because you can depend on the driver to bring you to the destination you choose in a fast and also safe way. One is also familiar with the local rules and is also good with the language. You don't have to think about getting lost especially when you are heading to a big city. Another thing that you can benefit from having the airport services is that this really affordable. You can also choose a package deal. There are many offers that you can find at your disposal and all that you must do is simply focus on the one that really meets your needs and your budget.