Lidl Ireland image

Lidl Ireland

Rachel Keelaghan

Job title:
Graduate Management Trainee, HR Department

I decided to apply for the Lidl HR Graduate Management Development Programme during my final year of college after speaking to a past Lidl graduate at a gradireland careers fair. The ownership, responsibility and opportunity that they were given throughout their time on the programme made me want to share in their experience too. Nearly 1 year into the programme and I can safely say it has exceeded all expectations.

I have been given many different projects to work on in different areas of HR which gives me a broad overview and understanding of how the different HR functions work within the business. You are allowed to be creative with your work, voice an opinion during meetings and contribute to the roll-out of many ongoing exciting projects. The level of opportunity and exposure that you are given is second to none which is probably my favourite thing about working at Lidl!


Jun 11

Jenni Lacey from the Society of Biology explores inspiration for this year’s photography competition

The Society of Biology’s amateur photography competition is currently open for entries. This year’s topic is ‘Feeding Life’ which neatly compliments the recent World Environment Day theme of ‘Think.Eat.Save’. Food consumption and its global impact is at the forefront of current environmental research, policy decisions and the public’s mind as we’re encouraged to remain economical and thoughtful around our eating habits.

So, it seems timely to celebrate some of nature’s prudent and opportunistic feeders, who also offer a valuable lesson in self-control and a warning of the dangers of overeating.

Nature’s overeaters

The ornate horned frog (Ceratophrys ornata) at first glance is quite a comical character – with its large, wide mouth and rotund body, it seems harmless. They are not built for speed but instead lie in wait, conserving their energy and waiting to ambush passing prey. They are indiscriminate feeders and therein lies their talent: they make the most of their surroundings and their physique, thriving in the rainforests of Argentina, Uruguay and Brazil. Surviving on a diet of insects, rodents, lizards and other frogs, they will pounce and attempt to swallow almost anything that passes.

Ornate horned frog eating mouse prey           Ornate horned frog eating worm

With a stark similarity to humans, their sedentary behaviour can result in problems; in environments where food is abundant their voracious appetite can cause them to overeat and become obese. They will keep eating as long as food is placed in their path. This is particularly the case when they are kept in captivity as pets, owners must carefully monitor their behaviour and tailor the amount of food they feed the frogs accordingly.

Humans don’t have the safeguard of a loving owner to oversee their diets so it is our own responsibility to consider our eating habits and help reduce the waste of food resources. Not only are we in danger of affecting our own health but we will rapidly exhaust food and energy supplies: global food production occupies 25% of all habitable land and is responsible for 70% of fresh water consumption, 80% of deforestation, and 30% of greenhouse gas emissions.

Get involved

The Society of Biology is seeking photographs that encapsulate the topic ‘Feeding Life’. The photograph could address a challenging issue like food security and waste, or malnutrition, obesity, and other diet-linked diseases. It could provide insight into the feeding behaviour of a plant or animal species including predators and parasites. Or it could illustrate how we are manipulating our diets using GM and other biological techniques. Whether illustrated on a global, organismal, cellular or molecular scale, the photograph should draw attention to the topic of food and biology in a unique and thought-provoking way.

Email updates

Preferred frequency:

Arkive twitter

Twitter: ARKive


Messages in this thread
    SubjectRe: Fix quilt merge error in acpi-cpufreq.c
    On Thu, Apr 16, 2009 at 03:46:42AM +0200, Ingo Molnar wrote:
    > For similar reasons people have memos, stick-it's and other formal,
    > automated, reflex-alike daily routine measures to make sure they
    > dont forget to do something they all too easily forget otherwise.
    > This kind of formal measure _forces_ the extraction of this very
    > specific type of summary on all sides of the contribution chain -
    > and it drastically reduced the number of commits i regretted in
    > hindsight.

    The question is whether Impact: _works_ in its current form. I was
    came across a recent set of commits sent to you where it was
    pathetically obvious that Impact: doesn't really help.

    The patch submitter in question was a non-English speaker. I've
    blacked out the submitter's name, because I'm not trying to call out
    that particular person, but rather the assumption that Impact: is
    always helpful. Here's a very clear case where it is not.

    I do feel your pain; there are one or two ext4 contributors where I
    always have to rewrite their commit logs and comments, and often I end
    up staring at the code trying to figure out what the !@#@? they meant.
    I used to try to coach them to make better messages, but I've since
    given up and just resigned myself to the fact that it's up to me
    rewrite the commit logs (and often, the comments in the code, too...)

    If we are going to use the Impact: header, there should only be a few
    standardized values that it can have, i.e., "clean up", "fix oops",
    "fix lock ordering", "fix performance problem", etc. Otherwise people
    will just put garbage in the Impact field --- what the heck does
    "Impact: it is not ready yet. remove it" mean?

    Or "Impact: fix smp_affinity when moving irq_desc"?

    Or worse yet, "Impact: so use dev_to_node"?!?

    At least for this particular submitter, the Impact: header clearly is
    adding no value, and in fact, I suspect his git commit logs would be
    better without trying to force him into filling out a field in what
    appears to be a completely random fashion.

    - Ted

    x86/irq: remove NUMA_MIGRATIE_IRQ_DESC

    Impact: it is not ready yet. remove it

    it causes crash on system with lots of cards with MSI-X
    when irq_balancer enabled...

    will have one new patch that create irq_desc according to device numa node.

    irq: correct CPUMASKS_OFFSTACK typo -v3

    Impact: fix smp_affinity copying when moving irq_desc

    CPUMASKS_OFFSTACK is not defined anywhere. it is a typo
    and init_allocate_desc_masks called before it set affinity to all cpus...

    split init_alloc_desc_masks() into all_desc_masks() and init_desc_masks()
    so in the init_copy_desc_masks could use CPUMASK_OFFSTACK there.
    aka copy path will not calling init_desc_masks anymore.

    also could use that CPUMASK_OFFSTACK in alloc_desc_masks()

    v3: update after "remove numa_migrate irq_desc"

    Subject: [PATCH 3/8] irq: make set_affinity to return status -v2

    Impact: prepare to use it to keep affinity consistent

    according to Ingo, change set_affinity() in irq_chip to return int.

    v2: fix two typo

    irq: change irq_desc_alloc to take node instead cpu

    Impact: prepare to make irq_desc_alloc to numa aware

    so could make irq_desc_alloc use node pass down

    irq: make io_apic_set_pci_routing to take device

    Impact: so use dev_to_node

    and use node in irq_desc_all_node()

    x86/irq: make MSI irq_desc numa aware

    Impact: use irq_desc_alloc_node

    try to get irq_desc on the node in create_irq_nr

    irq: make ht irq_desc numa aware

    Impact: use create_irq_nr

    try to get irq_desc on the node with create_irq_nr

     \ /
      Last update: 2009-04-16 05:59    [W:0.031 / U:0.516 seconds]


Grand Theft Monopoly

Renegade Economist Podcast 96

“As broadcast on the mighty – Professor Michael Hudson excels in describing globalisation from a financial snipers perspective, analysing how real estate (land) is used in the game of currency siphoning out of Latvia, Eastern Europe and Russia. What does neo-liberalism deliver? Who is behind the controls? Also gold, white collar sub-prime crime and GW’s departing deception.”


Stilton: vacaciones para todos. 5ª primaria (Aprende con Stilton)
La Dominación Masculina (Argumentos)
Guia Terapeútica de Acupuntura
Al Morir Don Quijote (Narrativa)
Wiseplanet is a language and cross-cultural training consultancy that provides customized solutions
for living and working in a multicultural world.

    As our planet becomes seemingly smaller and we find ourselves sharing an increasingly global workspace, one of the challenges we face is effective communication with people of different cultures.

    read more

    Everyone can use some help navigating linguistic and cultural differences. Let us help you become culturally competent in your relations with others who don’t necessarily share the same language...

    learn more

    meet the team

    read more

Don’t just take our word for it…

“I’m very fortunate that I had Michelle assisting me in my years living and working in the USA at an international architectural firm. She is a very sensitive person who is able to identify and understand the cultural issues that a foreign professional has working in the U.S and is capable of delivering different and efficient methods for improving spoken and written English.”

Luiz Fernando Azerado, Architect, Brazil

“Over the past few years, Wiseplanet has supported me with comprehensive communication training that is creatively tailored to my professional success. With their broad expertise in the English language and practical cultural advice, Wiseplanet provides me with sophisticated, hands-on solutions to any type of request I bring to my training. As a Japanese working in an American corporate work environment, I have built a reputation for my strong English communication skills and I would highly recommend Wiseplanet if you are seeking to boost your own career success with professional and personalized service.”

A.O, Revenue Management, Delta Air Lines, Atlanta, GA

“As an international employee working for a global company I knew it was essential for me to be able to use correct pronunciation and intonation in my work environment and to understand American culture and appropriate expressions in business situations. Michelle, an experienced trainer in the Compton-P ESL Accent Modification method, helped me correct my typical pronunciation errors dramatically. In addition, she helped me recognize some important cultural differences between Western and Asian culture.”

Teru Murata, Specialist for China and South East Asia Market, Pacific Revenue Management, Delta Air Lines, Atlanta, GA


Weather Forecast

The flaw in fetal-pain legislation

This week, Arizona’s new abortion law took effect, outlawing the procedure after 20 weeks of pregnancy - a much earlier threshold than in any other law that has been upheld in court. Like-minded laws have been enacted in Nebraska, Alabama, Idaho, Indiana, Kansas, Oklahoma, Georgia and Louisiana, and a bill similarly limiting abortion in the District of Columbia drew support Tuesday from a majority of the U.S. House, but not from enough members to pass.

These measures differ from previous attempts to prohibit abortion in that they rely on both the scientific claim that a fetus is capable of feeling pain and the legal claim that states may prohibit abortions to prevent that pain.

Although these laws rely on dubious medical science, they aim to exploit a loophole in the law and tempt federal judges disposed against abortion rights to find them constitutional. Thus, the laws present a major threat to abortion rights as we know them.

Since Roe v. Wade, the Supreme Court has consistently held that the Constitution permits states to prohibit abortion (as opposed to limiting the procedure used) only in order to preserve fetal life after the fetus is capable of surviving outside the womb. In constitutional law parlance, only at this viability point does the state’s interest in preserving fetal life become “compelling.”

Most medical professionals agree that viability begins at 23 to 24 weeks into pregnancy. These recent laws, then, represent an attempt to prohibit abortion before this threshold.

The fetal-pain bills do not directly challenge the Supreme Court’s judgment. Instead, they assert a new theory for outlawing abortion. The Nebraska bill states that “by 20 weeks after fertilization there is substantial evidence that an unborn child has the physical structures necessary to experience pain.” The legislatures passing these laws say that preventing this pain is a compelling state interest that justifies prohibiting abortion.

Whichever variant is adopted, the argument is flawed.

First, medical and psychological research shows that pain is both a physical response and an experiential one. The neural structures that a fetus would need to “experience” pain do not develop until well beyond the point at which these bills prohibit abortion. It is this experience of pain — not the observable neuroendocrine, metabolic and reflexive responses to stimuli to which these bills point — that matters in terms of the state’s interest. Thus, these bills are based on a false construct.

Second, even if fetal pain existed, the alleged experience could be prevented without outlawing abortion. As proof that fetuses are capable of feeling pain, Nebraska’s law notes that physicians often administer anesthesia to fetuses. This is done to relax muscles or to prevent neurodevelopmental problems later on — not, medically speaking, to control pain. But if these fetuses were capable of feeling pain, administering anesthesia would likely prevent any sensation of pain, just as it does in children and adults. Thus, there is no legal reason to prohibit abortion at 20 weeks: We can prevent fetal pain during an abortion — without burdening a woman’s right to that abortion - by requiring the administration of anesthesia to the fetus.

Even if such bills could overcome both objections, states still have not shown why their interest in avoiding the allegedly real and unavoidable experience of fetal pain should outweigh a woman’s right to an abortion. Although fetal pain might be relevant to that calculation, perhaps changing which abortion procedures are performed, it is not clear why it should be dispositive.

Because these laws are scientifically and legally ill-founded, federal courts should strike them down. Nevertheless, defenders of abortion rights should be afraid. Because such legislation invites courts to further restrict abortion without overruling existing precedent, it is entirely possible that they will garner five votes on the current Supreme Court and change the face of abortion law as we know it.


Aurora is real and still not being addressed

Much has been written about the Aurora test performed by INL and shown on CNN. The fact that the test report is still not public has only caused further confusion.

INL and other national lab cyber researchers have hacked both equipment vendor and user cyber systems at will.  However, people had been reticent to believe that cyber attacks could actually damage equipment. The purpose of the test was to demonstrate that a cyber attack could physically damage rotating equipment. It doesn’t matter if it is a diesel generator, turbine, compressor, windmill, pump, etc. Therefore, this applies to all industries including the Smart Grid. It is hard to believe, but people still deny that damage is possible even after the test.

A group of industry experts developed the Aurora test plan and installed the machine as it would have been in the real world. The same experts validated the test results. Following the demonstration, NERC issued an Advisory on Aurora. However, as an Advisory, they were only recommendations not requirements. Moreover, the recommendations were tied back to CIP-002. Unfortunately, the electric industry is using the loopholes exposed by Mike Assante’s April 7th letter to continue to ignore Aurora. Given that very few utilities have addressed Aurora to this day, regulations are needed post haste.

Without going into the specific details of the test, the generator was a 3.8 MVA machine de-rated by the manufacturer to 2.8 MVA for severe duty, driven by a 5000 Hp diesel engine, operating at 1800 rpm.  The INL test was conducted from the generator breaker only to protect other equipment on the INL grid.  An attacker would not be under this constraint. Other remote breaker locations would have been just as effective. (This was not an Internet-based attack.) The smoke seen in the video was when the coupling was DESTROYED as the diesel engine seized from internal mechanical damage.  The entire unit was scraped at the end of the test.  INL researchers believe that a large steam unit would be even more likely to be damaged from such an event.  Mechanical design margins are much narrower for large turbines, generators, and transformers than for marine diesel units.

We will have discussions concerning Aurora and other cyber events that can, and have, damaged equipment at the October Control System Cyber Security Conference.

Joe Weiss


November 26, 2013

Researchers At Penn Uncover Mechanism Behind Blood Stem Cells’ Longevity

Researchers have long wondered what allows these stem cells to persist for decades, when their progeny last for days, weeks or months before they need to be replaced. Now, a study from the University of Pennsylvania has uncovered one of the mechanisms that allow these stem cells to keep dividing in perpetuity.

The researchers found that a form of the motor protein that allows muscles to contract helps these cells divide asymmetrically, so that one part remains a stem cell while the other becomes a daughter cell. Their findings could provide new insight into blood cancers, such as leukemia, and eventually lead to ways of growing transfusable blood cells in a lab.

The research was conducted by Dennis Discher, professor in the Department of Chemical and Biomolecular Engineering in the School of Engineering and Applied Science, and members of his lab: lead author Jae-Won Shin, Amnon Buxboim, Kyle R. Spinler, Joe Swift, Dave P. Dingal, Irena L. Ivanovska and Florian Rehfeldt. They collaborated with researchers at the Université de Strasbourg, Lawrence Berkeley National Laboratory and University of California, San Francisco.

It was published in the journal Cell Stem Cell.

The standing theory to explain these cells’ near immortality is asymmetric division, though the cellular mechanism that enables this kind of division was unknown. Looking to identify the forces responsible for this phenomenon, the researchers analyzed all of the genes expressed in the stem cells and their more rapidly dividing progeny. Proteins that only went to one side of the dividing cell, the researchers thought, might play a role in partitioning other key factors responsible for keeping one side a stem cell.

They saw different expression patterns of the motor protein myosin II, which has two forms, A and B. Myosin II is the protein that enables the body’s muscles to contract, but in nonmuscle cells it is also used in cell division, where it helps cleave and close off the cell walls as the cell splits apart.

With these myosins as their top candidate, the researchers labeled key proteins in dividing stem cells with different colors and put them under the microscope.

The researchers then performed in vivo tests using mice that had human stem cells injected into their bone marrow. By genetically inhibiting myosin IIB production, the researchers saw the stem cells and their early progeny proliferating while the amount of downstream blood cells dropped.

The researchers also used a drug that temporarily blocked both A and B forms of myosin II, finding that it increased the prevalence of non-dividing stem cells, blocking the more rapid division of progeny.

The researchers believe these findings could eventually lead to the ability to regrow blood stem cells after chemotherapy treatments for blood cancers or even for growing blood products in the lab. Finding a drug that can temporarily shut down only the B form of myosin, while leaving the A form alone, would allow the stem cells to divide symmetrically and make more of themselves without preventing their progeny from dividing themselves.

On the Net:


Using The Spanking Effect On The Development Of Our Children

Self, Family

Disciplining a child is fine, but when has it gone too far?

To Spank Or Not To Spank? Part 2
This week’s newsletter is a continuation of my last newsletter, To Spank Or Not To Spank? Part 1 ( in which we discussed violence in society, how children’s thinking differs from adults and the physiological and neurological effects spanking has on our children. In this issue, we’ll take a look at how spanking affects our children’s behavior.

Spanking And Lying
Using spanking as a punishment leads to the repetition, escalation, or alteration of problematic behaviors. The child becomes accustomed to spankings, but is afraid and confused about what the adult is trying to teach about their behavior.

Why do children lie? To avoid punishment. They do this even when they have gotten in trouble before for lying. When we are stressed, our thinking becomes confused and distorted and our short-term memory is suppressed. After a few spankings, the child may be in such a fearful confused place, they cannot rationally remember that lying leads to spankings. So they lie again.

Repercussions Of Spanking
The 2011 article, "Plain Talk About Spanking," by Jordan Riak* offers some insights about spanking:

  1. Spanking can set children up to be easy prey for sexual predators because we are showing them that their bodies are not their own, they belong to their adult caregivers.
  2. Medical science documents that being struck on the bottom can stimulate sexual feelings. A child who is spanked on the buttocks can connect pain, humiliation and sexual arousal together.
  3. The sciatic nerve, which is the largest nerve in the body, is located deep in the buttocks. Spanking can cause bleeding in the muscle that surrounds this nerve which can result in damage to the leg on the side that was injured. The wave of the force exerted can travel up the spinal column and lead to nerve damage, compression, fractures, and/or soft tissue damage to the tailbone, scrum and vertebral bones.
  4. Spanking or slapping children’s hands can cause fractures or dislocations and lead to premature osteoarthritis.
  5. Shaking a child (shaken baby syndrome) can lead to severe brain and spinal cord damage, injury or death.
  6. The chicken and the egg. Which comes first? Problems at home or problems at school? Children who have problems at home have trouble staying still and focusing at school. They get in trouble at school. Their school calls the parents. The child gets in trouble at home. It’s a vicious circle where the child's needs are not met at home or at school.
  7. When parents rely on physical punishment, their children tend to be more aggressive and assaultive. Parents who were attentive, supportive and nonviolent, had children with the lowest incidence of antisocial behavior.
  8. Neuroscience research has proven that experience changes the brain. Spanking and its associated pain and fear, administered by those they love, is a stressful experience for children. Studies have shown that children are not consciously or willfully committing, as many of the behaviors for which they are punished as previously believed.
  9. Corporal punishment in schools has not shown to make schools better. Research shows that schools with the highest rates of corporal punishment are the worst-performing.

The article gives references as to where you can go to find the back-up documentation for the above claims as well as comments from other experts and questions and answers.

Meeting A child’s Needs
The belief has been that you either punish the child, or you let them run wild. This is all-or-nothing thinking. In between is a rich field of new understanding, regarding the power of the parent-child relationship.

Children have needs that only parents and primary caregivers can meet. Contrary to conventional thought, meeting a child’s needs does not make for a spoiled child and ultimately, a selfish adult. Meeting a child’s needs shows them a model of care, compassion and engagement. It teaches them the value of who they are, which will help them to grow up and live the same values. Through this modeling, they will pass care, compassion and engagement to others in their lives (the same as violence is passed on through modeling).

How a child is treated lays the template for their relationship with their self and others. Keep Reading...

More parenting advice from YourTango:

Explore YourTango


As campus protests continue, Princeton becomes flashpoint with debate over Woodrow Wilson

Smart Title:

Yale President Vows New Efforts to Promote Diversity

Yale President Peter Salovey announced Tuesday that the university will undertake a series of new efforts to promote an inclusive environment on campus. Among the steps he outlined: adding faculty positions on underrepresented groups and doubling the budgets for campus cultural centers that focus on various groups. He also pledged that he, "along with the vice presidents, deans, provosts and other members of the administration, will receive training on recognizing and combating racism and other forms of discrimination in the academy."

Ad keywords:

Protests at Still More Campuses

Protests over race and diversity continued to spread Monday, with actions at numerous campuses:

  • At Occidental College, students took over parts of an administration building to demand the creation of a black studies major and the hiring of more minority faculty members, The Los Angeles Times reported.
  • At Iowa State University, students and faculty members held a rally to support black students at the University of Missouri, and to draw attention to their concerns about experiencing racism on campus, The Ames Tribune reported.
  • At Niagara University, students walked out of classes to hold a rally on issues of racism and inequality, The Niagara Gazette reported.
  • At the University of South Carolina, about 150 students walked out of class and held a protest to demand that the university do more to promote diversity, The State reported.
  • In Boston, students from 17 colleges held a march against racial injustices, blocking traffic at some points in their protest, Boston.com reported.
Ad keywords:

U of York Apologizes for Statement on 'Men's Day'

Role boards play in the racial debates on campuses (essay)

The long-simmering tensions related to race, ethnicity, inclusion and diversity in higher education have reached the boiling point nationally. The headlines regarding protests and demands, not only by students but also by faculty and staff members, at Claremont McKenna College, Ithaca College, the University of Missouri, Yale University and elsewhere have put such issues firmly on the agendas of boards of trustees everywhere, if they were not there already.

And those recent controversies probably have added a sense of urgency to the conversations. While some boards have been giving these matters some attention for some time, we have now reached a tipping point where all boards must step up to partner in leadership with the president.

Regardless of trustees’ personal or political views on affirmative action and other policies, boards have an important role to play in their fiduciary as well as strategic roles with respect to race and inclusion at their institutions and within the state systems that they govern. The following are some specific steps that boards should consider. They should:

Ask for numbers and climate data. Boards should request meaningful data related to race, ethnicity and socioeconomic diversity; discuss the data and trends over the past three to five years; and understand the implications of what they learn.

Beyond the data on enrollment, retention and graduation rates by race and ethnicity, Pell eligibility, and gender, boards should ask for more granular data to identify meaningful trends. In what degree programs are students of different races and ethnicities enrolling? How well are different demographics of students progressing across these various degree programs?

For instance, are white students succeeding in STEM at different rates than minority students? Does a higher percentage of minority students leave after junior year as compared to other types of students? Or do those students not return as sophomores at different rates than majority students? What about admissions and yield patterns by race, ethnicity and socioeconomic status?

Another type of data to collect relates to campus climate, which differs from asking for information that the institution already has. The methodologies often include surveys, focus groups and interviews. Climate studies may be a significant undertaking, yet they can yield keen insights because they allow personal stories to emerge. They help leaders understand the actual experience of students, faculty and staff in ways that numbers alone cannot.

Ensure a comprehensive diversity plan. In addition to the need to understand current and emerging issues, boards should ensure that the institution has an intentional plan to encourage campus diversity and equity for students, faculty and staff. Such questions include: Is the plan appropriate? Does it address the right elements? Is it consistent with other institutional goals and priorities, such as those outlined in the strategic plan? Are the milestones and metrics sensible? How realistic is the timeline? Does it clarify who is responsible for what?

Hold the president accountable. A primary responsibility of boards is to ensure progress on institutional milestones and goals, and they do this by holding the president accountable. In turn, the board should be assured that the president is holding his or her staff and the faculty accountable for progress, as well. By being explicit about their expectations, the board sends an important signal that it too cares about equity in a sustained and systematic manner.

That said, any new goals must work in concert with other presidential priorities. Unrealistic goals and a constantly changing set of priorities do little to advance the institution or provide an effective North Star for progress.

Support the president. When the institution faces difficult and challenging issues -- as those involving race, diversity and inclusivity frequently are -- a board will also often need to counsel and support the president. Many presidents have and will come under fire for lack of perceived progress on objectives related to diversity and equity. While some deserve the criticisms they receive, others are and have been working diligently on this agenda.

Given the sense of frustration on many campuses, the way forward is often unclear, with no road map. There are no simple, proven strategies or silver-bullet solutions. If progress on diversity were easy, higher education -- and the nation -- would be farther along on these lasting challenges.

Acknowledge complexity. Change in the academy can be difficult and seem slow, much to the frustration of some trustees. The complex and often contentious issues of diversity and inclusion are adaptive challenges, not technical problems with quick fixes or clear answers. In fact, treating these issues as technical problems in order to apply a tried solution may only exacerbate them.

Instead, boards must work with the president, staff, faculty and students to examine the issues, acknowledge the complexity of views of multiple stakeholders, think critically about them, define what can be done and take steps forward -- in some cases boldly, and in others more incrementally.

Make sure a campus protest plan is in place. Headline-grabbing protests have occurred at a handful of campuses and are likely to unfold at others. It is impossible to say which institutions might face significant protests. Boards should help ensure that their campuses are prepared for possible protests and know their role if such protests emerge. Intentional conversations with campus leaders can help articulate a strategy and minimize any risks to people, property and reputations.

Develop a media strategy specifically for the board. An effective approach includes clarifying questions with the board such as: Who speaks for the board? Who crafts the talking points? What do rank-and-file board members say or not say if they are approached by the media?

Any communication strategies also need to attend to social media. How are the institution and the board monitoring it? What are the means of communication that the board should pursue or try to minimize? What are the priority outlets where the board and institution should focus their attention? How agile can such media strategies be if the platforms shift, from, say, Twitter to Instagram?

Discuss lessons learned from other industries, fields or sectors. Many trustees are highly effective leaders in their own industries and fields. They may have lessons and insights to share from outside of higher education that can help campus leaders.

For instance, many corporations and nonprofit organizations have made tremendous strides related to diversity and inclusion in the workplace. Others may have lessons to share from failed efforts that can also be illuminating. Boards should not shy away from serving as counselors when they have insights to share.

At the same time, savvy boards know that not all ideas from corporate or other settings transfer smoothly into higher education. Discovering what applies well or not can only happen through a candid dialogue between the board and the administration.

Look in the mirror. Most boards themselves have a lot of work to do regarding their own diversity. According to the most recent survey of the Association of Governing Boards of Universities and Colleges, the racial and ethnic diversity of boards has not increased significantly over many years. Thus, boards should consider the ways in which issues of diversity, inclusion, voice, power and perspective play out in their own boardrooms.

Key questions to ask include: How diverse is the board? To what extent does it mirror the campus or larger community? What are the experiences of minority board members? Do they feel their voices matter consistently? How well has the board retained minority members? Do they hold positions of board leadership?

Such conversations can be difficult to frame and hold, much like what is occurring on college campuses -- yet they are essential for the board to have. People on the campus must know the board is as serious about addressing such issues within itself as it is within the institution.

Build the campus culture by design, not default. Values matter greatly in the academy. In their dialogues with key stakeholders, boards should always think about the campus culture they want to build and the values they hold most dear and want to perpetuate. Those values should be pervasive throughout the campus -- so embedded in the culture (part of the ethos of the place) that they define all interactions and are defended at all costs. Boards should spend time learning how students experience the climate and culture, what shapes the student experience, and whether that differs across diverse groups and individuals.

Listen to students, faculty and staff. Trustees often are most comfortable in a problem-solving mode. But what may better serve their institutions is simply to be able to listen and empathize with students, withholding immediate judgment. Boards must remember that the heart of the matter is about students, their experience and their success. Moving too fast to solutions without understanding the nuance of the issues may provide a short-term sense of progress but create more significant challenges in the future. Building bridges between the board and students and other groups on the campus may be more important now than it has been in the last decade.

In sum, the challenges of race/ethnicity and equity are longstanding in the academy. Ten years ago, the American Council on Education released a report aimed at new presidents about leadership strategies for campus diversity, Leadership Strategies for Advancing Campus Diversity. The insights still resonate today, because unfortunately the challenges remain even if the stakes are higher now. In addition to the work of administrators, faculty and staff, board members have the potential to add value in creating a campus culture that is truly open, welcoming, respectful, diverse and inclusive.

Peter Eckel is a senior fellow and the director of leadership programs at the University of Pennsylvania’s Alliance for Higher Education and Democracy. Cathy Trower is president of Trower & Trower Inc., a board governance consulting firm.

Editorial Tags:

College of New Rochelle Considers Coeducation

The College of New Rochelle, which has an undergraduate liberal arts college for women and graduate and professional programs that serve women and men, is considering going completely coeducational. The college sent a letter and an FAQ to alumnae, seeking input. The materials make points similar to those offered by other women's colleges that have decided to admit men, with an emphasis on the very small proportion of high school girls who will consider women's colleges.

Such shifts at some women's colleges have led to major protests. Alumnae have created a Facebook page, and it is clear many of them are disappointed by the shift, but also that many fear for the financial future of the college as currently operated.

Ad keywords:

Mizzou protests are a pro-democracy movement (essay)

This past Friday morning on Facebook, an English professor at the University of Missouri and former doctoral student of mine, John Evelev, made what he says will be his last post about the protests against racism at the University of Missouri. Those protests culminated in the resignation of the system president and the Columbia campus chancellor -- and then led to a horrible number of overtly racist counterprotests and threats of violence against black students, faculty members and even ROTC members.

Evelev has written before about the climate of racism that the students detected and that now pervades the campus. In this post, he extrapolates from their concerns and their protests about racism to the very idea of protest itself, to the concept of participation and civic action in a democracy.

What Evelev wrote is so important to the future of democracy and of higher education that everyone needs to take it in. He has given me permission to quote him here: “While most people see this as simply or exclusively a protest against racism, the proper way to see this is as a pro-democracy movement. Universities and public universities in particular used to be democratic spaces, spaces of civic representation in American life. Faced with decreased public funding, they are being run more like businesses with leaders who are unresponsive or downright dismissive of students and faculty. The student protesters, along with the faculty and administrators who worked to remove Tim Wolfe, UM system president, and R. Bowen Loftin, the chancellor of the Columbia campus, were not just fighting racism, but fighting for university leadership that was democratic, responsive to the community, that recognized the university is not just an institution with a really bad profit stream. It is easy enough for the right-wing to dismiss the goals of the students as ‘getting rid of racism,’ but what they really don't want is an American population that actually seeks representation in their institutions, whether education or political. If faculty want shared governance, they are ‘living in an ivory tower.’ We should all want more involvement, more stake-ownership in the important public institutions of our society, not less.”

The students were protesting against racism, a climate of racism, and specific racist acts. They were also protesting against being silenced, being rendered invisible -- which, of course, is one of the most devastating, debilitating and definitional features of racism. The students were also advocating for the ability to have a voice, to make oneself heard. If anyone is silenced in a democracy, we no longer have democracy. That is true particularly of race, especially at this historical moment, as these students have shown us.

It is also true about democracy in general. What I believe John Evelev is saying here is that, in their protest, these students represent the highest aspirations of all education, higher education and public education. Indeed, they represent, as he so beautifully states it, the aspirations of a public in democracy itself.

We have seen so many attempts to suppress democracy and participation in public life -- from voting rights being curtailed to Supreme Court rulings making corporations into “people,” thus allowing businesses and the vastly wealthy to have inordinate power in shaping democracy. President Jimmy Carter has said we are no longer a democracy but an oligarchy, and many social scientists have said that, by definition, he is correct. Is this the society we want?

We cannot, as a nation, allow this to happen. We must reverse this terrible tendency. And the university is the place where this re-energizing of an idea of a “public” must begin. The university is where young people who are minors learn to become full active adults. If universities were only about vocational training, learning how to participate in a democracy would be a secondary factor. And for the vast numbers of full adults returning for skills redevelopment, this certainly may be true.

But we in America have opted to make higher education the place where we send those who are just reaching their majority: these are our children, our nation's future. And we hope that, when they graduate, they will not only know more about a subject, field, discipline and vocation. We also hope and believe that they will be ready to be fully responsible adults, productive members of a society.

In a democracy, that means participation. That means standing up for one's beliefs -- in a way that is civil, responsible, meaningful and true. That means learning to think clearly and articulate one's ideas. It means being able to write eloquently and express one's opinions persuasively. It means knowing not just a subject matter but why that subject matters in the world.

And sometimes it means protests -- especially when an open car, in which the president of your university rides, drives into a stadium in an official capacity and moves forward into a group of protesters, possibly even, according to one accusation, clipping one. Throughout this, the president sits in the car silently. These are his students, at his university. And they are black students. In Missouri, a state already riven by the racial incidents in Ferguson.

There is a lot of talk about whether or not the president should have resigned. It is his prerogative to resign. No one forced that decision. I don't know enough to comment.

What I do know for sure, about any university president, is that he or she must set the moral compass of the institution. Silence, in the car and in the aftermath, is not setting an example, is not modeling public discourse, is not addressing a problem. In view of that, it is not a surprise that Wolfe resigned. Not because of protesters, but because their protest threw into such vivid light what he himself had not addressed for over a month of a silence.

He isn't just anyone. He is the president, the leader. His actions and his words represent the university. He embodies, in actual and symbolic power, what higher education and democracy are for.

Was he afraid to speak? We don't know.

In some ways, the resignation is as baffling as the silence leading up to it. Open, public, intelligent discourse -- from the beginning and with wise and attentive and concerned leadership of the president -- might have been far better for everyone. Now two senior leaders will be replaced with two other senior leaders. What does that solve? Replacing one president with another does not change the conditions of the university. Replacing one administrator with another does not redress the problem of racism.

Leadership change changes leadership. Period. Open, strategic, participatory democratic attention is required to identify, address and solve a systemic problem. Change will only happen if whoever comes into the positions is committed to a better way. Such commitment is hardly a foregone conclusion.

That leads to a larger issue, one that Evelev is pointing to because it is a condition of higher education throughout the United States now. University presidents everywhere are under tremendous pressures these days, especially at public universities, to speak certain kinds of carefully guarded and protective and screened truths or be faced with trustees who want their resignation. More and more presidents are being chosen by such boards, sometimes without real support from the faculty members, students, staff, alumni or other administrators. The case of the University of Iowa is especially pertinent here.

But it is a pattern, an alarming one. President after president is being pressured to respond to politics, not to the mission and the calling of higher education. And I don't mean the small-p politics of student protests but the larger party politics of governors, trustees and funders who have ideological motivations and corporate ones, too.

Higher education must be about the free circulation of ideas, about genuine and responsible expression of ideas, about public discourse at its highest and its most urgent, about debate and dissent conducted in public as well. If there is no room for democratic discourse at a university, then our society is, quite simply, sunk.

Indeed, since John Evelev’s original Facebook posting, the terrible violence in Paris has given new meaning to the call for sane, rational, informed discourse in a democratic society. Innocent people have been murdered. And one reason they have been murdered is because terrorists do not want sane, democratic discourse. They seek to feed blind, uninformed panic. Such panic can lead to retribution not just against the guilty (who deserve it) but also against innocent people who can seem (to outsiders) to share characteristics of ethnicity, race or immigrant status with the perpetrators of violence.

Feeding a cycle of unthinking blame laid against the innocent is exactly what terrorists want. We are hearing far too much of this xenophobia already in the tragic response to a terrible tragedy.

And that brings us back, again, to the issue of racism. Attributing guilt to an entire group is, of course, one attribute of racism.

We have bequeathed to this generation the legacy of a frightening, complex world where the solutions are as difficult to understand as the problems. It will be their job, in the future, to solve these problems. There is no more profound mission of the university than to help prepare them for a future where informed democratic discourse and deep and substantive critical thinking are in constant danger of being drowned out by the forces of ignorance, prejudice and violence. It is a formidable challenge. The least we can do is respect the seriousness of the struggle.

Cathy N. Davidson is a distinguished professor and director of the Futures Initiative at the City University of New York's Graduate Center.

Editorial Tags:

Police Incident at Brown U Derails Latino Meeting

Ad keywords:

Christian For-Profit Adds Benefits for Same-Sex Partners

Grand Canyon University, a Christian for-profit institution, announced Friday that it will extend spousal benefits to same-sex partners of employees. A statement announcing the shift stressed that the university continues to believe "that the Bible is clear about marriage being a sacred union between a man and a woman." But the university said that "in this specific instance, GCU is making a conscious choice to maintain its religious beliefs, while respecting and honoring its neighbors, as well as the system of government and laws that exist today, by extending employee benefits to spouses of lawfully married same-sex couples." The statement stressed that Grand Canyon was making the decision itself, and not being forced to change policies. But the American Civil Liberties Union recently threatened to sue Grand Canyon if it did not treat employees in same-sex marriages the same as employees in opposite-sex marriages.

Two Christian colleges that treat gay married employees the same as straight married employees recently ended their membership in the Council for Christian Colleges and Universities, amid opposition from many CCCU members to same-sex marriage and a view expressed by some of those members that colleges that recognize same-sex marriages should be excluded from membership. Grand Canyon has no affiliation with the CCCU.

Ad keywords:

Rallies at Many Campuses Over Race, Debt

Students on many campuses held rallies Thursday to back black students at the University of Missouri at Columbia and to push for better treatment of minority students at their own institutions. Here are some local press reports about rallies at Guilford College, Loyola University Chicago, and the Universities of Michigan, Washington and Wisconsin at Madison.

Thursday was also the day for the Million Student March, which led to rallies at many campuses to call for free public higher education, the cancellation of current student debt and a $15 minimum wage.

Ad keywords:

Subscribe to RSS - diversity
Back to Top


Where is the best place to buy letters? by [deleted] in Sororities

[–]bethany930 2 points3 points  (0 children)

There are some locations where you can go and order letters. If you live in the New Jersey area, Rutgers University has a store called Scarlet Fever and you can bring in your own shirts, fabric, etc and get letters for a pretty good price. They also have shirts and fabric there too but it might cost a little more. If this doesn't work, customgreekthreads.com and somethinggreek.com are both really good websites, though somethinggreek is a little cheaper and they have packages.

Are any of you members of chapters without a house? How does that work out? by samshine in Sororities

[–]bethany930 -1 points0 points  (0 children)

Do you think it would be beneficial/detrimental if your chapter had a house? I think it would be beneficial because when a chapter has some internal issues (everyone has them, let's be real) it would force everyone to mediate their problems because at the end of the day, we all live together. Also, it just makes campus living arrangements easier. You don't have to worry about getting paired up to live with someone totally random that you may not trust, because you'll be living with a sister.

Where do you hold your meetings and rituals? We usually have to book rooms through student life. It can be a royal pain, especially if for some reason our application doesn't get put through. However, the entire student center is booked during recruitment by the IGC board.

Do you display composites anywhere? If so, where? At recruitment, and that's unfortunately it. I honestly don't even know why we get the giant composite frame since we have nowhere to store it. But we each get a mini composite to hang in our dorms each year.

What sorts of activities do you do to keep sisterhood strong? We usually do a pot luck dinner every once in a while, we have social events and sister dinner in the cafeteria once a week.

How many active members are there in your chapter? When I joined, there were about 50 sisters. Right now, we're at 45ish. On average, we usually have around 40 sisters.

Is there a specific reason for not having a house? (e.g., finances, local laws, etc.)? Local laws, if you have more than 5 girls living in a house it's considered a brothel.


Thursday, August 6, 2015

What Laika BOSS means to NIDS

I’ve long advocated for analysis of files transferred through the network. I’d like to explain how I feel Laika BOSS relates to NIDS. Just as we need NIDS to decode network protocols, apply signatures, and collect metadata on network traffic, so too we need a file-centric analysis system. Laika BOSS is this system, or at least an instance of this class of system. It performs recursive file format decoding, signature matching appropriate for files (yara), and metadata extraction. Laika BOSS is the widget to which NIDS should offload analysis of payload objects. Laika BOSS is the polished implementation of the file analysis portion of the vision that Ruminate IDS advanced.

As explained in my plea for NIDS to adopt an interface for external analysis of payload objects, the motivation for this separation comes down to specialization/Unix philosophy and general need for file analysis capabilities. There is a market for really good NIDS. I see the need for really good file-centric IDS (FIDS). They should be plumbed together, but the file analysis systems need to support more than just NIDS sources. If Laika BOSS’s relatively simple zeroMQ message format becomes the de-facto interface NIDS use to provide files for external analysis, I’ll be flattered.

Some NIDS will be tempted to try to build Laika BOSS style analysis into their core engine. While some steps towards greater payload visibility will always be welcome, going too far down this path will be a distraction. This will ultimately be similar to NIDS that have tried to bring in external log analysis/SIM functionality. A NIDS specific file analysis framework will always lag in content compared to a general purpose file IDS. More importantly though, there is still much to be done in the realm of network protocol analysis. The security community is much better served with NIDS engines that focus on support for protocols such as RDP, SMB, and HTTP2 over file formats such as JAR, SWF, and PDF. If a NIDS project wants to implement their own FIDS, I'd recommend keeping them separate, similar to Snort/Razorback.

In addition to opportunity cost, today’s NIDS just can't support the depth of analysis on files that some users want. This isn’t to say that current NIDS aren’t making an effort to provide these features. Both Bro and Suricata are both making strides towards this goal. I think the lua based rules that Emerging Threats has developed for Suricata, including functionality such as decompressing a JAR and analyzing constituent files, has given the community a taste of what must be.

However, today’s NIDS, at least as currently architected, can’t support the depth of analysis that is needed for today’s complex file formats. It’s not just the complexity of desired workloads that is a problem, it’s also inability to scale to ever increasingly parallel and economic platforms. It’s easy to pay for servers totaling dozens of CPU cores, but current NIDS architectures can’t scale well beyond about 16 threads, let alone operate on cloud resources. Suricata is the only mainstream NIDS that I know of that supports dynamic load balancing, but in practice this doesn’t scale well, with most high speed implementations using static load balancing for relatively independent worker threads. (And no, mechanisms such as the AF_PACKET rollover option do not help if they balance packets from the same stream to different workers, breaking stream reassembly).

The Laika BOSS white paper reports statistics from a real network using Laika BOSS configured with many modules including CPU intensive detection mechanisms for some file formats. Most object scan times are under 50ms but the average time spent processing a portable executable is 83s. My previous studies on this topic have convinced me that this level of variance in throughput will never be feasible in the current NIDS paradigm because as one scales up the number of NIDS threads, the limit on scalability remains the worst case load distribution. However, many want to be able to do this depth of analysis and are more than happy to pay for commodity CPUs to do it. Most users are willing to put depth of analysis in front of IPS capabilities and the associated real time constraints. If NIDS provide files to Laika BOSS asynchronously, the additional layer of dynamic load balancing makes this level of analysis feasible.

We’re very close to being able to provide payload files to external systems in current NIDS. Both Suricata and Bro can write files out to a filesystem. Furthermore, lua scripts in Suricata have access to reassembled file payloads. Bro has a new file analysis framework. There are a few limitations with all of these approaches. In many cases, providing network layer context for a file is not straightforward. In other cases, access to the file is provided in chunks instead of in a single buffer. However, I hope that in the near future, we’ll see efficient integration of Laika BOSS with NIDS, allowing the offloading of analysis of all objects passing through the network. In the meantime, there are organizations using Vortex/Ruminate derivatives to provide network payloads in a scalable, if not ugly way.

I heartily endorse Laika BOSS. I’m proud that Lockheed Martin has made this tool open source. I feel it has a good shot at becoming the file analysis engine that the community needs. I believe that the ease of creating modules and the general interface suitable for many use cases will make it popular among users. I hope that NIDS engines are soon able to efficiently integrate with Laika BOSS to offload file-centric analysis.

Saturday, June 21, 2014

Tactics for Storing Security Event Data

Security event data typically has the following properties:
  • Organized primarily by time
  • Limited, Fixed Retention
  • Immutable
  • Not Highly Relational
And queries usually have the following properties:
  • Very high insert to query ratio
  • Core indicator types (ex. IP) comprise most searches

Why Mongo?

Events are Stored to be Deleted

Working Set Blues

Tiered Storage Please

Indexing the Kitchen Sink

Stop the Sync Shell Game

There is no Trie

Lower the Resolution Please

Trading CPU for IOPS

Saturday, October 19, 2013

BlueLight: A Firefox Extension for Notification of SSL Monitoring

Recently I built a Firefox Extension that was useful for my particular, if not peculiar needs. I wanted to share with any who might find it useful. BlueLight is designed to provide notification of SSL inspection--the type that is common for organizations to perform on the traffic of their consenting users.

There are many tools, and no shortage of Firefox extensions, that relate to SSL security and detecting MitM attacks. CipherFox and similar extensions are very useful, but didn’t fit my specific need because they aren’t quite noisy enough--I wanted more active and intrusive notification when CA’s of interest were used. Certificate Patrol and similar systems are useful for detecting the introduction of SSL inspection, but these systems don’t fit the scenario of overt, consensual, and long term SSL inspection. BlueLight is based heavily on Cert Alert. In fact, if the alerting criteria in Cert Alert wasn’t hardcoded, I’d probably be using it for this purpose.

BlueLight is useful when SSL Inspection is occurring, usually through a MitM scenario on web proxies using organizational PKI. Obviously, being notified of this on a per site basis is only useful when the organization is selective about what traffic is inspected—if everything is MitM’d then this notification provides no value.

Some claim that users are more secure when their traffic is subject to the organizations protections and monitoring. In this case, BlueLight provides re-assuring feedback to the user, letting them know that they are covered. Others may want to use BlueLight to know when they are under the purview of surveillance. It may deter them from taking some action while being subject to monitoring. In the case that monitoring should not occur on specific traffic, it provides useful notification to the user, so that the erroneous inspection can be rectified. In this vein, I’ve seen BlueLight be particularly useful as it alerts for all SSL elements of the page, not just the main URL (it alerts on the first occurrence, and only the first occurrence).

BlueLight isn’t designed to be useful for other scenarios such as detecting unauthorized SSL MitM attacks or any other covert SSL malfeasance. However, since BlueLight can be configured to alert on basically any certificate issuer, it may well be useful for other similar uses.

BlueLight has to be configured by the user to be useful. As it is, it’s probably only useful to reasonably technically savvy folk. In sharing BlueLight with the larger community, I hope it might be useful to others. BlueLight can be downloaded from or from

Monday, August 5, 2013

Intelligence Compliance: Checklist Mentality For Cyber Intelligence

The past few years have seen a sharp increase in the amount of targeted attack intelligence shared and the number of venues used for sharing. There is a geeky fervor emerging in the community rooted in the premise that if we accelerate sharing and consumption of intelligence, even to the point of automation, we could significantly improve network defense. Momentum is snowballing for adoption of specific standards for intel sharing, the foremost of which is the mitre suite of STIX/TAXII/MAEC. There is a seemingly self-evident necessity to share more intel, share it wider, and share it faster.

As someone who seeks to apply technology to incident response, I see great promise in standards, technology, and investments to accelerate the distribution and application of threat intelligence. I’ve spent years developing capabilities to perform security intelligence and have seen first-hand the benefits of information sharing. The amount of security data exchanged will likely continue to grow. However, I have concerns about the shift from security intelligence to intelligence compliance and about the fundamental benefit of comprehensive distribution of threat intelligence.

Compliance Supplanting Analysis

Information sharing has been critical to the success of intelligence based network defense. Direct competitors from various industries have come together to battle the common problem of espionage threats. Threat intelligence sharing has been wildly successful as sharing has included relevant context, has been timely, and as the attackers have been common to those sharing. Years ago, much of this sharing was informal, based primarily in direct analyst to analyst collaboration. Over time, formal intel sharing arrangements have evolved and are proliferating today, increasing in count of sharing venues, the number of participants, and the volume of intel.

The primary concern I have with this increase in intel sharing is that it is often accompanied by a compliance mindset. If there’s anything we should have learned from targeted attacks, it is that compliance based approaches will not stop highly motivated attacks. It’s inevitable that conformance will fail, given enough attacker effort. For example, targeted attackers frequently have access to zero-day exploits that aren’t even on the red/yellow/green vulnerability metric charts, let alone affected by our progress in speeding patching from months to days. The reactive approach to incident response is focused primarily on preventing known attacks. As a community, we have developed intelligence driven network defense to remedy this situation. It allows us to get ahead of individual attacks by keeping tabs on persistent attackers, styled campaigns in the vernacular, in addition to a proper vulnerability focused approaches. The beauty of intelligence driven incident response is that it gives some degree of assurance that if you have good intelligence on an attack group, you will detect/mitigate subsequent attacks if they maintain some of the patterns they have exhibited in the past. This may seem like a limited guarantee, and indeed it is narrow, but it’s the most effective way to defeat APT. Intelligence compliance, on the other hand, promises completeness in dispatching with all documented and shared attacks, but it makes no promise for previously unknown attacks.

To explain in detail, the point of kill chain and associated analysis isn’t merely to extract a proscribed set of data to be used as mitigation fodder, but to identify multiple durable indicators to form a campaign. This has been succinctly explained by my colleague, Mike Cloppert, in his blog post on defining campaigns. The persistence of these indicators serves not only as the method of aggregating individual attacks into campaigns, but the presence of these consistencies is the substance of the assurance that you can reliably defeat a given campaign. By definition, individual attacks from the same campaign have persistent attributes. If you have a few of these, 3 seems to be the magic number, across multiple phases of the kill chain, you have good assurance that you will mitigate subsequent attacks, even if one of these previously static attributes change. If you can’t identify or your IDS can’t detect enough of these attributes, security intelligence dictates that you either dig deeper to identify these and/or upgrade your detection mechanisms to support these durable indicators. Ergo, defense driven by intelligence dictates you do analysis to identify persistent attack attributes and build your counter-measures around these.

Intelligence compliance, on the other hand, provides no similar rational basis for preparation against previously unseen attacks. Surely, a compliance focused approach has some appeal. It is often viewed as seeking to ensure consistency in an activity that is highly valuable for security intelligence. In other cases, less critical drivers overshadow primary mission success. Intel compliance provides a highly structured process that can be easily metered—very important in bureaucratic environments. The one guarantee that intelligence compliance does give is that you have the same defenses, at least those based on common intelligence, as everyone else in your sharing venue. This is important in when covering your bases is the primary driver. This provides no guarantee about new attacks or the actual security of your data, but does allow you to ensure that known attacks are mitigated, which is arguably most important for many forms of liability. Lastly, giving, taking, or middle manning intel can all be used as chips in political games ranging from true synergies to contrived intrigues. Intelligence compliance provides a repeatable and measurable process which caters to managerial ease and is also able to be aligned with legal and political initiatives.

There are limitless ways in which intelligence compliance can go wrong. Most failings can be categorized as either supplanting more effective activities or as a shortcoming in the mode of intelligence sharing which reduces its value. It is also fair to question if perfect and universal intelligence compliance would even be effective. Remember, intelligence compliance usually isn’t adopted on technical merits. The best, if not naïve, argument for adoption of this compliance mindset is that intel sharing has been useful for security intelligence, hence, by extrapolation, increasing threat data sharing must be better. Sadly, the rationale for a compliance approach to intel sharing frequently digresses to placing short-sighted blame avoidance in front of long term results.

The primary way in which intel compliance goes awry is when it displaces the capacity for security intelligence. If analysts spend more time on superfluous processing of external information than doing actual intelligence analysis, you’ve got serious means/ends inversion problems. Unfortunately, it’s often easier to process another batch of external intel verses digging deeper on a campaign to discover resilient indicators. This can be compared to egregious failings in software vulnerability remediation where more resources are spent on digital paper pushing, such as layers of statistics on compliance rates or elaborate exception justification and approval documentation, than is expended actually patching systems. An important observation is that the most easily shared and mitigated indicators, say IP addresses (firewalls) or email addresses (email filters), are also easily modified by attackers. For that reason, some of the most commonly exchanged indicators are also the most ephemeral, although this does depend on the specific attack group. If an indicator isn’t reused by an attacker, then sharing is useful for detecting previous attacks (hopefully before severe impact) but doesn’t prevent new attacks. A focus on short-lived intel can result in a whack-a-mole cycle that saps resources cleaning up compromises. This vicious cycle is taken to a meta level when human intensive processes are used despite increased intel sharing volume, putting organizations too far behind to make technological and process improvements that would facilitate higher intel processing efficiency. This plays into the attacker’s hand. This is exactly the scenario that security intelligence, including kill chain analysis, disrupts--allowing defenders to turn an attacker’s persistence into a defensive advantage.

Another intel sharing tragedy occurs when attack data is exchanged as though it is actionable intelligence and yet it’s no more than raw attack data. There are many who would advocate extracting a consistent set of metadata from attacks and regurgitating that as intelligence for sharing to their peers. I’m all for sharing raw attack data, but it must be analyzed to produce useful intelligence. If the original source doesn’t do any vetting of the attack data and shares a condensed subset, then the receiver will be forced to vet the data to see if it’s useful for countermeasures, but often with less context. The canonical example which illustrates the difference between raw attack data and intelligence is the IP address of an email server that sent a targeted malicious email, where that server is part of a common webmail service. Clearly this is valid attack data, but it’s about as specific to the targeted attacker as the license plate number of a vehicle the terrorist once rode in is to that terrorist, given that vehicle was a public bus. Some part of this vetting can and should be automated, but effective human adjudication is usually still necessary. Furthermore, many of the centralized clearinghouses don’t have the requisite data to adequately vet these indicators, so they are happily brokered to all consumers. To make matters more difficult, different organizations are willing to accept different types of collateral mitigation, the easiest solution being to devolve into the common denominator for the community which is a subset of the actionable intelligence for each organization. For example, given an otherwise legitimate website that is temporarily compromised to host malicious content, some members of a community may be able to block the whole website while others may not be able to accept the business impact. The easiest solution is for the community is to reject the overly broad mitigation causing collateral impact, while the optimal use of the intelligence requires risk assessment by each organization.

While ambiguity between raw attack data and vetted intelligence is the most obscene operationally, because it can result blocking benign user activity, there are other issues related to incomplete context on so called intelligence. An important aspect of security intelligence is proper prioritization. For example, many defenders invest significantly more analyst time in espionage threats while rapidly dispatching with commodity crimeware. If this context is not provided, improper triage might results in wasted resources. Ideally, this would include not only a categorization of the class of threat, but the actual threat identity, i.e. campaign name. Similarly, often intelligence is devoid of useful context such as whether the IP address reported is used as the source of attacks against vulnerable web servers, for email delivery, or for command and control. This can lead to imprecise or inappropriate countermeasures. Poorly vetted or ambiguous intel is analogous to (and sometimes turns into) the noisy signatures in your IDS—they waste time and desensitize.

With all that being said, I’m an advocate of intel sharing. I’m an advocate of sharing raw attack data, which is useful for those with the capacity to extract the useful intelligence. Realizing that this isn’t scalable, I’m also an advocate of sharing well vetted intelligence, with the requisite context to be actionable. However, even if your shop doesn’t have the ability to process raw attack data at a high volume, sharing that data with those who can ostensibly results in sharing of intel back to you that you couldn’t synthesize yourself. My main concern with intelligence compliance is that it robs time and resources from security intelligence while providing no guarantee of efficacy.

Intelligence Race to Zero

Beyond supplanting security intelligence, my other concern with the increase in information sharing is that as we become more proficient at ubiquitous sharing, the value of the intelligence will be diminished. This will occur whether the intelligence is revealed directly to the attackers or if lack of success causes them to evolve. Either way, I question if intelligence applied universally for counter-measures can ever be truly effective. Almost all current intelligence sharing venues at least give lip service to confidentiality of the shared intelligence and I believe many communities do a pretty good job. However, as intel is shared more widely, it is increasingly likely that the intel will be directly leaked to attackers. This principle drives the strict limitations on distribution normally associated with high value intelligence. It is also generally accepted that it’s impractical to keep data that is widely distributed for enforcement secure from attackers. The vast majority of widely deployed mitigations, such as AV signatures and spam RBLs are accepted to be available to attackers. In this scenario, you engage in an intelligence race, trying to speed the use of commodity intel. This is the antithesis of security intelligence which seeks to mitigate whole campaigns with advanced persistent intelligence.

Note that even if your raw intel isn’t exposed to attackers, the effects are known to the attacker—their attacks are no longer successful. Professional spooks have always faced the dilemma of leveraging intelligence versus protecting sources and methods. If some intelligence is used, especially intelligence from exclusive sources, then the source is compromised. As an example, the capability to decrypt axis messages during WWII was jealously protected. The tale that Churchill sacrificed a whole city to German bombers is hyperbole, but it certainly is representative of the type of trade-offs that must be made when protecting sources and methods. Note that this necessity to protect intel affects it’s use through the whole process, not just merely the decision for use at the end. For example, if two pieces of information are collected that when combined would solidify actionable intelligence, but these are compartmentalized, then the dots will never be connected and the actionable intelligence will never be produced. We see this play out in so called failures of the counter-terrorism intelligence community, where conspiracy theorists ascribe the failings to malice but the real cause is, more often than not, hindrances to analysis.

It’s worth considering how sources and methods apply specifically to network defense. Generally, I believe there is a small subset of intelligence that can be obtained solely through highly sensitive sources that is also useful for network defense. In most cases, if you can use an indicator for counter-measures, you can also derive it yourself, because it must be visible to the end defender. Also, while some sources may be highly sensitive, the same or similar information about attack activity (not attribution), is often available through open sources or through attack activity itself. Obviously, this notion isn’t absolutely true, but I believe it to be the norm. As a counter-example, imagine that a super sensitive source reveals that an attacker has added a drive by exploit to an otherwise legitimate website frequented by the intended victim audience. In this example the intel is still hard to leverage and relatively ephemeral: one still has to operationalize this knowledge in a very short time frame and this knowledge is by definition related specifically to this single attack.

Resting on the qualitative argument of indicator existentialism, the vast majority of counter-measures can be derived from attacker activity visible to the end network defender. This is necessarily true of the most durable indicators. Therefore, I don’t consider protecting sources (for network defense) the biggest consideration and advocate wide sharing of raw attack data. However, that certainly doesn’t mean that the analysis techniques and countermeasure capabilities are not sensitive. Indeed, most of my work in incident response has been about facilitating deeper analysis of network data, allowing durable and actionable intelligence to be created and leveraged. Competitive advantage in this realm has typically been found by either looking deeper or being more clever. In a spear phishing attack, for example, this may be in analysis of obscure email header data or malicious document metadata or weaponization techniques. Often the actionable intelligence is an atomic indicator, say a document author value, which could presumably be changed by the attacker if known. Some may require more sophistication on the part of the defender: requiring novel detection algorithms, correlations, or computational techniques such as that which my pdfrate performs. Either way, the doctrine of security intelligence is based in the premise that persistent indicators can be found for persistent attackers, even if it requires significant analysis to elucidate them. This analysis to identify reliable counter-measures is what security intelligence dictates and is often the opportunity cost of intelligence compliance. I’ve seen some strong indicators continue to be static for years, allowing new attacks to be mitigated despite other major changes in the attacks.

It is my belief, backed by personal experience and anecdotal evidence, that if what would otherwise be a strong mitigation, if kept secret, is used widely, then the lifespan of that indicator will be decreased. In the end I’m not sure it matters too much if the intelligence is directly revealed or if the attackers are forced to evolve due to lack of success, but that probably affects how quickly attackers change. In my experience, it is true that the greater the sophistication on the part of the defender and the greater the technical requirements for security systems, then the less likely useful indicators are to be subverted. However, it’s possible that continued efficacy has more to do with narrow application due to the small number of organizations able to implement the mitigation rather than difficulty of attackers changing their tactics. Often I wonder if, like outrunning the proverbial bear, today’s success in beating persistent adversaries may be more about being better than other potential victims than actually directly beating the adversary. While intelligence driven security, and by extension information sharing, is much more effective than classic incident response, I think it is yet to be proven if ubiquitous intel sharing can actually get ahead of targeted attacks or if attackers will win the ensuing intelligence/evolution race.

One benefit of the still far from fully standardized information sharing and defense systems of today is diversity. Each organization has their own special techniques for incident prevention--their own secret sauce for persistent threats. It’s inevitable that intelligence gaps will occur and some attacks, at least new ones, will not be stopped as early as desired. The diversity of exquisite detections among organizations combined with attack information sharing, even that of one-off indicators, allows for a better chance of response to novel attacks, even if this response is sub-optimal. A trend to greater standardization of intelligence sharing, driven by compliance, will tend to remove this diversity over time, as analysts, systems, and processes will be geared to greater intel volume and lower latency at the expense of intelligence resiliency.

Long Road Ahead

While I’m primarily concerned about being let down when we get there, it’s also important to note that as a community, we have a long pilgrimage before we make it to the ubiquitous intelligence sharing promised land. Mitre’s STIX et al are widely being accepted across the community as the path forward, which is great progress. Now that the high level information exchange format and transport is agreed upon, we still have a lot of minutia to work out. For example, much of that actual schema for sharing is still wide open. For example, many indicator types still have to be defined; standards for normalization and presentation still need to be agreed upon, and the fundamental meaning of the indicators still need to be agreed upon across the community.

I think it’s instructive to compare the STIX suite to the CVE/CVSS/CWE/CWSS/OVAL suite, even though the comparison is not perfect. These initiatives were designed to drive standardization, automation, and improve latency of closing vulnerabilities. There is plethora of information tracked through these initiatives: from (machine readable) lists of vulnerable products, to the taxonomy of the vulnerability type, to relatively complicated ratings of the vulnerability. Despite this wealth of information, I don’t think we’ve achieved the vulnerability assessment, reporting, and remediation nirvana these mechanisms were built to support. Of all the information exchanged through these initiatives, probably the most important, and admittedly the most mundane, is the standardized CVE identifier, which the community uses to reference a given vulnerability. This is one area where current sharing communities can improve—standardized identifiers for malware families, attack groups, and attacker techniques. While many groups have these defined informally, more structured and consistent definitions would be helpful to the community, especially as indicators are tied to these names to provide useful context to the indicators (and provide objective definitions of the named associations). Community agreement on these identifiers is more difficult than the same for vulnerabilities, and building the lexicon for translations between sharing communities is also necessary, as defining these labels is less straightforward and occurs on a per community basis. As we better define these intelligence groupings and use them more consistently in intel sharing, we’ll have more context for proper prioritization, help ensure both better vetted intel and more clear campaign definitions, and have better assurances that our intelligence is providing the value we aim to achieve out of sharing.

In helping assess the effectiveness of information sharing, I think the following questions are useful:
  • How relevant to your organization is the shared intelligence?
  • Is the intelligence shared with enough context for appropriate prioritization and use?
  • How well is actionable intelligence vetted? Is raw attack data shared (for those who want it)?
  • How durable is the shared intelligence? How long does it remain useful?
  • How timely is the shared intel? Is it only useful for detecting historical activity or does it also allow you to mitigate future activity?
  • Do you invest in defensive capabilities based on shared intelligence and intelligence gaps?
  • Do you have metrics which indicate your most effective intelligence sources, including internal analysis?
  • Do you have technology that speeds the mundane portion of intelligence processing, reserving human resources for analysis?

Closing Argument

I’m sure that there are some who will argue that it’s possible to have both security intelligence and intelligence compliance. I must concede that it is possible in theory. However, as there is plenty of room for progress in both arenas, and resources are scarce, I don’t believe there is an incident response shop that claims to do either to the fullest degree possible, let alone both. Also, the two mindsets, analysis and compliance, are very much different and come with a vastly different culture. Most organizations are left with a choice—to focus on analysis and security intelligence or to choose box checking and information sharing compliance.

Similarly, I question the seemingly self-evident supposition that sharing security data ubiquitously and instantaneously will defeat targeted attacks. While there will almost certainly be some raising of the bar, causing some less sophisticated threats to be ineffective, we’ll also likely see an escalation among effective groups. This will force a relatively expensive increase in speed and volume of intel sharing among defenders while attackers modify their tactics to make sharing less effective.

As we move forward with increased computer security intelligence sharing, we can’t let the compliance mindset and information sharing processes become ends unto themselves. Up until the time when our adversaries cease to be highly motivated and focused on long term, real world success, let’s not abandon the analyst mindset and security intelligence which have been the hallmark of the best incident responders.

Saturday, October 27, 2012

PDFrate Update: API and Community Classifier

I am very pleased with the activity on in the last few weeks. There have been a good number of visitors and some really good submissions. I’m really impressed at the number of targeted PDFs that were submitted and I’m happy with the pdfrate’s ability to classify these. I really appreciate those who have taken the time to label their submissions (assuming they know if they are malicious or not) so that the service can be improved through better training data.

There is now an API for retrieval of scan results. See the API section for more details, but as an example, you can view the report (JSON) for the Yara 1.6 manual.

This API may be unconventional, but I do like how easy it is to get scan results. You submit a file and get the JSON object back synchronously. I’ve split the metadata out from the scan results for a couple reasons. First, the metadata can be very large. Second, the metadata is currently presented as text blob, and I wasn’t sure how people would want it stuffed into JSON. If you want both, you have to make two requests. You can also view the metadata blob for the Yara 1.6 manual.

I’m happy that there have already been enough submissions, including ones that weren’t classified well by the existing data sets, that I’ve generated a community classifier based on user submissions and voting. I’m thrilled that there were submissions matching categories of malicious PDFs that I know are floating around but simply aren’t in the existing data sets. I expect that if the current submission rate stays the same or goes up, the community classifier will become the most accurate classifier, because it will contain fresher and more relevant training data. Again, as an example, you can check out the report for the Yara 1.6 manual which now includes a score from the community classifier.

If a submission had votes before Oct 25th, it was included in the community classifier. Some users will note that even though they themselves did not vote on their submissions, they have votes. I reviewed many interesting submissions and placed votes on them so that they could be included in the community classifier. I decided to not do a bulk rescan of all documents already submitted. It wasn't for technical reasons. Note that the ratings occur solely based on the previously extracted metadata and as such are very fast. I did so because I didn’t want to provide potentially deceptive results to users. If a document is in the training set, it is generally considered an unfair test to use the resulting classifier on it, as the classifier will almost always provide good results. Regardless, if you want to have a submission re-scanned, just submit the file over again.

Again, I’m pleased with the PDFrate so far. I hope this service continues to improve and that it provides value to the community.

Saturday, September 15, 2012

Announcing PDFrate Public Service

I’m excited to announce PDFrate: a website that provides malicious document identification using machine learning based on metadata and structural features. The gory details of the underlying mechanisms will be presented at ACSAC 2012.

I’ve been working on this research since 2009, which was a year where the stream of PDF 0-days being leveraged by targeted attackers was nearly unbroken. I’ve refined the underlying techniques to a place where they are very effective in real operations and are addressed rigorously enough for academic acceptance. Note that I originally designed this for the purpose of detecting APT malicious documents but have found it to be largely effective on broad based crimeware PDFs also. Furthermore, it is pretty effective at distinguishing between the two. I can speak from personal experience that mechanisms underlying PDFrate provide a strong compliment to signature and dynamic analysis detection mechanisms.

Those that are interested should head over to the pdfrate site and check out the “about” page in particular which explains the mechanisms and points to some good examples.

PDFrate demonstrates a well refined mechanism for detecting malicious documents. This currently operates on PDF documents. I am close to extending this to office documents. But I see this paradigm extending much farther than just malicious documents. I see wise (and deep) selection of features and machine learning being effective for many things other things such as emails, network transactions such as HTTP, web pages, and other file formats such as SWF and JAR.

I’m happy to provide the PDFrate service to the community so that others can leverage (and critique) this mechanism. Providing this as a service is a really good way for others to be able to use it because it removes a lot of the difficulty of implementation and configuration, the hardest part of which is collecting and labeling a training set. High quality training data is critical for high quality classification and this data is often hard for a single organization/individual to compile. While the current data sets/classifiers provided on the site are fine for detecting similar attacks, there is room for improvement and generalization which I hope will come from community submissions and ratings. So please vote on submissions, malicious or not, as this will speed the development and evolution of a community driven classifier. This service could benefit from some additional recent targeted PDFs.

In addition to the classification that PDFrate provides, it also provides one of the best document metadata extraction capabilities that I’ve seen. While there are many tools for PDF analysis, the metadata and structure extraction capabilities used by PDFrate provide a great mix of speed, simplicity, robustness, saliency, and transparency. Even if you aren’t sold on using PDFrate for classification, you might see if you like the metadata it provides. Again, the about provides illustrative examples.

I hope this service is useful to the community. I look forward to describing in depth in December at ACSAC!


MPSHome Alumni Calendar Contact MyMPS
This Day in History: October 4

1927 – Gutzon Borglum begins sculpting Mount Rushmore.

1941 – Norman Rockwell's Willie Gillis character debuts on the cover of The Saturday Evening Post.

1943 – World War II: U.S. captures the Solomon Islands from the Japanese.

1957 – Leave It to Beaver premieres on CBS.

1965 – Pope Paul VI arrives in New York, the first Pope to visit the United States of America and the Western hemisphere.

1983 – Richard Noble sets a new land speed record of 633.468 miles per hour (1,019.468 km/h), driving Thrust2 at the Black Rock Desert in Nevada.

1985 – The Free Software Foundation is founded in Massachusetts, United States.

1988 – U.S. televangelist Jim Bakker is indicted for fraud.

2006 – The website Wikileaks is launched by Julian Assange.

1626 – Richard Cromwell, English academic and politician, Lord Protector of Great Britain (d. 1712)

1822 – Rutherford B. Hayes, American general, lawyer, and politician, 19th President of the United States (d. 1893)

1861 – Frederic Remington, American painter, sculptor, and illustrator (d. 1909)

1880 – Damon Runyon, American author and playwright (d. 1946)

1903 – John Vincent Atanasoff, American physicist and academic, invented the Atanasoff–Berry computer (d. 1995)

1923 – Charlton Heston, American actor and director (d. 2008)

1937 – Jackie Collins, English-American author and actress (d. 2015)

1941 – Roy Blount, Jr., American journalist and author

1957 – Russell Simmons, American businessman, founded Def Jam Recordings and Phat Farm

1754 – Tanacharison, American tribal chief (b. 1700)

1944 – Al Smith, American lawyer and politician, 42nd Governor of New York (b. 1873)

1970 – Janis Joplin, American singer-songwriter (b. 1943)

1974 – Anne Sexton, American poet and author (b. 1928)

1975 – Joan Whitney Payson, American businesswoman and philanthropist (b. 1903)

2004 – Gordon Cooper, American colonel, engineer, and astronaut (b. 1927)