Know All For Free

How to professionalize the security industry

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:56:00 -0800

How to professionalize the security industry
After more than 400 years the private security industry in the UK can claim advances in proficiency yet continues to fall behind in its pursuit of professionalism. As a private security analyst, I’ll tell you why I believe the industry needs to do more to break away from a public perception that has it as no more than a force of ‘night watchmen.’
I strongly believe that there is no room in the industry for watchmen. Instead, the industry needs to develop a clear career path for those who join, and demonstrate that it is an industry with the ability to make a significant contribution to the overall security of the country.
As a store detective, I worked with a number of the country’s larger retailers. Constant contact with customers enabled me to track a variety of situations but, after around 3 years there are two incidents that remain with me.
The first happened during my first day on duty at a store in Camberley. A couple entered the store and headed for the coat section. The lady removed a coat from the hanger, tried it on and casually walked over to the exit and with her partner made a run for a waiting car-The cost of the coat… £900 - Why high value coats were not protected better and why were they so close to the exit? These are questions I asked myself.
So with this in mind whenever I was assigned to a retail store, during my store tour, I identified items of high value and determined whether they were positioned in a
location that facilitated their easy removal from the store. I always submitted my findings with suggestions for improved security to the store management. Some managers cooperated but most of them didn’t. After all I am only a ‘security,’ what do I know?
On another occasion I was assigned to a store in London Colney. It was located in the middle of nowhere, and no more than two minutes from the motorway. Two big retailers shared the site.
The store I guarded had two fire exits that opened towards the motorway. The toilets were situated between the two stores. For me, this meant that a shoplifter could take bags of merchandise towards the toilet but since technically they are still within the confines of the store security could not interrogate or apprehend them.
The biggest problem though was the merchandising of the stock. There were high value coats and jackets at the entrance. I raised my concerns in discussion with the store manager and gave him the benefit of my professional opinion, but he did nothing. Within a few hours of our discussion, seven of the jackets were snatched. Again, I was proven right.
You see, the store’s location made it easy for shoplifters to drive up to the store, make a quick grab, dash and speed off back onto the motorway. After that incident I advised the manager to remove the rest of the jackets from the entrance. He informed me that the plan for arranging merchandise on the shop floor comes directly from their head office. I suggested that maybe he needed to call the head office and inform them that his store was located in the middle of a ‘free for all’ and the current layout was unsuitable for this location. He listened but never acted on my advice. A few days later thirteen of the jackets were stolen. Finally he decided to remove them from the entrance. But his organization had already lost £5000.
Why didn’t the manager listen to me? Maybe it’s because Security officers have always had a love hate relationship with retail managers.
At times I feel that security is seen by most security buyers as a grudge purchase or an unneeded expense, instead of an investment. The main reason for this perception has been the industry’s inability to clearly define its role in the security pyramid of the UK. Everyone knows that the Police are responsible for enforcing the law, the Armed Forces defend sovereignty, MI5 and MI6 are internal and external operatives. Who or what is a security officer? How does the industry define itself? In marketing there is a saying that it’s not what is said but how it is said. It seems to me that the industry has been unable to define itself to the country and sadly for those who have chosen private security as a vocation.
Four Hundred Years On
The concept of private security is not a modern phenomenon. In fact, private security existed in the UK before the police force. Cave drawings and other archaeological findings clearly attest to the fact that the issue of safety has long been the concern of man from the beginning of time. The earliest security officers can be traced back to the 1600s when out of the desire to protect their property, wealthy merchants established a private security force known at the time as ‘Shiver and Shake Watch’. This was followed by the Bow Street Runners and eventually the Marine Police Force, sometimes known as the Thames River Police and believed to be England's first professional Police force.
It was formed in 1798 by magistrate Patrick Colquhoun and a Master Mariner John Harriott, to tackle theft and looting from ships anchored in the Pool of London and the lower reaches of the river... The 1800s saw the creation of what can be considered the modern police force when the concept of the rights of the individual began to take hold. For the first time tax revenues were used to pay for night watch.
With the development of trade and the expansion of the free market economy also came laws that illegalised many previous practices. At the same time an increase in serious crime brought pressure to bear on the local constabulary and forced officers to prioritize their response,
Once again wealthy individuals decided to purchase their own security. This saw emergence of a more wide spread and professional private security industry. Like most privately owned businesses, the private security industry was left to operate under its own code. The result was near anarchy as criminal gangs drifted into an increasingly profitable industry.
In an attempt to regulate the industry in 2001, parliament enacted the Private Security Industry Act. That led to the formation of the Security Industry Authority.
Today’s security industry is a far cry from the night watch of yester year. It is a multi-billion pound global industry, employs three times more people than the police and engages in a raft of activities from event management to ferrying millions of pounds each day to businesses around the country. More recently it has become involved in the transportation of prisoners,
However, the industry is faced with a number of very important questions:

Step One to Professionalizing – Definition
As security professionals how do we define ourselves? And what powers do we have? If we are to dispel the notion that we are just night watchmen to be called upon as the need arises, the issue of definition needs to begin with the government, police and other stalwarts of security in this country. We are a significant part of the security structure and we are on the frontline of the prevention and maintenance of law and order. But we are a 21st century force with a sixteenth century mandate. We face modern day challenges and are expected to tackle them without the necessary tools or legislation. Consequently, the professionalizing process has to begin with an amendment in the Private Security Industry Act that provides a clear definition of our roles and powers.
Step Two to Professionalizing – Training
Whilst on duty in Camberley, I noticed two women stuffing their handbags with jewelry. I radioed CCTV control to keep a watch on them while I observed them from a distance. When they were satisfied that they had taken enough, they walked out of the store without paying for the merchandise. There were already two security officers positioned at the exit, so as they exited the store they were apprehended. While leading them towards the holding room, one of the ladies dropped to the floor at the entrance of the store and refused to stand up. It took three officers almost forty-five minutes to safely move her to the holding room.
A few weeks after this incident, I was assigned to a store in Cheshunt. While patrolling the aisles, I noticed a female customer remove a scarf and jumper and concealed them in her handbag. I kept her in my sight until she stepped out of the store without paying. I approached her and identified myself as a security officer. On hearing this she sped off. I chased after her and apprehended her in the middle of a car park. I felt I could handle her on my own. This was until a gentleman approached with a knife and threatened me. Because of my training I eventually managed to subdue him and take control of the situation. No one was injured.
Like me many security officers are faced with potentially dangerous situations every day but too many of them are inadequately trained to deal with unpleasant situations.

There needs to be three stages of training: Pre-licensing, Continuous development and Specialization
Pre Licensing
The SIA needs to recruit an adult literacy expert to work with industry professionals to design a training programme. The way the current programme is designed makes it impossible for anyone to absorb all the required information in 30 hours and be able to use it effectively.
Continuous Development
Along with the pre-licensing course work, there needs to be an in-house course designed for security companies that will be used internally to further develop new & seasoned security officers. Developments in security legislation should be incorporated into any continuous training & development programme. Security officers should also be assessed every 3 years to ensure that they are complying with the legislation. The renewal of their license will depend on their continued development and knowledge of the industry...
Specialised Training

If Security officers expect to be treated like professionals, then we must begin to behave as professionals. There is no professional in the world that undergoes only 30 hours of training in their lifetime. With the barrier for entry into the security industry so low we need to raise the level of training to give us the extra recognition we require to be seen as a professional industry.
Conclusion
In this country we have a few of the best institutions in the world: the BBC, Oxford & Cambridge, Scotland Yard, Fleet Street and above all the British Armed Forces. For centuries these institutions have been setting standards for the rest of the world to follow. The introduction of the SIA was another opportunity for Britain to set the standard and create a model of professionalism within the private security industry for the rest of the world to copy and learn from. After all we were the first country to introduce the concept of licensing in the security industry. However, the current structure is not designed for the extra tasks it is expected to undertake. The SIA was created to license security officers and accredit security companies.
Therefore professionalizing the private security Industry will require:

Redefining the mandate of the SIA and restructuring it with the appropriate framework and mechanisms
Defining our role within the grand scheme of the security structure in the UK
Creating a set of criteria for entry
Revamping the training regime to make it fit for purpose

The UK private security industry is seen by some as a gravy train, run by people who have never worked a single day as a security officer. If we are truly serious about professionalizing the industry, we will need to engage with those who understand the challenges facing the various stake holders.
Let those who regulate the security industry be reminded that there is no place in the 21st century for an institution that is run along the lines that made it fit for purpose in the sixteenth century.

Under Creative Commons License: Attribution

Windows 7 security : A great leap forward or business as usual?

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:55:00 -0800

The public release of Windows 7 is approaching fast. Debates and discussions have been raging on the security improvements in the new platform, and some potential problems have also emerged. In this white paper, we run through the most significant changes and additions, and look at what they might mean to users and administrators.
by Chester Wisniewski, Senior Security Advisor, Sophos
Can Windows 7 succeed where Vista didn’t?
The much-heralded Windows Vista had a mediocre reception on its initial release, and never really took off despite great efforts from Microsoft to encourage hardware vendors to use it. Many businesses, wary of numerous issues, opted to stick to the tried and trusted XP until the new platform stabilized with service packs and upgrades.
But Microsoft took a different course – it rushed to create a replacement platform.
The upgrades included with Vista focused on visuals and certain speed improvements. But the platform introduced a number of new or improved security features, most notable of which was the User Account Control (UAC) system, which was designed to prevent unauthorized execution of code. UAC was widely criticized for its intrusive popups, and its reliance on the understanding of a largely untrained user base that is more likely to ignore or disable the alerts than to take the time to decipher their meaning.
Some other minor additions, such as encryption software BitLocker and the Address Space Randomization system, provided a little extra security, while some items such as the one-way firewall and the Security Center remained largely unchanged.
With Windows 7, Microsoft showed that it is paying attention to its critics and has attempted to deal with a number of these issues.
Some of the changes are largely cosmetic, with further upgrades to the desktop look and feel that continue the direction taken by Vista, following the lead of a certain rival operating system with a far better reputation for glossy visual appeal and user-friendly design.
Under the hood, there are new additions and serious
upgrades to previous security measures that offer the promise of greater security as well as ease of use. Microsoft overhauled the interface between users and Vista’s security controls with the Vista Security Center becoming the more fun-sounding, if a bit ambiguous, Action Center. In addition, the company redesigned the UAC, expanded the firewall into a more complete feature and extended encryption. Microsoft also promises a new user-friendly VPN system.
The implementation and completeness of these new ideas will be significant factors in Windows 7 gaining traction with users and IT departments that have resisted upgrading their systems. For the many that have waited so long, upgrades are no longer a choice. Microsoft hopes to avoid a repeat of the Vista experience—so marketing and sales will be pushing hard on customers to upgrade to Windows 7. It is almost certain that Windows 7 will push XP aside. Therefore, the safety level of the new platform will have a massive influence on computer users worldwide, whether they like it or not.
Action stations: Windows Security Center rebadged but not replaced?
Microsoft introduced Windows Security Center with XP and it has remained largely unchanged ever since. With Windows 7 it has been given a major revamp. The new Action Center combines the existing management and control of the firewall, updating and anti-malware protection with a selection of additional system maintenance tasks, including backup, troubleshooting, anti-spyware, UAC and the general state of network security settings.
Windows Vista Users accustomed to the constant stream of alert popups and the old system tray shield badge will experience the biggest change. Windows 7 presents more detailed listings of potential issues, which often come with useful information and advice. Integration with anti-malware solutions is much more granular, enabling products to inform the operating system when they need updating. In Vista, the only information the Security Center could provide was “out of date” or “more than 30 days out of date.” Products can also feed their own customized information to users, enabling them to make more informed choices, and users gain a level of customization (e.g., they can disable functions they are not interested in monitoring).
The new Action Center icon looks like a waving flag; it features a small red mark when something important needs fixing. At first glance it seems like a good idea to do away with the popups, which became almost invisible for many users thanks to their frequent appearance. But the flag icon could be a step too far: The new alerting system may be so obscure as to be rendered useless.
The improved integration and control, and more granular messaging, will help most users and security solution developers. However, striking the right balance between keeping users informed and flooding them with irritating alerts remains tricky.
Access denied: UAC simplified, but still ruined by pester power?
As part of the Action Center lineup (and therefore a core security feature of the platform), the UAC system has also had a radical revision to minimize its impact on the user. In Vista, where it first appeared, the system quickly became notorious for presenting an excess of intrusive alerts and demands for confirmation, which quickly turned off users who consequently turned off the system. Changes to system settings were the main cause of these—rather than new software installations or installed programs trying to adjust a setting (when alerts are more expected and in some cases even appreciated). The new system has a finer level of controls than the simple on or off of the earlier version; it defaults to prompting only when third-party programs try to make changes and allowing changes initiated by the user. A simpler slider system enables a user to set more or less strict data protection with ease. In addition, the occasionally rather scary dimming (and often brief blacking out) of the screen that accompanies the alerts by default can also be disabled. Microsoft also redesigned popups to be more informative.
Microsoft promised a significant decrease in the number of popups, and, indeed, the popups in Windows 7 now have improved information on exactly what is being permitted—so it should make the system more effective. However, it is unclear whether many users will use the system correctly— that’s because most users lack the understanding required to make informed calls, and many are unlikely to think beyond simply making the popup disappear. On a standard desktop running with the “protected administrator” default user, making the popup disappear is as simple as clicking yes or no; the default selection is no, so users who have trained themselves to simply hit the Enter key will find themselves protected from unwanted changes and most likely frustrated by non-functional software.
Another issue with these default settings is that malware could bypass the system by injecting itself into a trusted application and running from there. Indeed, some malware has been observed spoofing UAC-style prompts to obtain user permission to operate unimpeded.
The system is improved from its previous, barely usable state. But it still lacks the features of platforms with more ground-up security models, where such alerts generally provide adequate context and detail so users can grasp exactly what is being asked and require an administrator password even from a logged on administrator— which forces users to consider what they are allowing and take responsibility for their own safety. The UAC concept is user-driven rather than expert-driven, so it is a questionable approach in a world where end-user expertise is rare. Although personal files and tools will require user approval and operation, core system assets should be more rigorously protected.
Border control: Windows Firewall finally fully functional?
One of the most significant security improvements introduced in the XP era was the Windows Firewall. Initial off-by-default versions proved entirely inadequate, so with SP2 Microsoft made a major step change in the security of users worldwide by providing firewalling as a standard feature.
Of course, with only inbound protection rather than the bidirectional control provided by proper firewall solutions, it was far from ideal. Although the basic stateful packet-filtering provided some protection from common exploits, it lacked any advanced features like a full-fledged antivirus; and without central management, policy enforcement and auditing were unsuitable for serious business networks. For most well-informed administrators, it was just another thing to disable before rolling out more comprehensive protection. If nothing else, though, it gave the inexpert, or just lazy, everyday home user a bare-bones level of protection from many forms of attack.
With the new OS, Windows Firewall finally comes of age. The new version provides appropriate inbound and outbound port and protocol filtering including IPv6 support and a raft of features. Detailed user-level configuration is available, but at the corporate network level the improvements are even more significant, with complete management and reporting well integrated into the group policy subsystem.
This all sounds like a major boon to home and business users, but it depends on how broadly it’s adopted, which in turn depends on how willing people are to adapt long-standing security practices. Home users—again, all but the most ill-informed—are using their internet security suites to provide both anti-malware and firewalling, generally with specialist firewall design and integration with behavioral anti-malware providing a much higher level of protection. At the business level, similar practices will apply in most cases, with providers of corporate security solutions bundling desktop firewalling with their other protective layers and providing their own centralized management and reporting systems. Security admin specialists will be charged with monitoring and maintaining all protection in bigger networks. In addition, they will still have to control anti-malware, NAC and other security implementations that are not so well integrated into Microsoft’s own control systems. Security specialists may also face a steep learning curve with the Group Policy Object management style (although it’s familiar to user-level software and policy administrators, and suited to their needs) because it’s so unlike standard workflow patterns in existing security management systems, which are specifically designed to cope with the complex needs of firewall configuration.
For most home and work users, splitting the task of security management between multiple tools, usage layouts and support systems will be a pretty obvious timewaster. The use of firewalls from existing, trusted providers seems likely to remain the norm for the foreseeable future.
Tunnel ahead: DirectAccess, a simple VPN for all?
For corporate administrators, one of the most interesting new security features in Windows 7 is likely to be the new DirectAccess system, which is essentially a built-in VPN client designed to allow users to “simply and more securely access corporate resources when out of the office” (source: Microsoft Windows 7 main page). It is intended to be fully integrated, always on and compatible with firewalls and NAT setups, and to allow both remote access to corporate networks and remote management of logged-in systems by network admins. Remote users are growing ever more commonplace and the issues they present to network security administrators expand in complexity along with their numbers and requirements. Microsoft has recognized the need for major improvements in remote connectivity, so it appears that it will make it very simple and easy to stay safe on the road.
However, there are some major implementation and security issues here. The first big stumbling block an admin will hit when trying to implement DirectAccess is its complete reliance on IPv6. Although theoretically a much superior and more scalable technology to IPv4, IPv6 has yet to make much if any headway in the real world. This means that admins will need to implement IPv6 both on workstations and on the corporate networks, with the inevitable associated learning curve and security lapses when implementing complex and unfamiliar technology for the first time. The alternative, as recommended by Microsoft, is to implement translation technologies at both the workstation and server sides, likely to require different tools and systems for the two, with the associated additional overhead and several more levels of complexity for the administrator – and of course the additional security risk that complexity brings.
Those persuaded to bite the bullet and become early adopters of IPv6 should remember the lessons of the IPv4 introduction – when large numbers of severe vulnerabilities were discovered. It seems inevitable that similar issues will be found with IPv6 when the user base has built up and stumbled across them, and early adopters will be embroiled in a taxing cycle of firefighting and patching until the bugs are ironed out.
There are also some potential dangers in the way Microsoft recommends using the system, which is intended to tunnel traffic securely into corporate networks but allow other activities such as web browsing to use the machine’s typical (usually wireless) connection, presumably to save on corporate resources. This approach will immediately sound alarm bells with security-conscious admins who see such a setup as an open bridge between their carefully protected networks and the threat-riddled frontiers of the internet. In other words, this approach should be avoided at all costs.
When IPv6 finally becomes the norm, this system will be a great leap forward. But it is premature and somewhat lacking in completeness of vision, so serious network admins will stick with their existing VPN providers for some time to come.
Locked out: BitLocker, a business-ready encryption system?
BitLocker disk encryption, which was introduced in Vista, has been somewhat extended and improved in Windows 7. Again, it is included only in the Enterprise and Ultimate editions. It has some hardware requirements as well, including a compatible BIOS and a separate unencrypted boot partition from which to access the encrypted system drive. For optimum performance, a trusted platform module that provides a range of services like tamper protection to allow trusted boot, key storage and basic cryptographic functions, is recommended. In its Transparent Operation Mode, it provides little more than integrity checking on boot, with decryption failing, or at least requiring additional confirmation before proceeding, if unauthorized modifications have been made. The User Authentication Mode offers a more secure level of encryption, requiring a user password or a key stored on a USB drive before the protected system or other volumes are decrypted.
Windows 7 includes an additional set of functionality for encrypting USB removable drives, which should be compatible with Windows Vista without changes. XP users will require a new plugin to access data stored on encrypted key drives, which will at least allow read access. The plugin will only provide protection when the drive is disconnected from the machine; when plugged in, all data on the drive is vulnerable to harvesting if the machine is compromised by malware.
Similar to its improvements in the firewall, Microsoft appears to have done a good job of providing a quality encryption system built in to its operating system. But, again, similar to the situation with its firewall, it remains to be seen if the company, which still has long-standing problems inspiring trust on security matters, will persuade admins to migrate from their existing, well-known and trusted expert cryptography providers. Management remains a key issue, with the implementation of centralized key management and disaster recovery lagging well behind the solid implementation at the local level.
Related to BitLocker in name only, AppLocker provides a basic whitelisting system designed to allow only approved software to run on Windows 7 systems. Available only in the Enterprise and Ultimate editions, it is manageable via the Group Policy model.
More or less: Other security benefits and potential pitfalls
Admins considering implementing Windows 7 in a corporate environment should review a number of other areas where they’ll encounter some good points and some hazards.
Some have highlighted the built-in XP mode virtualization system, which provides full compatibility with older software, as a great benefit to users. Others have pointed out the potential security drawbacks – with good reason. There is little centralized management available for XP mode virtual systems. Moreover, as with any virtual machine, the guest system will require all the usual patch management and client security software to keep it safe. Many inexperienced users think virtual guest systems are protected by the security of the host – not subject to their own patching and anti-malware requirements. Therefore, these users tend to leave these virtual guest systems open to attack and infestation, so significant use of such systems by home users may lead to the growth of infected machines attacking the rest of the world.
In a corporate setting, there appears to be little need for XP mode because most professional software runs without difficulty on native Windows 7. The main target of XP mode appears to be gamers clinging to aged favorites. Most admins should simply disable XP mode in the corporate desktops; and those who must allow it should follow the usual requirements for virtualization, with all the extra work of patching and client-side security conducted as scrupulously as possible.
There have been rumors that European anti-trust regulations may force Microsoft to provide a so-called “E Edition” for the European marketplace. This edition will enable users to select from a range of leading browsers during installation, with the operating system opened up somewhat to allow it to function without Internet Explorer. Although this may be of interest to home users intrigued by the perceived added security and usability of some browsers, corporate software management is generally better served by Microsoft’s regular, if often rather tardy, patching system. Moreover, few businesses will be prepared to fully trust the relatively under-supported open-source alternatives for the time being. For most, using IE as a default and alternatives available as secondary browsers if required is likely to remain the standard.
Microsoft has been heavily criticized for some time for stubbornly clinging to the default setting in most Windows releases to hide file extensions, which has been exploited by malware authors for many years to disguise their wares as something other than what they are. The issue has been around since Windows NT, and is widely regarded as one of the simplest moves Microsoft could make to show it is serious about keeping its users away from malware.
The password authentication model presents a major stumbling block to Microsoft’s highly valued usability, and the company seems to have recognized that the model also has flaws as a security system. One addition to Windows 7 that seems likely to be universally welcomed is the built-in support for biometric devices. It handles fingerprint readers and comes with API access for developers of other types of biometric identification.
A growing number of devices now have integrated fingerprint readers. Although the readers have been implemented with varying degrees of success, this could move authentication away from the easily cracked or stolen password model toward more personal, unique and certain ways of confirming identities. The success or failure of this new model will depend greatly on the close integration of devices with platforms, software and web services, and Microsoft has taken an important step toward providing its end of this package.
With all these new features, will Windows 7 keep me safe?
Whether its motivation arises from a genuine desire to do things better or simply a sensible business case for appearing more credible on security issues, Microsoft has attempted to move closer to an appropriate security model. The company has provided some interesting and useful tools to assist its users and network admins in maintaining control over their systems and data. However, many of these new tools have flaws of one kind or another – and some show serious shortcomings in completeness of vision and thoroughness of implementation. Still others seem like excellent and complete packages waiting only for the rest of the world to be in a position to use them.
Of course, we never expected the new platform to do away with the need for anti-malware and other security and control solutions. But at least Microsoft will be covering most of the security issues for its wide user base of under-educated, under-motivated home users once its new Security Essentials free desktop anti-malware arrives.
Most businesses will stick to third-party expert security software providers. But it’s possible the decrease in numbers of easy targets elsewhere will reduce the numbers of zombies, spam bots.

Under Creative Commons License: Attribution

The 10 Coolest Information Security Careers

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:54:00 -0800

Every time someone asks me about my profession, people’s reaction is often the same: -Wow! So you’re like those hackers I see in the (Hollywood) movies! That’s really cool! Listen, can you discover someone’s password for me?
After an hour long monologue telling them the difference between hackers and crackers, the unethical implications of discovering someone else’s password, the basics of networking functionality and so on, people are still amazed by the knowledge the profession requires and the coolness of “attacking” websites and investigating a computer crime. I guess it’s a reflex of that famous TV series…
But either we like it or not, Information Security careers hold a certain glamour and ignite people’s imagination. Thus, I’ve decided to research a bit further, and write down what each job is about so the next time I’m asked, I’ll just refer people to this page.
This article is also useful if you’re considering to start your Information Security career or looking for some career tips.
So, let’s see what we’ve got. Let me highlight that the career order here purely reflects my personal preference. Objections are welcome!
The article is written in descending order to give you that suspense feeling

10 – Information Security Analyst

This information security job involves assessing the effectiveness of Information Security policies and pointing out vulnerabilities or lack of controls to mitigate a given risk. The security analyst will work with every department in the company to make recommendations for improvements and craft detailed design documents for them to implement. This position has become common place with the advent of ISO 27001, Sarbanes-Oxley and similar regulations and compliance frameworks.
Where to look for a job: basically, every company dealing with information requires an Infosec Analyst.

9 – Incident Responder

Those employed in this information security career will monitor computer systems for security breaches, report and document such breaches and implement appropriate countermeasures. The incident responder will also undertake protective and corrective measures when a security incident is discovered.
Where to look for a job: These professionals are usually found at the SOC or network monitoring department of datacenters.

8 – Network Security Engineer

Network security engineers are responsible for developing, maintaining and troubleshooting computer network security systems, configuring security hardware and software and preparing security reports. These professionals possess deep knowledge of communications protocols, network routing, packet and content filtering. That’s how I started my career, a couple of years ago…
Where to look for a job: Almost every company with a medium/large sized network infrastructure. For small companies, do expect the network administrator to wear this hat.

7 – Chief Information Security Officer

The responsibilities of this information security career are enormous, as CISOs are in charge of an organization’s entire computer security system. The CISO will also oversee the company’s entire network of people who safeguard a company’s digital security, from systems security officers to software and hardware vendors. Their responsibilities may also include identifying a company’s digital protection objectives and defining allocation of resources based on priority areas, as well as overseeing investigation of security breaches and incident response planning. Depending on the country, CISOs are legally liable for a company’s Information Security health.
Where to look for a job: Large organizations.

6 – Information Security Architect

Information Security Architects are the professionals thinking on the big picture: They need not only be aware of every piece of technology deployed within the business architecture, but also understand how and why all of these components interact with each other to achieve the objectives of the enterprise. The architect is involved (or at least should be, but we know how real life is…) at the early stages of any IT project to design and implement the security policies required to protect the integrity, confidentiality and availability of the information on an end-to-end basis.
Where to look for a job: Major organizations, Information Security Services Provider/Consultancy companies.

5 – Forensic Analyst

The professional holding this position analyzes computer systems to identify who is the responsible for the misuse of a system, or to detect whether a certain application was used to commit a crime. His task doesn’t end there: the forensic analyst is responsible for preserving, documenting and interpreting computer evidence subject to legal rules and guidelines.
Where to look for a job: Information Security Services Provider and consultancy companies, major organizations where security is paramount (banking, financial, health, etc).

4 – System, Network and Web Penetration Tester

This job involves attempting to penetrate systems, networks and applications in order to detect their vulnerabilities so that companies can correct flaws and improve their security. The tester must be able to identify flaws in security and bring up possible solutions, as well as providing suggestions on how to better allocate security resources. This information security career is also known as white-hat hacking, ethical hacking and pentesting.
Where to look for a job: Information Security services providers and consultancy companies, major organizations where security is paramount (banking, financial, health).

3 – Information Security Forensics Expert

This information security career involves analyzing the aftermath of a systems security breach by hackers in order to determine how the breach occurred and which of the company’s systems may have been compromised. This position requires security professionals with updated forensic and reverse engineering skills, as well as an awareness of the latest methods of exploiting system vulnerabilities.
Where to look for a job: Information Security services providers and consultancy companies, government agencies.

2 – Malware Analyst

This information security career involves reverse-engineering malicious software such as viruses and spyware in order to determine how they attack computer systems and how they spread as well as define signatures that could indicate their presence within a system. This profession requires a deep knowledge of high and low level programming languages.
Where to look for a job: Security Software makers.

1 – Computer Crime Investigator

This is one of the most glamorous information security jobs as the job holder assists police and forensic investigators with crimes involving computers or with aspects of a criminal investigation involving computers. The computer crime investigator uses advanced technologies to analyze evidence. They will also help law enforcement officials in recovering deleted, hidden or encrypted data from a hard drive which may be of value to an ongoing investigation. It’s also very probable that security clearance will be required if you want to become a Computer Crime Investigator.
Where to look for a job: Law enforcement agencies, Information Security consultancy companies.
Do you agree with my choice? What’s the coolest job for you? Please share your opinion in the comments below!

Under Creative Commons License: Attribution

Choosing A Security Company

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:52:00 -0800

Security is a necessary part of life these days and it is wise to choose a reputable security company for your needs. If you have never done this before, you will need to know just what to look for. If you need security for an event, you may be tempted to hire your own security guards, but how do you know what training they have had for the job? By hiring a security company you won't have to vet each security guard personally, because that job will have been done by the company.

When choosing a security company there are certain things you need to consider. Firstly, their accreditations; don't just accept these at face value though.

You must discuss your requirements with the company to ensure
they can provide exactly what you want. The needs for an event will be different from the security needs of a home. If you are not sure what is needed, then they should be able to give good advice on the matter.

It is always good to get recommendations from previous customers. Ask the security company to provide you with some names you can contact. Follow through and ask these people just how satisfied they were with the security guards and service provided.

Read the small print in their contract and make sure you understand it all. Some companies may require minimum terms for their service. Cost is another point to consider. You will have a budget to stick to, but buying cheap is no use if the service you need is not there.

Can the security company travel and how much extra will this be? There is no use in hiring security guards in Sydney if you live in another centre; security guards in Brisbane will not be likely to travel to Perth. If you have a one-off event, travel costs may be within your budget, but for permanent security, you need someone local. Visit the website of a reputable security company in Sydney or Brisbane. For more details visit at www.alwayssynergy.com.au

(ArticlesBase SC #2032290)

Security Services In Ncr

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:52:00 -0800

Security personnel are not police officers, unless they are security police, but are often identified as such due to similar uniforms and behaviors, especially on private property.

Services provided by any Security Company deals in, the prevention of unauthorized activity or entry, traffic regulation, access control, and fire and theft prevention and detection. These services can be broadly described as the protection of personnel and/or assets. Other security services such as roving patrol, bodyguard, and guard dog services are also included, but are a very small portion of the industry.

Employees of private security companies are generally referred to either as "security guards" or "security officers", depending on the laws of the state or country they operate in. Security companies themselves are sometimes referred to as "security contractors.

AVS Guards takes pride for its ultimate solution in the fields of security services and provides a blend of specialized services which includes Uniformed Guarding Services; we have proven ourselves with our best "SECURITY SERVICES IN NCR" region.

The company was established in 2005 by specialists in this field with years of experience for fulfilling the aim of providing security and detective services all over the country. The company is dedicated for delivering new standards of security and, surveillance support that far exceed the expectations of our clients.

With the endeavor to be a pioneering service provider, we possess progressiveness and productivity in all our operations for effectively securing your tomorrow and today.

Our experienced personnel have extensive experience in handling complex and sensitive case and let the work done by most conscious way.

The success of an organization depends corely on employees. An unsuitable employee is loss in terms of time and productivity. A dishonest employee can also indulge in theft and fraud. A disloyal employee can leak out confidential information to your business rivals and competitors who can then steal a march over you.

AVS offers operational support and training to organizations that require a high level of investigative expertise and discretion including: .........

• Corporate Security
• Industrial Security
• Bouncer Services
• Detective Services
• Residential Security
• Banks / ATM's

AVS works for organizations that require a high level of investigative expertise and discretion Security Services in NCR:

• Corporate Offices
• IT's /BPO's
• Educational Institutes
• Housing Societies
• Financial Institutions
• Healthcare Industry
• Shopping Malls / Multiplexes
• And Other Industries

Security is a feeling that gives confidence. A place featured with innovative security salutations fills the environment with lots of peace and employees work with additional concentration because they are safe. Our aim is to offer services that make your work place safer and ideal for any working procedure. For any further clarification feel free to contact info@avsguards.com.

Under Creative Commons License: Attribution

The importance of information security training

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:51:00 -0800

Information security training is one very important as well as sensitive aspect which needs to be dealt with in the right manner by all companies who work using large volumes of data on a daily basis. Some of this data and information which they are handling on an everyday basis could be of a very sensitive nature and the consequences of this information reaching the wrong hands could also prove to be fatal. Many companies could end up suffering from severe losses if any confidential and sensitive information pertaining to the company is made available to the wrong people. Sometimes the security measures which have been undertaken in order to protect the sensitive data and information are so weak that they can be easily circumvented by any expert hacker. Due to all these security concerns, a lot of companies have decided to make information security training, a mandatory point on the learning curve for all their employees.
The main purpose behind conducting these information security training programs is that all employees will be well qualified to provide the right amount of security and protection for all the sensitive and confidential information which is being handled by the company. Apart from protecting the data and information, they will also be taught as to how they should deal with trespassers who try to gain access to this information and use it for the wrong purposes and also try to destroy it in certain
instances. Network security, secure software development, vulnerability, penetration testing and digital forensics are some of the topics which will be covered as a part of the information security training program.
Cyber security is also another important aspect of these information security training programs. This subject will also prove to be very useful for all the employees who handle sensitive data in the company. The main reason for this subject being given such high priority is that employees will become well equipped to handle any kind of security breach which is likely to take place with regard to the sensitive and confidential company information. They will also understand the various methods which can be adopted to breach the security firewalls which have been created. Auditing in information technology, forensics and hacking are some of the other aspects which will be dealt with during the cyber security module of the information security training sessions.
Penetration testing is one of the most important aspects which will be dealt with under network security. This will help in finding out the exact level of vulnerability by finding out all the loopholes which are present in the current security arrangements which have been created in order to protect all the confidential and sensitive information being handled by the company. Every single shortcoming in the existing security systems will have to be exposed in order to provide the right kind of security systems which will be adequate to protect the data required by the company. All the possible methods of hacking will also have to be explored in order to secure all the sensitive data and information in the right manner to keep it safe.

Under Creative Commons License: Attribution

Top 30 Killer Home Security Tips You Can’t Do Without

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:50:00 -0800

Exterior Security Make sure garage, shed and property gates and fully secured after every use. Purchase more secure locks if necessary. Expensive gardening equipment should be security locked away such as lawn mowers. Be sure all garage doors are locked when leaving the house If you have a door connecting the garage to the house it should be solid wood or metal and secured with a strong lock and dead bolt.
Your garage door should be fitted with a strong security lock which is preferably secured to the floor. Get into the habit of always locking your car door when you come home at night. Bicycles and motorbikes should be secured or locked away safe. If you own ladders make you these are all secured or locked away.
Don’t allow drain pipes to be used to gain access to upper floors. Shrubs, trees and bushes should all be pruned so the burglar cannot hide. Install exterior security floodlighting that works with a motion sensor. Be sure any outdoor lighting is switched on in the evening.
So an emergency service can find your house in an emergency, make sure your house number or name is clearly visible Imagine you have locked yourself out – how easy could you break in? Fix any weaknesses that can allow an easy entry for the burglar.

Exterior Door Security Your external doors should be of solid hardwood or metal construction. Glass panels should be reinforced. Fit a peep hole for viewing visitors. Fit a deadbolt lock into the frame of the door. Always make sure exterior doors are locked, even if you go out for a couple of minutes and especially at night. Give extra keys to a neighbor you can trust and never hide them under the front doormat or in a flower pot.
Window Security Check for rotting window frames and replace if necessary. Secure every window in the house with a high security window lock. Consider security window bars if you think your windows could be smashed in order to gain entry.
General Security Around The Home Use interior timers for your lamps. This will give the impression someone is at home. Use a security safe for all your valuables or deposit them in a bank. Keep firearms security locked in an appropriate firearms cupboard. This should be fitted with a trigger guard lock. Keep an up to date inventory of all of your possessions.
Take digital photos of your possessions and valuables and burn the photos to DVD. Put the DVD in a bank safety deposit box. Have emergency telephone numbers next to your telephone. Make sure your whole family is aware of an evacuation procedure in the event of an emergency such as a fire. Let trusted neighbour know that you are going on vacation so they can watch over your property.
Security mark all valuable items such as your computer, TV, Hi-Fi etc… with an appropriate identification mark as recognized by your local police. Cancel deliveries and papers when on vacation And of course, activate your alarm system when leaving your property.

Under Creative Commons License: Attribution

Advanced Security Training by various companies

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:47:00 -0800

There are a lot of companies that are providing training on the security systems. Security has become a major concern for all of us. There are dangers of thefts everywhere. With internet it has become much easier to break into any system and get password and the username. Decoding of files is also not a problem. To get the latest security and vigilance system a person has to keep the employees who have the latest training in security systems.
The security personnel to be up-to-date in their knowledge and experience should keep themselves abreast of all the development that is taking place in this field. Many times it is necessary for these personnel to enroll themselves in the advanced security training to learn the latest in security business. There are numerous companies that provide certifications on security training and management. These certificates are recognized by people all over the world. There is a lot of hard work needed to earn the advanced security certifications. Those who have worked hard and managed to get this certification have found a new upward graph in their career as security personnel.
Security has become such an important concern that many companies would like to have the best of experts in the field of security as a part of their staff. The certificate provided by the companies providing the training is valuable to the person regarding information security management. Any person cannot get this knowledge only by reading a book.

Different types of companies existing in different parts of the world are now recognizing the need for better quality security training or advanced security training. All the major information about the company's security system and all its internal operations are made available to the security personnel so that they understand all the finer points and intricacies of the system. The training to safeguard all these factors are needed to ensure that the most superior levels of security and protection have been provided for the internal network of every company.
During the training of the person the course offers specialized areas of training that include all the latest news and information of the security systems installed in the company, how to keep a check so that no internal information reaches the wrong hands and there is no breach Management is also taught in the training programs that the level of network security management is also at the top-most level. Network thefts are very common and this aspect is also covered in this course. All the areas of security is covered in the training program from the conventional forms of security to the latest and modern form of network security.
Security training is also taken up with full-force by these personnel and they make the security system of any company impregnable. It becomes very secure as the advance level of training gives the latest and the best possible experience and knowledge to the people undertaking it. The scope in this field is very wide as security is needed by even smaller companies Training in security education will surely be good career choice.

Under Creative Commons License: Attribution

Need for Advanced Security Training

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:47:00 -0800

There has been an increase in the need of security at all levels. Even homes need security systems. The commercial places or offices need more security and for that reason they keep professional people for maintaining security. The professional security people are adept at handling all the security concerns with ease. The threat of insecurity looms large in all fields. To take care of this threat there are better and modern methods for upgrading the security systems.
The security system that was earlier suitable for any commercial or office place is not suitable now and so people are switching over to advanced security training to keep the security up-to date. There is a need in every part of the world for superior quality security training. There is need for keeping the security of companies managed by its internal staff who are trustworthy. They should be given proper training so that they have the latest knowledge and information about security.

It is being acknowledged by everyone that there is need for a better system of security. To improve the system of security there should be better and latest training. To safeguard the interest of the company it is needed that the best levels of security and protection have been provided for the internal network of every company.
You can find many programs that would teach the staff about improving the security system of the company. These training programs are necessary for keeping the security in perfect condition and order. There are many facets in the advanced security training. Teaching the security staff about latest developments has become necessary. There are many aspects in these securities trainings like the penetration testing, attack of web applications, exploit writing, wireless auditing and general penetration testing. These features are some of the aspects which will be covered during these advanced security training courses. People who get these training get better idea about the latest security system.
There is a large potential in this field and those who have taken the latest training will stand to gain. It would be better for their career and future after learning these processes. The level knowledge with regard to security is necessary so that there is better security management in improving at all times and you should be aware of this new knowledge. There will be theoretical as well as practical training in this field to improve the overall awareness of this field. This training program gives full learning process to the people who are undertaking it. There are exams also held and a certificate provided to the qualified personnel.
The course that teaches the further aspects of security training process has a proper lab for everyone and a proper business network is made available to the student in order to practice all the theory which has been imparted during the classroom sessions. There would be practical problems given to the student, which has to be solved by the students.
The whole training programs aims in giving better education on security measures to the students.

Under Creative Commons License: Attribution

How to gain information security training?

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:46:00 -0800

Information technology (IT) has rapidly developed in recent years and has now penetrated into many aspects of business. Though IT offers many advantages to people, there are also some disadvantages. Never in the history of computing has the number of hackers in the society been so high nor the techniques used for hacking been so advanced, than in the present day. A new branch of criminal and civil offenses has been introduced into the law, pertaining to data protection and cyber security. Many sunrise companies now employ teams of IT security professionals in order to protect their own data. This means that there is a high demand for IT security professionals.
Companies require the help of IT security professionals because the implementation of simple security systems has proved to be inefficient in some cases. This is because professional hackers have now gained knowledge on vulnerabilities of this common software. A hacker may be able to compromise with simple security software, if he/she puts a significant effort into it.
Basically, there are two types of Information security training; those security courses which are offered by the company to its employees and those courses which are offered though universities, academies and other IT institutes. Courses which are offered by the company are only available to its employees and are usually free of charge or at a lower cost. Even though the provision of these courses is cost ineffective to the company, there is a high potential for future advantages to the company (as their networks and data will be more secure). These courses mainly consist of basic data protection concepts and contain little or no advanced data protection concepts.

A person can also gain IT security education by enrolling in a security training course offered by an IT institute. The advantage of going through this avenue is that it is more flexible. The person will be able to choose from a wide range of courses, depending upon his/her personal preference. There are two entry level security certifications that are accepted internationally. These are the Security+ certification and the GIAC-GSEC certification. In the United Kingdom, becoming a member of the Institute of Information Security Professionals (IISP) is also advisable for an IT security professional. After gaining a basic entry level certification, the person should then move on to perform a more advanced security course. The Certified Information Systems Security Professional (CISSP) is considered a medium or senior level IT security course. After gaining a CISSP certification, one will then have to choose a particular field of study for advanced level IT security training. The available fields of study are; Information Systems Security Architecture Professional (pertaining to information security architecture), Information Systems Security Management Professional (pertaining to information security management), Information Systems Security Engineering Professional (pertaining to information security engineering) and Certified Information Security Manager (pertaining to information security management).
Even though these courses will provide a person with thorough Information security training, it should not be a stopping point. Hackers are finding new ways to compromise with information systems and so IT security professionals should also be able to rapidly retaliate with suitable new counter-measures.

Retrieved from "http://www.articlesbase.com/internet-articles/how-to-gain-information-security-training-3450278.html"

(ArticlesBase SC #3450278)

Security Awareness tools

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:45:00 -0800

Security is one very important parts of the company. Not all the employees understand the implications of lax security. The employees become negligent after some time and start taking this security issues for granted. They don't take care of small things which can become hazardous for the company. To keep the employees up-to-date and make them understand the implications of negligent security, the employers should give Security awareness tools like various courses to its employees.
The employees should understand the importance of security measures and to explain the importance of security awareness to the employees. The methods to reduce risk in the company and the emerging security threats that could potentially harm the organization. The employees at the higher levels of the company have a higher chance of being directly exposed to security threats on a regular basis. An effective, focused security course will help in training the employees. The employees at higher level are at higher risk to becoming the target of a social engineer and unsuspectingly add to a security breach.

The training courses make the employees aware of the critical security problems like detecting and reacting to potential threats, the identifying physical security vulnerabilities, and the importance of basic security precautions. It is not a simple task to develop a training program. Everyone thinks that they know the basic of training and they will follow them. The only problem is that they slowly grow out of these habits and don't follow any basic security procedures. With time it becomes difficult to follow these steps and it becomes their habit to be negligent. It would prove very dangerous for the company's security.
The Security awareness tools make us more alert and attentive to even a small security measure. The small problems faced by the employees should be taken into consideration during the training session. It would be like a revision of the security steps, but it would be worth it. This training will make the employees to know when to use the defense systems and to be aware from where danger is going to come. Anticipating security breach by being aware is the best way to avert security problems.
The security course make the employees focus on the security and safety at a time when it is reliant upon developing security system. This course focuses on the honest assessment of the vulnerability in a given environment or condition. It will make you prepared to face any threat and to overcome that threat.
The course is versatile way to keep the employees up-to-date in the security measures. If anything point is repeated again and again, then there are chances that it won't slip their mind. Just to make them remember the basic security needs and steps it is necessary to give them a refresher course and what better than this course. The security course will surely make them understand the better points of safeguarding the company and keeping it secure for you. The best way to keep your company free from predators and thieves, it is in your best interest to have this course.

Retrieved from "http://www.articlesbase.com/internet-articles/security-awareness-tools-3450309.html"

(ArticlesBase SC #3450309)

Read more: http://www.articlesbase.com/internet-articles/security-awareness-tools-3450309.html#ixzz1741ny3Df
Under Creative Commons License: Attribution

What Every Web Programmer Needs To Know About Security

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:35:00 -0800

This submission contains slides that complement each of the chapters in the book "Foundations of Security: What Every Programmer Needs To Know" for use by instructors and students alike. The slides cover secure design principles, common web application vulnerabilities, an introduction to cryptography, and much more!

Part 1

Part 2

Part 3

All slides (4.2 MB zip)

http://code.google.com/edu/submissions/daswani/index.html

Security Benefits

noreply@blogger.com (Wagdy Hassan) — Fri, 3 Dec 2010 07:30:00 -0800

Introduction: DNS security threats and mitigations

Because of the open, distributed design of the Domain Name System, and its use of the User Datagram Protocol (UDP), DNS is vulnerable to various forms of attack. Public or "open" recursive DNS resolvers are especially at risk, since they do not restrict incoming packets to a set of allowable source IP addresses. We are mostly concerned with two common types of attacks:

Spoofing attacks leading to DNS cache poisoning. Various types of DNS spoofing and forgery exploits abound, which aim to redirect users from legitimate sites to malicious websites. These include so-called "Kaminsky attacks", in which attackers take authoritative control of an entire DNS zone.
Denial-of-service (DoS) attacks. Attackers may launch DDoS attacks against the resolvers themselves, or hijack resolvers to launch DoS attacks on other systems. Attacks that use DNS servers to launch DoS attacks on other systems by exploiting large DNS record/response size are known as amplification attacks.

Each class of attack is discussed further below.

Cache poisoning attacks

There are several variants of DNS spoofing attacks that can result in cache poisoning, but the general scenario is as follows:

The attacker sends a target DNS resolver multiple queries for a domain name for which s/he knows the server is not authoritative, and that is unlikely to be in the server's cache.
The resolver sends out requests to other nameservers (whose IP addresses the attacker can also predict).
In the meantime, the attacker floods the victim server with forged responses that appear to originate from the delegated nameserver. The responses contain records that ultimately resolve the requested domain to IP addresses controlled by the attacker. They might contain answer records for the resolved name or, worse, they may further delegate authority to a nameserver owned by the attacker, so that s/he takes control of an entire zone.
If one of the forged responses matches the resolver's request (for example, by query name, type, ID and resolver source port) and is received before a response from the genuine nameserver, the resolver accepts the forged response and caches it, and discards the genuine response.
Future queries for the compromised domain or zone are answered with the forged DNS resolutions from the cache. If the attacker has specified a very long time-to-live on the forged response, the forged records stay in the cache for as long as possible without being refreshed.

For an excellent introduction to Kaminsky attacks, see An Illustrated Guide to the Kaminsky DNS Vulnerability.

DoS and amplification attacks

DNS resolvers are subject to the usual DoS threats that plague any networked system. However, amplification attacks are of particular concern because DNS resolvers are attractive targets to attackers who exploit the resolvers' large response-to-request size ratio to gain additional free bandwidth. Resolvers that support EDNS0 (Extension Mechanisms for DNS) are especially vulnerable because of the substantially larger packet size that they can return.
In an amplification scenario, the attack proceeds as follows:

The attacker sends a victim DNS server queries using a forged source IP address. The queries may be sent from a single system or a network of systems all using the same forged IP address. The queries are for records that the attacker knows will result in much larger responses, up to several dozen times¹ the size of the original queries (hence the name "amplification" attack).
The victim server sends the large responses to the source IP address passed in the forged requests, overwhelming the system and causing a DoS situation.

¹See the paper DNS Amplification Attacks for examples, and a good discussion of the problem in general.

Mitigations

Until a standard system-wide solution to DNS vulnerabilities is universally implemented, such as the DNSSEC² protocol, open DNS resolvers need to independently take some measures to mitigate against known threats. Many techniques have been proposed; see IETF RFC 5452: Measures for making DNS more resilient against forged answers for an overview of most of them. In Google Public DNS, we have implemented, and we recommend, the following approaches:

Securing your code against buffer overflows, particularly the code responsible for parsing and serializing DNS messages.
Overprovisioning machine resources to protect against direct DoS attacks on the resolvers themselves. Since IP addresses are trivial for attackers to forge, it's impossible to block queries based on IP address or subnet; the only effective way to handle such attacks is to simply absorb the load.
Implementing basic validity-checking of response packets and of nameserver credibility, to protect against simple cache poisoning. These are standard mechanisms and sanity checks that any standards-compliant caching resolver should perform.
Adding entropy to request messages, to reduce the probability of more sophisticated spoofing/cache poisoning attacks such as Kaminsky attacks. There are many recommended techniques for adding entropy, including randomizing source ports; randomizing the choice of nameservers (destination IP addresses); randomizing case in name requests; and appending nonce prefixes to name requests. Below, we give an overview of the benefits, limitations, and challenges of each of these techniques, and discuss how we implemented them in Google Public DNS.
Removing duplicate queries, to combat the probability of "birthday attacks".
Rate-limiting requests, to prevent DoS and amplification attacks.
Monitoring the service for the client IPs using the most bandwidth and experiencing the highest response-to-request size ratio.

In addition, Google Public DNS' prefetching system, which we developed to improve performance, provides fringe security benefits. It allows us to:

Strictly prioritize prefetch traffic above user traffic, thereby rate-limiting traffic to nameservers.
Partition caches according to the type of traffic, preventing attackers from writing garbage entries to the prefetch cache; and preventing the prefetch system from reading poisoned delegations from the user cache.
Keep enough popular names in the cache to satisfy most user queries, continuing to serve users even when under attack.

²Google Public DNS supports EDNS0, which means that we accept and forward DNSSEC-formatted messages; however, we do not yet validate responses.

Implementing basic validity checking

Some DNS cache corruption can be due to unintentional, and not necessarily malicious, mismatches between requests and responses (e.g. perhaps because of a misconfigured nameserver, a bug in the DNS software, and so on). At a minimum, DNS resolvers should put in checks to verify the credibility and relevance of nameservers' responses. We recommend (and implement) all of the following defenses:

Do not set the recursive bit in outgoing requests, and always follow delegation chains explicitly. Disabling the recursive bit ensures that your resolver operates in "iterative" mode so that you query each nameserver in the delegation chain explicitly, rather than allowing another nameserver to perform these queries on your behalf.
Reject suspicious response messages. See below for details of what we consider to be "suspicious".
Do not return A records to clients based on glue records cached from previous requests. For example, if you receive a client query for ns1.example.com, you should re-resolve the address, rather than sending an A record based on cached glue records returned from a .com TLD nameserver.

Rejecting responses that do not meet required criteria

Google Public DNS rejects all of the following:

Unparseable or malformed responses.
Responses in which the query ID, source IP, source port, or query name do not match those of the request.
Records which are not relevant to the request.
Answer records for which we cannot reconstruct the CNAME chain.
Records (in the answer, authority, or additional sections) for which the responding nameserver is not credible. We determine the "credibility" of a nameserver by its place in the delegation chain for a given domain. Google Public DNS caches delegation chain information, and we verify each incoming response against the cached information to determine the responding nameserver's credibility for responding to a particular request.

Adding entropy to requests

Once a resolver does enforce basic sanity checks, an attacker has to flood the victim resolver with responses in an effort to match the query ID, UDP port (of the request), IP address (of the response), and query name of the original request before the legitimate nameserver does.
Unfortunately, this is not difficult to achieve, as the one uniquely identifying field, the query ID, is only 16 bits long (i.e. for a 1/65,536 chance in getting it right). The other fields are also limited in range, making the total number of unique combinations a relatively low number. See IETF RFC 5452, Section 7 for a calculation of the combinatorics involved.
Therefore, the challenge is to add as much entropy to the request packet as possible, within the standard format of the DNS message, to make it more difficult for attackers to successfully match a valid combination of fields within the window of opportunity. We recommend, and have implemented, all the techniques discussed in the following sections.

Randomizing source ports

As a basic step, never allow outgoing request packets to use the default UDP port 53, or to use a predictable algorithm for assigning multiple ports (e.g. simple incrementing). Use as wide a range of ports from 1024 to 65535 as allowable in your system, and use a reliable random number generator to assign ports. For example, Google Public DNS uses ~15 bits, to allow for approximately 32,000 different port numbers.
Note that if your servers are deployed behind firewalls, load-balancers, or other devices that perform network address translation (NAT), those devices may de-randomize ports on outgoing packets. Make sure you configure NAT devices to disable port de-randomization.

Randomizing choice of nameservers

Some resolvers, when sending out requests to root, TLD, or other nameservers, select the nameserver's IP addressed based on the shortest distance (latency). We recommend that you randomize destination IP addresses to add entropy to the outgoing requests. In Google Public DNS, we simply pick a nameserver randomly among configured nameservers for each zone, without any consideration of response time. Latency is not a consideration because we serve most traffic with responses that have been prefetched , so slow nameservers don't contribute to latency.
If you are concerned about latency, you can use round-trip time (RTT) banding, which consists of randomizing within a range of addresses that are below a certain latency threshold (e.g. 30 ms, 300 ms, etc.).

Randomizing case in query names

The DNS standards require that nameservers treat names with case-insensitivity. That is, the names example.com and EXAMPLE.COM should resolve to the same IP address³. However, in the response, most nameservers echo back the name as it appeared in the request, preserving the original case.
Therefore, another way to add entropy to requests is to randomly vary the case of letters in domain names queried. This technique, also known as "0x20" because bit 0x20 is used to set the case of of US-ASCII letters, was first proposed in the IETF internet draft Use of Bit 0x20 in DNS Labels to Improve Transaction Identity. With this technique, the nameserver response must match not only the query name but the case of every letter in the name string; for example, wWw.eXaMpLe.CoM or WwW.ExamPLe.COm. This may add little or no entropy to queries for the top-level and root domains, but it's effective for most hostnames.
One significant challenge we discovered when implementing this technique is that some nameservers do not follow the expected response behavior:

Some nameservers respond with complete case-insensitivity: that is, they return the same results for equivalent names with different cases in the request; but they do not match the exact case of the name in the response.
Other nameservers respond with complete case-sensitivity (in violation of the DNS standards): that is, they match the exact case of the name in the response; but return different results for equivalent names with different cases in the request (typically NXDOMAIN)!

For both of these types of nameservers, altering the case of the query name would produce undesirable results: for the first group, the response would be indistinguishable from a forged response; for the second group, the response could be totally invalid.
Our current solution to this problem is to create a whitelist of nameservers which we know apply the standards correctly, and to only apply the case randomization technique in requests to those servers. We also list the appropriate exception subdomains for each of them, based on analyzing our logs. If a response that appears to come from those servers does not contain the correct case, we reject the response. The whitelisted nameservers comprise more than 70% of our traffic.

³RFC 1034, Section 3.5 says:

Note that while upper and lower case letters are allowed in domain names, no significance is attached to the case. That is, two names with the same spelling but different case are to be treated as if identical.

Prepending nonce labels to query names

If a resolver cannot directly resolve a name from the cache, or cannot directly query an authoritative nameserver, then it must follow referrals from a root or TLD nameserver. In most cases, requests to the root or TLD nameservers will result in a referral to another nameserver, rather than an attempt to resolve the name to an IP address. For such requests, it should therefore be safe to attach a random label to a query name to increase the entropy of the request, while not risking a failure to resolve a non-existent name. That is, sending a request to a referring nameserver for a name prefixed with a nonce label, such as entriih-f10r3.www.google.com, should return the same result as a request for www.google.com.
Although in practice such requests make up less than 3% of outgoing requests, assuming normal traffic (since most queries can be answered directly from the cache or by a single query), these are precisely the types of requests that an attacker tries to force a resolver to issue. Therefore, this technique can be very effective at preventing Kaminsky-style exploits.
Implementing this technique requires that nonce labels only be used for requests that are guaranteed to result in referrals; that is, responses that do not contain records in the answers section. However, we encountered several challenges when attempting to define the set of such requests:

Some country-code TLD (ccTLD) nameservers are actually authoritative for other second-level TLDs (2LDs). Although they have two labels, 2LDs behave just like TLDs, which is why they are often handled by ccTLD nameservers. For example, the .uk nameservers are also authoritative for the mod.uk and nic.uk zones, and, hence, hostnames contained in those zones, such as www.nic.uk, www.mod.uk, and so on. In other words, requests to ccTLD nameservers for resolution of such hostnames will not result in referrals, but in authoritative answers; appending nonce labels to such hostnames will cause the names to be unresolvable.
Sometimes generic TLD (gTLD) nameservers return non-authoritative responses for nameservers. That is, there are some nameserver hostnames that happen to live in a gTLD zone rather than in the zone for their domain. A gTLD will return a non-authoritative answer for these hostnames, using whatever glue record it happens to have in its database, rather than returning a referral. For example, the nameserver ns3.indexonlineserver.com lives in a gTLD zone rather than in the indexonlineserver.com zone. If we issue a request to a gTLD server for n3.indexonlineserver.com, we get an IP address for it, rather than a referral. However, if we prepend a nonce label, we get a referral to indexonlineserver.com, which is then unable to resolve the hostname. Therefore, we cannot append nonce labels for nameservers which require a resolution from a gTLD server.
Authorities for zones and hostnames change over time. This can cause a nonce-prepended hostname that was once resolvable to become unresolvable if the delegation chain changes.

To address these challenges, we created a "blacklist" file containing exceptions for which we cannot append nonce labels. The file is populated with hostnames for which TLD nameservers return non-referring responses, according to our server logs. We continually review the exceptions list to ensure that it stays valid over time.

Removing duplicate queries

DNS resolvers are vulnerable to "birthday attacks", so called because they exploit the mathematical "birthday paradox", in which the likelihood of a match does not require a large number of inputs. Birthday attacks involve flooding the victim server not only with forged responses but also with initial queries, counting on the resolver to issue multiple requests for a single name resolution. The greater the number of issued outgoing requests, the greater the probability that the attacker will match one of those requests with a forged response: an attacker only needs on the order of 300 in-flight requests for a 50% success chance at matching a forged response, and 700 requests for close to 100% success.
To guard against this attack strategy, you should be sure to discard all duplicate queries from the outbound queue. For example, Google Public DNS, never allows more than a single outstanding request for the same query name, query type, and destination IP address.

Rate-limiting queries

Preventing denial-of-service attacks poses several particular challenges for open recursive DNS resolvers:

Open recursive resolvers are attractive targets for launching amplification attacks. They are high-capacity, high-reliability servers and can produce larger responses than a typical authoritative nameserver — especially if an attacker can inject a large response into their cache. It is incumbent on any developer of an open DNS service to prevent their servers from being used to launch attacks on other systems.
Amplification attacks can be difficult to detect while they are occurring. Attackers can launch an attack via thousands of open resolvers, so that each resolver only sees a small fraction of the overall query volume and cannot extract a clear signal that it has been compromised.
Malicious traffic must be blocked without any disruption or degration of the DNS service to normal users. DNS is an essential network service, so shutting down servers to cut off an attack is not an option, nor is denying service to any given client IP for too long. Resolvers must be able to quickly block an attack as soon as it starts, and restore fully operational service as soon as the attack ends. The best approach for combating DoS attacks is to impose a rate-limiting or "throttling" mechanism. Google Public DNS implements two kinds of rate control:
- Rate control of outgoing requests to other nameservers. To protect other DNS nameservers against DoS attacks that could be launched from our resolver servers, Google Public DNS enforces per-nameserver QPS limits on outgoing requests from each serving cluster.
- Rate control of outgoing responses to clients. To protect any other systems against amplification and traditional distributed DoS (botnet) attacks that could be launched from our resolver servers, Google Public DNS performs two types of rate limiting on client queries:
  - To protect against traditional volume-based attacks, each server imposes per-client-IP QPS and average bandwidth limits.
  - To guard against amplification attacks, in which large responses to small queries are exploited, each server enforces a per-client-IP maximum average amplification factor. The average amplification factor is a configurable ratio of response-to-query size, determined from historical traffic patterns observed in our server logs.
  If queries from a specific source IP address exceed the maximum QPS, or exceed the average bandwidth or amplification limit consistently (the occasional large response will pass), we return
- (small) error responses or no response at all.
- done.
http://code.google.com/speed/public-dns/docs/security.html

Blue Host - Cheap web hosting option ,,

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 20:05:00 -0800

Blue Host is a cheap web hosting company from Salt Lake City, Utah, USA. They are very similar to Gator Host and were established since 2006. They are slightly more expensive that Gator Host but do not charge extra for phone support and I have had excellent phone support from them over the past year from hosting 2 of my blogs with them. From my 1 years experience with them they have great cpanel which is really useful for setting up databases and email accounts. Reliability and speed has also been very good.
CLICK HERE TO SIGNUP FOR BLUEHOST.COM

How much does it cost?

Basic Plan (flat rate):

1 year $6.95/month
2 years $6.95/month
3 years $6.95/month

What do I get?

Unlimited Domain Hosting
Unlimited GB Hosting Space
Unlimited GB File Transfer
Unlimited E-mail Accounts
Free Domain Forever
Free Site Builder w/ templates
$50 Free Google Credit (can only be used by USA customer)

Popularity

Google Trends suggests that Blue Host is gaining in popularity since it was established in 2007.

Hope this article helps you

Hostgator ... Cheap web Hosting Plans ..!

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 19:53:00 -0800

Here is a review of the best and cheapest web hosting options for your blog. Only the best options are shown here as there are alot of bad options available these days!

Why do I need a web host?

Generally speaking, you need a web host to use your own domain name for your blog. For example you want to change your blog from http://blogoola.wordpress.com to http://blogoola.com/blog/ so that it is no longer hosted on WordPress and they don’t put advertising on it allowing you full control over what your readers are seeing.
Another major advantage, is with a blog on WordPress.com you cannot use Plugins but when you haveyour own web hosting you can install plugins which can do all sorts of useful things like get your blog listed in Google or display your Facebook like button etc.
So bascially, if you want to port your blog to your own domain from wordpress you need a cheap web host.

Host Gator is a cheap web hosting company based in Houston, Texas, USA. They are well established with over 220,000 customers worldside and offer all the options that any web hosting company should provide.
CLICK HERE TO SIGNUP FOR GATORHOST.COM

How much does it cost?

Basic Plan:

1 year $4.95/month
2 years $5.95/month
3 years $6.95/month
Monthly $8.95/month

What do I get?

Single Domain
UNLIMITED Disk Space
UNLIMITED Bandwidth
Shared SSL Certificate
4,500 Free Website Templates
45 Day Money Back Guarantee
24/7/365 Technical Support (which has a small charge per call)
$100 Google AdWords Credit

Popularity

Google Trends suggests that Gator Host is gaining in popularity since it was established in 2007.

Web Hosting Sale Friday 26 November 2010

50% OFF EVERYTHING From 12:00AM CST – 5AM CST
80% OFF EVERYTHING From 5AM – 9AM CST (WHILE SUPPLIES LAST)
This applies to ALL Accounts and ALL Term Lengths. So you’re visitors and friends will have the opportunity to receive up to 80% off of up to 3 years worth of Hosting!
That would come out to $35.64 for 3 FULL YEARS! <– Amazing!
For other countries the time in CST is equivalent to:
Australia 4pm Friday 26th November 2010.
United Kingdom 6am Friday 26th November 2010.
CLICK HERE TO SIGNUP FOR GATORHOST.COM

How To Use An Rss Blog Reader

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 16:12:00 -0800

We'd like to introduce you to one of those cool networking tools out there that will help you with your blogging, education, and networking efforts. This may seem like a very basic concept, but our motto is "one step at a time", and we'd like to express the importance of setting this tool up: if you haven't done so already, now would be a good time.
What is this nifty little tool? An RSS blog reader, online blog reader, or RSS feed reader.
What is a blog reader? A blog reader is an organizer for all your favorite blogs. It allows you to collect RSS feeds from all over, into one place, and administer them as you like. You can often group them by name or class, choose to receive email digests, bookmark your favorites, and more.
Readers are provided by many different sites out there, such as: Bloglines, Google Reader, NewsGator, SharpReader, NetNewsWire, or RSS Bandit. (Google Reader is the best RSS feed reader for us). Again, if you don't yet have a reader, take some time this week to get one started — you'll be glad you did.
How to use your reader for blogging. Coming up with content is always on the mind of a blogger, and often a struggle. Keeping up to date on blogs related to your industry can give you fresh ideas of what to write on your own. Don't copy others, but if you have your own fresh take on a subject, or notice something they missed, write about it!
How to use your reader for networking. Networking** is a great way to take part in your online community, and drive traffic to your own website. Find blogs that interest you — news, music, religion, yoga — it doesn't have to be in your industry, just things that interest you. Comment on other people's blogs. Take part in discussions. Thumbs up or down others' comments. A web RSS reader gives you quick access.
How to use your reader for education. The web is abundant with free information and education. We suggest you create a section in your reader of blogs written by the leaders of your industry. This helps you stay ahead of the game, and (most important) continue to provide value to your customers.

Retrieved from "http://www.articlesbase.com/rss-articles/how-to-use-an-rss-blog-reader-2139334.html"

(ArticlesBase SC #2139334)

How to Use RSS to Generate Tons of Traffic to Your Blog

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 16:12:00 -0800

Blogging is the most convenient way to stay connected with your visitors. Using RSS traffic, you can generate tons of traffic to your blog. Individual and corporate bloggers adopt RSS to create more feed traffic for their sites. RSS or short for Really Simple Syndication is a web feed traffic that publishes updated works. RSS feeds optimize your articles to increase traffic. It improves your page rank in the search engine. Here are important factors to consider when using RSS to feed traffic.
1.      Use of keywords
Many readers search the net using keywords or phrases. When composing posts for your blogs, ad meaningful keywords in your RSS feed's title and description. If you have good keywords, your feed has higher chances of being included in the search results.
2.      Use GUID format
GUID (Globally Unique Identifier) is a unique identifier. Include different GUID in all your feed items. It helps the RSS feed determine when you wrote the post in your blog or when modification and updates happen.
3.      Include dates of publication
More feed traffic comes to you when you have updated blogs. Publication date is necessary to increase traffic to your blog. Include the publish date on items even if the content is timeless. The date helps readers know the currency of the blog.
4.      Improve your Feed
Adding pictures or images increase your RSS traffic and give it a more polished look. Although the increase in traffic maybe minimal, it helps brand your feed.
5.      Feed Hosting
Take complete control of your RSS traffic by hosting your own feed or let another party do it for your website. Through this you get more feed traffic and generate additional traffic to your blog.
6.      Follow the reminders
Never plagiarize the contents of your RSS feed. Plagiarism damages your own reputation. It does not only ruin your traffic, it is bad for your credibility. Never do the same with copyrights. Republishing your RSS feed contents violates the law. Do not create splogs. These clutter the search engines and make things for feed traffic to locate websites. Do not use multiple feed formats to items of the same content. Multiple RSS feed brings about confusion. The version of RSS traffic that you use should provide only the single feeds. If you adopt the good feed practice, you will get the full advantage of RSS.
By considering these factors, you get the maximum benefit of RSS feed to direct traffic to your blog. With higher RSS feed, more traffic comes to your blog.
Are you ready to discover other traffic generation methods? I invite you to examine your FREE report at http://www.im2financialfreedom.com . This report also tells you the necessary steps that YOU MUST TAKE, on making your first "pot of gold" online.

Retrieved from "http://www.articlesbase.com/rss-articles/how-to-use-rss-to-generate-tons-of-traffic-to-your-blog-2210350.html"

(ArticlesBase SC #2210350)

RSS as a Sign of Trust

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 16:11:00 -0800

Just like VeriSign may be a standard of trust thus too is an RSS feed. It's one of many components which will be included in your web site
that permits consumers to feel additional assured that you are a business owner who is trying out for their best interests.Why is RSS an indicator of trust?One of the simplest reasons I recognize of is that RSS presents your content as authoritative and price reviewing. If you did not believe
within the worth of the content you would not take into account using RSS.The residual profit of using an RSS feed is that buyers will be alerted when new content is released. This may end in a positive traffic jam
on your site.When you have an RSS feed it additionally tells customers that you are serious regarding providing new and helpful content. It tells them you
shake up the positioning frequently and they will not have to fret about static data on your site. There are already too several of these
never changing sites available. RSS indicates a promise that you'll to not be one among them.RSS can be applied to text content such as blog posts; information based content or maybe new product pages. RSS will additionally be applied
to any podcasting or video streaming you would possibly make available.Effectively this mechanism provides a means that of encouraging interaction with those who were motivated enough to sign up for your RSS
feed.This function may be a good companion to methods you may be using as you're employed to develop client-centric strategies. RSS is not just
for you to syndicate material it's designed to meet the needs of consumers and bring them to your site.Face it, the a lot of impressions they need of your business the larger trust they'll place in your business - unless you give them some

reason to doubt your trustworthiness.An RSS feed allows customers to manage their interests and on-line activities. In some ways that an RSS feed can be utilized in place of a
typical bookmark. Content consumers will be alerted through their RSS reader every time you place one thing new online.This concept mirrors major news syndication groups, but you bypass the printing press, the requirement for advertisers and the everyday costs
associated with syndication.A lot of and additional power is being given to each customers and business homeowners to try and do more in an on-line environment than a
brick and mortar counterpart could ever hope to achieve.For example can you imagine the price of a brand new junk message from a store in your downtown area being delivered the identical day to
everybody who has expressed an interest in being on that company's commonplace mailing list?It's just not visiting happen.Use RSS to develop trust and a better sense of name loyalty in your on-line store.

Retrieved from "http://www.articlesbase.com/rss-articles/rss-as-a-sign-of-trust-3611948.html"

(ArticlesBase SC #3611948)

Tips to Get the Most Out of Your RSS Subscribers at Your Blog

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 16:10:00 -0800

This first is not normally an issue, but it can easily be done, and what we're referring to is ensuring that your site remains constant when it comes to theme, colors, layout, and design, etc. You'll have to keep things pretty stable on your end so it doesn't negatively impact anything like RSS subscriptions, etc. If you ever decide to optimize your site, or do split testing to that end, then you may want to give your readers a heads-up about it. There's a lot of wisdom and practical value with maintaining a consistent look about your site. The bottom line with this is obviously it's your site, and you can do what you want; just be sure to bear this point in mind before you make radical changes, etc. Secondly, the best way to get people to remain subscribers is to provide true value without distracting them. For instance, if you use too many hyperlinks in your posts, people will divert quickly in another direction. You want their whole focus on whatever content you provide, so that it benefits them the most. You don't want to provide a trap door out of there every two seconds. Your posts are supposed to be valuable in themselves where the subscribers learn something new without leaving. Readers are always searching for those webpages that offer the entire bulk of the information they seek, as it's annoying to have to go searching for more. If you do include links, put them at the end of your post where people can find out where to go when they're done reading. In short, your posts should be a one stop destination for your subscribers.

You should never commit the mistake of including CPC ads, like Adsense, directly in the posts themselves. This will make it so that people aren't able to read your information very well, and that will usually make them stop. Though on a regular website like mine that gives tax accounting information it is more accepted to have advertisers who pay for the overhead of the website.

That's why you can't just put your banners anywhere. There are lots of bloggers who think that they will get lots of clinks by slapping banner ads right in the middle of their posts. Their readers are just going to jump ship, and that's what they don't realize. You must ensure that your goals are kept apart, as making money and keeping your subscribers happy should be two separate undertakings. But if you were to put CPC ads on the outsides of your posts, you'll be able to accomplish both goals easily. All in all, from the above article it gets clear that RSS is here to stay but if you want your subscribers to stay then you will have to keep the above tips in mind and make sure they are satisfied. If you use your RSS the right way, you will get tons more traffic and prospects to your blog than ever before.

Retrieved from "http://www.articlesbase.com/rss-articles/tips-to-get-the-most-out-of-your-rss-subscribers-at-your-blog-3729376.html"

(ArticlesBase SC #3729376)

Effective Tips to Prevent RSS Unsubscriptions for Your Blog

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 16:10:00 -0800

It's very important to be consistent with your site/blog because visitors respond very favorably. You'll have to keep things pretty stable on your end so it doesn't negatively impact anything like RSS subscriptions, etc. Granted, most site owners don't go crazy with "redoing" their site, but there are those who do try different things. There is familiarity and security when it comes to recognizing something and feeling very comfortable with it; so that's another concern and reason to be careful. Also, we're not saying you should never test or do a redesign because it's your business and site, so just proceed with some caution with it.
When it comes to published content on your sites, they too need to have the same sort of consistent tone or feel to them. If your content starts turning off your subscribers, then obviously you'll be in for some problems. As long as you keep giving them something interesting, they will want to keep reading and learning. It all depends on your market, but there's usually no end, practically, to the amount of good information you can provide. The only way to receive what you want is to give, and that means giving excellent value to your audience.
Make sure your subject matter remains consistent from post to post. When people subscribe to your RSS feed, they are expecting a certain topic and you need to always provide that. You can play around with various things and try to be innovative, but your main blog topic should remain consistent. If you can keep your blog focused, more people will see it as valuable
and they'll want to keep your RSS feed.
All in all, the above article should help you comprehend just how important it is to think about how your readers feel and to give them what they seek. Just ensure your subscribers always get what they came for if you want them to hang on, and that's when you'll start seeing loads of free, targeted traffic.

Retrieved from "http://www.articlesbase.com/rss-articles/effective-tips-to-prevent-rss-unsubscriptions-for-your-blog-3748331.html"

(ArticlesBase SC #3748331)

from the match ajax-kiev match !!

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 15:59:00 -0800

...

...

everybody clap your hands!!!

turn around!

f-side

vak410

this is how the arena looks like when ajax scores!!!!

Qatar 2022: Reactions !!!

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 15:50:00 -0800

AFP

HH Sheikh Hamad bin Khalifa Al-Thani, Emir of Qatar:This achievement is a big one for all Arab countries and I hope that Qatar will successfully stage this tournament. We can promise that the infrastructure will be in place and that all Arabs will support our efforts. It was a difficult moment for us because the team headed by Sheikh Mohammad had a big hill to climb and it would have been difficult if we lost. But even if that happened, we wouldn't have given up and we would have doubled our efforts. A lot of people think that we are a small country, but we can accomplish great things.

Sheikh Mohammad bin Hamad Al-Thani, Qatar bid chairman
On behalf of millions living in the Middle East I want to thank you for having a bold vision. On behalf of all these people, we will not let you down. Thank you for acknowledging that this is the right time for Middle East. We are looking forward to the big date in the middle of 2022. I would like to acknowledge our competitors, who kept us busy. FIFA has taken this bold decision and we honestly thank them. I would also like to thank every single member of our bid committee who worked hard to make this dream come true. I would also like to say congratulations to his royal highness, the Emir, for believing that expanding the game and bringing it to our region is the right thing to do.

Thank you your royal highness for your belief. Most importantly I want to thank on behalf of the bid committee every single person who believed in us. We were written off early on and no one saw that we had a chance to win. But because of the millions of people who stood with us, we won. We have worked very hard to get to this point. Today we will celebrate, but tomorrow the work begins. We acknowledge that there is a lot of work ahead, but we promise that we will deliver. We will deliver with a lot of passion and make sure that this is a milestone in the history of Middle East and the history of FIFA. So thank you again for making this dream to come true and I hope to see you all at the opening match in 2022.

HE Sheikh Saud bin Abdulrahman Al-Thani, General Secretary of Qatar Olympic Committee Qatar has put football in the Middle East on the world stage. The bid team put in a tremendous effort and it has impressed a lot of people.

HH Sheikha Mozah bin Nasser Al MisnadI was hoping to win not only for Qatar but for the whole region and the bid team as well. I saw in the last few days how they worked day and night and they deserved to win. I'm extremely happy because this win is not only for Qatar but for the whole region. The joy has overwhelmed everyone. What happened today showed to the youth of Qatar that anything is possible.

Hassan al-Thawadi, Qatar 2022 bid chief executiveI thank FIFA for their trust. We thank you for believing in change and for your efforts to widen the borders of the game and give Qatar this opportunity. You will be proud of us and the Middle East. This I promise.

http://www.fifa.com/worldcup/qatar2022/news/newsid=1344979/index.html

Zidane: A victory for the Arab world

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 15:48:00 -0800

Getty Images

An ambassador for Qatar’s bid to stage the 2022 FIFA World Cup™, former France midfielder Zinedine Zidane was all smiles on a dramatic Thursday afternoon in Zurich.

Speaking exclusively to FIFA.com, the usually reserved Zizou voiced his delight at the Qataris’ successful candidature and outlined what it means to him on a personal level and to the Arab world as a whole.

FIFA.com: Zinedine, how do you feel about the announcement?
Zinedine Zidane: Relieved more than anything because it’s never easy to support a bid. It’s like a competition. What makes me happy is the fact that the message I was trying to convey throughout the campaign seems to have got through. I was saying that football belonged to the whole world, and now Russia and Qatar, who’ve never organised the World Cup, will finally be hosting this amazing event. There’s a certain logic in that decision and it’s fantastic news for both countries.

You seem very happy. Why is that exactly?
I’m proud to have been part of this bid, which I’ve supported all the way through. I’m proud to have made my contribution to a new country getting the World Cup. Qatar and the entire Middle East as a whole deserves this event and that makes me happy.

You mention the Middle East. Do you see this as something that resonates beyond Qatar?
Yes, it’s a victory for the Arab world. Qatar has received support from the Arab world as a whole and I think that’s been an important factor. Now they’ve got a little bit of time to get down to work and do what they have to do, which is to harness sport and football to achieve some big things. They’ve got ten years to put a team together and stage a wonderful World Cup.

What do you think tilted the balance in Qatar’s favour?
I think it was the fact they’d be new hosts that made the difference. When he made the announcement President Blatter seemed delighted that FIFA and its Executive Committee were happy to entrust the tournament to a country that had never hosted it before. That’s what stood out for me. And as far as I’m concerned, it’s a logical choice. But obviously, when it comes it down to the voting, it’s the little details that make the difference.

You went through a similar experience when France was awarded the 1998 FIFA World Cup. Can you remember how you felt then?
It came as a bit of a shock to me. It must have been before 1994 and I was just making my way into the France team. I clearly remember saying to myself that if France got the tournament, I’d be in with a chance of playing in it, of being part of it. It was great for France, but for me personally it was even more amazing to think that I could take part in it as a member of the national team.

So what was it actually like to take part?
Well, you know, you can’t ask for anything more than to play in the World Cup at home and to beat Brazil 3-0 to win it. There’s no doubt about that! (laughs)

This is only the start for Qatar. Will you have a role to play in the years to come?
I don’t have any exact role right now. My job was to support the bid, and I’ve done that. I’m happy with my contribution and we’ll just have to wait and see what happens in the future. What’s important right now is to savour the moment and I’m delighted to have played my part in a winning team.

interview : Figo : Club World Cup is Inter's priority

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 15:47:00 -0800

.
On the surface, little seems to have changed in the life of Portugal icon Luis Figo since the legendary wing wizard hung up his boots in May of last year. Still clearly in excellent physical condition and as professional as ever, the 2001 FIFA World Player remains involved in the beautiful game in his role as International Relations Manager for FC Internazionale Milano.
Ahead of the reigning European champions’ bid for global glory at the FIFA Club World Cup UAE 2010, the 38-year-old spoke exclusively to FIFA.com on a host of issues including the FIFA Ballon d’Or, Portugal’s new coach Paulo Bento and his country’s joint-bid to host the 2018 FIFA World Cup™.
FIFA.com: Luis, can you tell us how your working life has changed since you hung up your boots?Luis Figo: At the moment I’m working for Inter Milan as their International Relations Manager. I attend events related to the UEFA Champions League and the FIFA Club World Cup, such as the draw recently held in Zurich, as well as other competitions. But I’m also involved in the 'Inter Campus' social project, which helps children across the globe via a football development programme.

On the subject of the FIFA Club World Cup, it’s a competition that FC Internazionale Milano are set to tackle for the first time. What are the club’s objectives for UAE 2010?Inter have the opportunity to take part in this prestigious competition for the first time ever, which means that winning it has become an overriding objective for the club. After winning the Champions League, the Club World Cup is our priority and would cap a fantastic year. We’re going to try and claim a trophy that would add a huge amount of lustre to our trophy cabinet. It’s a very important challenge for us.
Following victory in the Champions League, Jose Mourinho has departed to be replaced by Rafael Benitez. How difficult is it for any coach to try and fill Mourinho’s shoes?It’s a new season, a transitional campaign under a new coach. But we’re very pleased to have signed a very experienced coach, who has an impressive CV and is held in great store internationally. We have our minds set on achieving more success, just like last season.

After winning the Champions League, the Club World Cup is our priority and would cap a fantastic year.

Luis Figo

Speaking of coaches, what’s your verdict on the appointment of a former team-mate of yours, Paulo Bento, as Portugal boss?I know him very well, we were in the national squad together for years. He’s a great professional and a real winner. Let’s hope things go well for him during this new era with the national team. I’m sure he can give Portugal plenty to celebrate.
And what about you? When will we see Luis Figo in the dugout?Not for the time being. To be honest I’m really enjoying the work I’m doing at the moment. I don’t plan on becoming a coach in the near future, I’ve got other projects in mind.
Such as charity work?Of course. As someone who’s in the public eye, helping other people is the least I can do. It’s something that gives me real pleasure. I’ve got my own charitable foundation that tries to provide fresh opportunities and better living conditions for young people. That, along with the work I do for 'Inter Campus', is very important to me.
In your role as an ambassador for Portugal and Spain’s bid to host the 2018 FIFA World Cup, how much would welcoming the global showpiece mean to the two countries?To have the opportunity to host a World Cup is an honour and privilege for any nation. In my personal opinion, I think that Portugal and Spain have everything you need to be model hosts, particularly given the passion for football in both countries. We’ve got good infrastructures in place, so let’s hope we can win everybody over. I’m certain of one thing: it’ll be an incredible ‘fiesta’, especially for Portugal for the simple reason that it would be the first time they've hosted the World Cup.
One final question: now that we know the nominees for the FIFA Ballon d’Or 2010, which player do you think will take home the award?The favourites are Wesley Sneijder and the group of players from the Spanish national team which won the World Cup in South Africa. That tournament usually has a big impact on decisions like this, so Xavi, Andres Iniesta or David Villa could all win it.
http://www.fifa.com/worldfootball/news/newsid=1343954.html

Move Aside USA and England, It’s Qatar’s Turn to Shine

noreply@blogger.com (Wagdy Hassan) — Thu, 2 Dec 2010 15:43:00 -0800

Now this tournament has truely been inclusive. It has finally genuinly brought multicultuaralism to the table. A long time coming but an arab nation has finally gotten the honour to host the World Cup in twelve years time. Why celebrate from now? Well, if you live outside North America, it is the most prestigious tournament on the face of the earth. Being a host, means having the limelights on your country for a whole month. Not to mention the spot light you are under in the six months prior to that date. Not only is this a publicity victory, but a financial one too. As this is a very lucrative business hoarding millions of dollars from the sale of tickets, sports memorobilia, and other sponsor products and events.
Congradulations Qatar, you have finally managed to break the entire arab world from the tent inhabiting, camel riding stereotype that has kept the entire arab nation hostage, except for a few. Coming from an oil rich gulf country, I’m pretty sure that they will not leave a single penny unspent for the sake of putting the world in awe. Yes, I’m pretty sure there will be a spectacular show twelve years from now. Whether you are a football/soccer fan or not, I think this is a tournament worth having front and center seats for.

Image via Wikipedia

Image via Wikipedia