A memoir story Essay Example | Topics and Well Written Essays - 500 words

A memoir story - Essay Example In all, a topic that should be inspirational is left as disturbing and depressing. Structurally, the first paragraph could be better by placing the first two sentences at the end of the paragraph. Also, all of the activity that took place at the hospital, and probably the church, could have been incorporated into one shorter paragraph and eliminate some of the redundant emotions. As an example, Kate gets introduced twice; once in the opening sentence and again in the body of the paragraph. Paragraphs three and four are both addressing the confusion of being faced with dying. These could be incorporated into one paragraph. The conclusion doesnt address the thesis. The premise of the essay was how life is a gift, but concludes with the writer waiting in heaven for their family to die. There were a number of grammar errors, mainly commas and the use of quotes. The quotes of the priest in paragraph four are used, but it is a statement of what he said, not his actual words. Also, the two sentences that comprise paragraph six should be incorporated into a longer paragraph that expresses a whole idea. In some strange way the day I found out I was going to die was the same day I began to live life to the fullest. It sounds like a hallmark card, I know, but it is the truth. [place at the end of the paragraph] When I left the doctor’s office I could not believe what I had heard. I thought I was going to be okay, I mean I had the hysterectomy, radiation and chemo. I did exactly what the doctors told me to do. He must be wrong; one year is not nearly enough time with the kids. â€Å"I am not going to see my girls graduate, I will not be present at their weddings, I will not have grandchildren,†[should be a period here] these are all the thoughts that were running rampant in my mind. I could feel my heart racing; my breathing was erratic and shallow. I couldn’t seem to catch my breath. I felt myself being sucked into a big black hole. Everything around

By the way, meet Vera Stark Essay Example | Topics and Well Written Essays - 1000 words

By the way, meet Vera Stark - Essay Example During years it became the speaker for Afro-Americans and their view on actual social problems and past prejudices, Penumbra Theater is concentrated on the Afro-American’s focus and perspective of seeing important things and showing them to public. Penumbra Theater stage though small does not make public feel unnatural, it looks atmospheric and creates an effect of coziness and hospitality. But of course it is not the building, which looks classically inside, but people who make all performances wonderful and glorious. Talking about Vera Stark, we can’t forget about great sets work by C. Lance Brockman, beautiful musical pieces by music director Sanford Moore and highly professional dancing performances organized by chorographical director Austene Van. Surely. Moreover, taking into consideration that Vera Spark is a historical play costume work is very important. Matthew LeFebvre made everything look real and convincing. My special attention goes to elegant and perfectly placed bright red dress of the main heroine. Vera and her friends in maid uniforms were looking attractive and natural too. Gloria Mitchell’s appearance was always perfect, calling up all those archetypes of femme-fatales and glorious women from the Golden Era of Hollywood. All costumes created atmospheric feeling of thirties and allowed believing in actors` play even more. Marcus Dilliard on lighting and Martin Gwinup responsible for sound and video design (especially good work with the television piece) altogether make the whole performance look natural and made viewer to pay attention to every little piece and detail. â€Å"By the Way, Meet Vera Spark† was written by Lynn Nottage whose â€Å"Ruined† won Pulitzer Prize in 2009. Vera Spark is an Afro-American women trying to reach the stars in the 1930’s Golden Age of Hollywood and also helping Gloria Mitchell, successful movie star. Vera is a main heroine; she is persuasive, active, smart, and

Statistics in Business Essay Example for Free

Statistics in Business Essay Introduction This paper is going to discuss statistics in business. One will be able to understand there are different levels of statistics along with the importance statistics are in business decision making. Statistics in Business Statistics are a mathematical analysis of data collected. The data collected can in turn be used to show statistics in a number form. With the data collected, the analysis of the data, along with the financial reports from a business, one can make a better informed decision. Statistics in business is useful when making business decisions. The statistics can show important information to help judge what may happen in the future for a product or the need of a type of business. There are levels of measurement to help when data is gained to obtain the statistics. The levels of measurement include nominal, ordinal, interval, and ratio. Examples of these levels include the following: Nominal – Numbers on sports players jerseys for identification purposes. Ordinal – The letter grade students receive on homework assignments. Interval – This level does not have a true zero point. Ratio – When one number of measurement can be divided by another nonzero number and there is meaning to that number. At the ratio level of  measurement the number â€Å"0† has meaning as it represent there is nothing to show. Conclusion In conclusion one can see there are different levels of statistics and how important they are when making business decisions. Reference McClave, J. T., Benson, P. G., Sincich, T. (2011). Statistics for Business and Economics (11th ed.). : Pearson Education. (McClave, Benson, Sincich, 2011) Lind, D. A., Marchal, W. G., Wathen, S. A. (2011). Basic Statistics for Business Economics (7th ed.). : McGraw-Hill Company. (Lind, Marchal, Wathen, 2011)

Swot Analysis Of Country Oman Finance Essay

Swot Analysis Of Country Oman Finance Essay The UAE has achieved stable progress over the past three decades to emerge as a important global player in both the  political and the economic position The tremendously fast rate of economic growth until 2008 was due to the constant demand  for oil, in addition they a move their focus to a number of non-oil sectors. The UAE had maintains a dynamic political ties up with over  60 countries, mainly in Europe and Asia. The UAE is considered to be one of the foremost political forces in the Middle  East and is a member of a number of regional organizations, including the Gulf Cooperation Council (GCC), the Arab  union and the Organization of the Islamic Conference. Under the control of former President Sheikh Zayed, the UAE transformed from a nation of large-scale poverty  to a highly developed and wealthy country. With the death of Zayed in 2004, his son, Sheikh Khalifa, immediately took  over as president. Although the government structure in the UAE is not democratic, both Zayed and Khalifa have  bear the responsibility of retain the countrys development. The government has constantly received appreciation  for its efforts to creating business opportunities in Oman. The countrys tax rule is also considered among  the best in the world for businesses. The UAE market is capable to with a well-built telecommunication network and, as a  result, the countrys IT market is slowly becoming competitive. However, the level of science education remains low. The  country has a strong integrated environmental development program. Its ecological procedures are integrated with the  Environmental Impact Assessment (EIA) program, which is par t of business practice in the UAE. PESTEL ANALYSIS OF OMAN COUNTRY http://www.free-power-point-templates.com/articles/wp-content/uploads/2012/08/pest-diagram-ppt-template-543450.jpg (Sources: www.google.com) INTRODUCTION PESTEL stands for Political, Economical, Social, Technological, Environmental and Legal. It is used to describe an analysis that determines the opportunities and risks of global growth. It is also termed as a PEST or PESTLE analysis. Political, Economical, Social, Technological, Environmental and Legal issues differ from one country to another. As a company looks to influence the advantages that the democratization of technology, information and finance, and grow beyond the national borders that previously controlled them, it is necessary that they consider a PESTEL analysis to accompany their SWOT analysis. The PESTEL analysis provides a strong outline which is used by global and multinational firm to set the stage to develop specific strategy to ease the risks involved in carry out their vision in new environments. This PEST country analysis report on Oman provides a holistic view of the country, with understanding analysis of current and future issues, supplemented with significant quantitative data to support trend analysis. FEATURES AND BENEFITS Following are benefit that business will gain if they implement pestle analysis in their planning process: Useful to know political environment: It is helpful to understand the political system in Oman through examination of key factors in the country and governance indicators. Useful to know economic situation: It is useful to understand the economic situation in Oman through a balanced evaluation of core macroeconomic matter. Useful to know demographics analysis: To understand the customer demographics in Oman through analysis of income distribution and the rural-urban split, as well as healthcare and education. Use to evaluate technology advancement: It is use to evaluate the technological background in Oman through analysis of related laws and policies, as well as patent data. Useful for controlling changes: By making effective use of PEST Analysis, it makes sure that it has united positively with the forces of change that are affecting the world. Good use of PEST Analysis helps to avoid taking action that is meant to failure for reasons beyond control. Helpful to know about new country or region: PEST is useful when we are start operating in a new country or region. Use of PEST Analysis helps to break free of lifeless assumptions, and helps to quickly adapt the reality of the new environment. HIGHLIGHTS The political landscape section discusses the evolution of the political scenario in Oman, as well as the countrys economic, social, foreign, and defence policies. The section also discusses the countrys performance according to World Bank Governance Indicators. The economic landscape section outlines the evolution of Omans economy, as well as the countrys performance in terms of GDP growth, composition by sector (agriculture, industry, and services), fiscal situation, international investment position, monetary situation, credit disbursement, banking sector, and employment. The social landscape section analyzes the governments social welfare policies, as well as the countrys performance in terms of healthcare, income distribution, and education. REASON TO USE PESTLE SWOT ANALYSIS Following are the main reason for using pestle swot: Useful to formulate goal: Strategic management is an essential aspect of managing modern businesses that involves forming goals and implements the programs that fulfil those goals. Useful to intact environmental scanning: Environmental scanning is a component of strategic management where mangers study various economic, political and social factors that might affect the business. It is helpful to small business also: It can help small businesses to identify intact markets and avoid costly mistakes. Small businesses can better compete by using these critical tools to assess opportunities and challenges. It is useful to manager for conducting an effective business: SWOT analysis and PESTLE analysis are two common strategic management equipment that the help managers brainstorm and organize their ideas during the environmental scanning process. It is broad wider concept: A main reason companies use both SWOT and PESTLE is because these tools offer broad and efficient analyses of key areas of a strategic plan. SWOT is an acronym that stands for strengths, weaknesses, opportunities and threats. PESTLE has wider coverage of business and external issues, including political, economic, social, technological, legal and environmental factors. POLITICAL ENVIRONMENT IN OMAN http://www.oxberryrisk.com/Images/political_risk_analysis.jpg INTRODUCTION OF THE SECTOR The stability and structure of a countrys government gives a basis to understand future changes in the regions political environment. Policy at the local or federal level can differ significantly. Political power in Oman is dominated by Sultan Qaboos ibn Said Al Said who is responsible for all major decision-making and government actions. Decision-making authority rests with the Sultan with contribution from his advisors, the appointed Majlis al-Dawla and members of Omans leading merchant families. Succession is a key risk concern. Sultan Qaboos has dedicated himself for promoting the countrys reconstruction, economic diversification as well as continued political stability. A process of limited elected reform has been in progress over the last several years including the introduction of direct elections for members of the counselling assembly in 2000 and universal suffrage in 2003. In recent October 2007 elections, Oman records a strong 68% voter turnout. While Oman is gradually moving forward on political liberalization efforts, the Councils role remains largely advisory. Following is the political structure of Oman country: POLITICAL STRUCTURE MONARCHY Head of State Sultan Qaboos bin Said Al-Bu S aid Council of Ministers Composed of  the Sultans Advisors State Council (Majlis al-Dawla) 57 Appointed tribal and religious leaders Consultative Council (Majlis al-Shura) 84 member Elected body with advisory functions Major Parties Illegal Last Elections Consultative Council October 2011 THE MONARCHY The Sultan is a direct heir of Said bin Sultan, who had first opened relations with the  United States  in 1833. The Sultanate is neither political parties nor governing body, although the bicameral representative bodies provide the government with advice. The present Sultan has no direct heir, and has not publicly selected a successor. Instead, the ruling family should generally select a new Sultan after his death. If they do not select a new ruler after three days, then they open a letter left to them by the late Sultan, containing a proposal for a new Sultan. Current Sultan of Oman, Majesty Sultan  Qaboos  bin Said Al Bu Said holds an unexpected amount of power. Along with his position as Sultan, he is prime minister, defence minister, finance minister, foreign affairs minister and chair of the central bank. Moreover, Qaboos has only a few family members in his cabinet and the offices they hold are considered quite powerless. His cousin Hay him for example, is minister of national legacy and culture while his uncle, Shabib is special advisor for environmental affairs. This style of control has suggestion as none of his family members have gained the necessary managerial skills to rule Oman after Qaboos death. JUDICIAL SYSTEM The court system in Oman is regulated by Royal Decree 90/99. There are three court levels in Oman; the Elementary Court is the lowest court, followed by the Court of Appeal, and then the Supreme Court as the highest court in the country. In addition to this there is an Administrative Court that looks into cases made against the government. GOVERNMENT ATTITUDE TOWARDS FDI The government keenly support foreign direct investment into the country to increased employment opportunities for Omanis. Omanisation allowance are currently in force for six industries in the private sector, i.e. the transport, storage and communications sector at 60%,finance, insurance and real estate at 45% and industry at 35%. Authorities created the Omani Centre for Investment Promotion and Export Development (OCIPED) in 1997 with the aim of providing foreign investors with a one-stop-shop for licensing and registration procedures. Judicial transformation is in progress and the court system is considered largely fair. Corruption level are low by regional standards and do not act as a significant obstacle to foreign investment. LAND OWNERSHIP In Oman the regulation for land are expected to be less because the minister wants to increases the opportunity for tourism. The Ministry of Housing, Electricity and Water may grant permission to a company or a foreign national the Right to use a certain property for operations that promote the economic development of Oman. INCENTIVES Government incentives to promote local and foreign investment include tax exemptions; the provision of industrial plots in industrial zones for nominal charges; preference in the allocation of government land; interest-free or subsidized loans with longer terms for repayment; reduced charges for water, electricity and fuel; financial assistance for the development of economic and technical possibility studies; and the accelerate arrangement of immigration visas and permits for foreign workers. GOVERNMENT REGULATIONS AND POLICIES A foreign national desire to engage in a trade or business in Oman or to acquire an interest in the capital of an Omani company must obtain a license from the Ministry of Commerce and Industry. In general, the ministry grants a license if the paid-up capital of the Omani company in which the investment is made is at least Rs 150,000 (US$ 390,000) and if the foreign ownership of the company does not exceed 49%. The Social Security Law requires private-sector employers and their Omani employees to pay monthly contributions to an insurance fund for old age, disability and death benefits. Oman does not impose personal income tax. Income tax is levied on people that are wholly owned by Omani nationals, entities with foreign participation, branches of foreign companies and Omani sole proprietorships. All companies incorporated in Oman irrespective of the extent of foreign ownership and branches of companies registered in the other member states of the Gulf Co-operation Council (Bahrain, Qa tar, Kuwait, Saudi Arabia and the United Arab Emirates) are taxed at a rate of 12%, for income exceeding RO 30,000. A single tax rate applies to branches of foreign companies, at rates ranging from 0% to 30%. Petroleum companies are subject to tax under specific provisions and rates. Omani sole proprietorships are taxed at a rate of 12%.The Omani Labour Law requires employers to pay end-of-service benefits to expatriate employees. FOREIGN INVESTMENT With the exemption of certain restrictions on the foreign-currency holdings of  commercial banks, Oman does not impose exchange controls. In general, Oman does not restrict the transfer of funds overseas of equity or debt capital, interest, dividends, branch profits, royalties, management and technical service fees, and personal savings. RESTRICTIONS ON FOREIGN INVESTMENT The Foreign Capital Investment Law (Royal Decree No. 102 of 1994) governs foreign investment in Oman. If the foreign body want to invest in Omani companies they must file applications for licenses with the Ministry of  Commerce and Industry. The ministry grants licenses to applicants if   both of the following conditions apply: The paid-up capital of the Omani company in which the investment is made is at least Rs.1, 50, 000(US$390,000). The foreign ownership of the company does not exceed 49%.The Ministry may exempt the following entities from the licensing conditions : Companies conducting business through special contracts or agreements with the government; Companies established by Royal Decree; and Parties conducting a business that the Council of Ministers declares necessary to the country. TAX EXEMPTIONS In Oman tax is exempted from corporate tax and customs duty which may be granted by the Ministry of Finance. From the following activities tax is exempted such as manufacturing, mining, agriculture, fishing, fish farming, fish processing, aquaculture, animal breeding, tourism, the export of manufactured and reprocessed products, operation of colleges, universities, and higher education institutes, private schools, training institutes, private hospitals and public utilities. Exemptions are granted for five year periods effective from the date when production begins or services are first rendered; a five year extension may be granted. .Management agreements and construction contracts do not qualify for tax exemptions. Companies engaged in the activities listed above may also obtain an exemption from the payment of customs duty on exports and on imports of equipment, spare parts and raw materials. IMPORTING The import of goods into Oman requires an import license. The import of  certain classes of goods, including alcohol, firearms and explosives, requires a special import license. Goods entering Oman must have certificates of origin. Oman follows Arab boycott rules, which forbid the import of goods originating from Israel. EXPORTS Oman does not restrict exports. However, the export of items of historical value requires an export license. CUSTOMS DUTIES In Oman most imported goods are subject to pay customs duty at a flat rate of 5% on their cost-insurance freight (CIF) value. Consumer goods, including food substance are exempt from customs duty whereas alcohol and tobacco are subject to pay higher rates of duty. Goods produced within the GCC generally may be imported duty-free. In certain circumstances, Oman may allow the contractors to import duty-free equipment and materials for use the on government, PDO and OLNG projects. Since from 2005 Oman has entered into a Free Trade Agreement with the United States of  America. POWER ON THE TOURISM SECTOR The government promote foreign contribution to develop the country tourism industry. Since the mid-1980s, the government has gradually opened its desert, mountains and coastlines to foreign tourists and the Ministry of Tourism has share part in various international tourism exhibitions to introduce Oman to the world tourist trade. Due to recent changes made in visa a regulation that had increases arrival of a large number of populations which in turn are likely to increase the flow of  tourists in Oman. Due to the development of International Airport which increase the tourist probable of the country. A new Tourism Ministry was set up in 2004 to provide push to this sector. The Ministry of Tourism has free provisional tourist arrivals figures for 2011. These showed a slight decline of 1.8% in arrivals over the year to 1,427,611. In light of this to some extent unsatisfactory figure, BMI has change down its predict for tourist arrivals in 2012, believe that an increase of 10% is now the most likely outcome for the year, down from 15% previously. BMIs predict is in line with the governments outlook for the industry. ECONOMIC ENVIRONMENT http://t2.gstatic.com/images?q=tbn:ANd9GcQnKP8I_IH7yqQSamEgMPjoj-OcN1qkxFY8WKYN5xiM_sYx59qBHwTwJjP3 (Sources: www.google.com) INTRODUCTION OF THE SECTOR Omans economy is based mainly on petroleum and natural gas. With limited energy reserves, Oman has decided to expand its economy away from oil and gas production. The Oman Vision 2020 development plan highlighted the need for the Omani economy to expand its economy through a process of  industrialization and privatization. The main single industrial investment target is the port city of Sohar, near the UAE border. The government has direct with several main privatization programs, including power generation projects, and other power and water generation plan. Oman expects to triple the industrys one percent contribution to GDP and finally create over 1, 14,000 tourism-related jobs. Besides these the government had built a second airstrip and new terminal at Muscat International Airport by 2011. The government is also in the procedure of expanding its privatization efforts to its wastewater and solid waste management operation. In addition to this the Omanis aggressively marketing itself as a enchanting, environmentally aware tourist goal. The Omani government is developing a port at Duqm, an evenly populated area along the Arabian Sea. This strategy call for the construction of a dry dock facility, oil refinery, petrochemicals complex and fish processing centre to ultimately fight with Dubais Jebel Ali port complex. The Duqm development plan also calls for the construction of an airport to facilitate passenger and cargo shipments and a three-hotel tourism resort complex. MACRO ECONOMIC DATA Following is the macro data of Oman country. YEAR 2005 2006 2007 2008 2009 2010 2011 GDP Normal GDP 309.5 36,804 4,198 60,299 46,115 56,251 61,840 Real GDP 4.0 5.5 6.8 12.8 2.0 3.6 3.8 Origin of GDP Agriculture -2.9 -4.6 4.6 0.5 1.5 1.6 1.6 Industry 5.6 -1.7 3.6 11.9 0.3 3.8 3.9 Services 6.7 12.2 9.5 1.3 1.2 3.4 3.7 Population income Population 2.5 2.6 2.7 2.9 3.2 3.3 3.4 GDP per head 20,396 21,639 22,360 24,629 22,960 23,151 23,440 Fiscal indicators Govt. Indicators 38.0 35.2 36.7 32.9 38.1 36.3 34.0 Govt. Expenditure 35.4 34.9 36.5 32.6 41.9 37.1 35.0 Govt. Balance 2.5 0.3 0.2 0.4 (3.8) (0.8) (1.0) Net public debt 4.9 3.8 3.1 2.5 5.5 4.5 4.1 Prices financial indicators Consumer prices (average, %) N/A N/A N/A N/A N/A N/A N/A Lending interest rate (average %) 7.1 7.4 7.3 7.1 7.4 6.8 6.9 (Sources: GCC construction fact sheet) GROWTH RATE GROWTH RATE AMOUNT GDP ( APPROX) $59.946billion PER  CAPITA GDP (APPROX.) $21,646 REAL GDP GROWTH RATE (APPROX.): 7.8% The government is looking to expand the economy beyond the hydrocarbon sector, which still account for about 75% of export earnings, given the limited sector possible to force and maintain growth beyond 2020. Foreign investment maintain of natural gas projects, along with the government investments will sustain growth. Oil prices natural gas represents a small proportion of GDP and export revenues. To this end, the government is shifting its plan to aim renewable energy as a key developmental goal with hope that it will contribute about 30% of GDP by 2020. PURCHASING POWER G:images omanOman-50Rials-f.jpg (Sources: www.google.com) The inflation rate for the year ended 2010 was about 4%. This was the outcome of declining crude oil prices. The oil and natural gas being the core business of  Omanis it play an important role in determine the per capita income and their purchasing power. However, the situation is changing. There is gradual boom in the per capita income. The period of rapid growth has come to an end, and in the absence of a sharp recovery in oil prices Oman looks set to grow in the 3-4% range over the coming 5-10 years. The cost of living in Oman is high as most of the goods are imported. MINERAL RESOURCES http://www.omanet.om/arabic/economic/images/9-9.jpg Omans mineral resources include chromite, dolomite, zinc, limestone, gypsum, silicon, copper, gold, cobalt, and iron. Several industries have grown up around them as part of the national development process which, in turn, has boosted the minerals sectors contribution to the nations GDP as well as providing jobs for Omanis. The mineral sectors operations include mining and quarrying, with several projects recently completed, including: an economic feasibility study on silica ore in Wadi Buwa and Abutan in the Wusta Region, which confirmed that there were exploitable reserves of around 28 million tonnes at the two sites; a feasibility study on the production of magnesium metal from dolomite ore; a draft study on processing limestone derivatives; a project to produce geological maps of the Sharqiyah Region; economic feasibility studies on the exploitation of gold and copper ores in the Ghaizeen area; a study on raw materials in the wilayats of Duqm and Sur for use in the Sultanates cem ent industry; and a study on the construction of a new minerals laboratory at Ghala in the Governorate of Muscat. Metkore Alloys will build a world-class 1,65,000 tonnes per annum capacity ferro chrome smelter project in Oman with an envisaged investment of $80 million. SOURCE OF FUNDS AND THEIR COST Oman commercial banks are the primary source of short, medium, and long-term credit. Because there is no restriction in obtaining credit in Oman they can also obtain credit from commercial banks in the neighbouring Gulf countries. The Oman Development Bank they grant loans to small and medium-size companies, for less than Rs.2,50,000. Investors also obtain financing from the Gulf Investment Corporation located in Kuwait which is established by the GCC, is a major financial institution whose main purpose is to invest in the equity and provide loan funding to the new companies. SECURITIES MARKET The Capital Market Authority in Oman is established in 1998 which regulates the securities market. Muscat Securities Market, which began its operations in 1989, over sees the flow of funds into securities and develops the local financial market. Membership in the exchange is compulsory for Omani licensed banks, specialized loan institutions, authorized financial intermediaries, joint stock companies and Omani public authorities whose shares are registered on the securities market.   Commercial banks, joint stock investment and brokerage companies which is registered in Oman they may establish investment funds called joint investment accounts. The accounts are listed on the Muscat Securities Market and may be up to 49% foreign-owned these funds are exempt from taxation. INFRASTRUCTURE AND PHYSICAL FACILITIES The Omani government is developing a port at Duqm, which is a less populated area along the Arabian Sea. This plans call for the construction of a dry dock facility, oil refinery, petrochemicals complex and fish processing centre to eventually fight with Dubais Jebel Ali port complex. The plan also calls for the construction of an airport to facilitate passenger and cargo shipments and a three-hotel tourism resort complex. . Oman is focusing on its port infrastructure as well. Two of Omans principal ports, Sohar and Salalah, are aggressively moving forward on expansion of  their respective. To increases the tourism facilities the government will build a second runway and much-needed new terminal at Muscat International Airport in 2011, they also built a new taxiway at Salalah Airport in 2010, and new airports at Sohar, Ras al-Hadd, and Duqm. Oman is focusing on its port infrastructure as well. Two of Omans prime ports, Sohar and Salalah, are aggressively moving forward on expansion of  their respective.. Oman is focusing on its port infrastructure as well. SIZE OF MARKET In 2002, Oman attracted some 1.2 million foreign visitors; about 7,00,000 came from the GCC (GULF CO-OPERTION COUNCIL) states. And of those700, 000 tourists, an overwhelming 85 percent of them came from the UAE. For all the talk in Muscat and Salalah about bringing in European tourists, the fact remains that the bulk of the sultanates visitors come from a lot closer to home- and, of those, huge numbers are simply driving across the border for a very short-term stay. Oman has so much more to offer than the other Gulf States in terms of  culture and history. Oman offers an real Arabian experience thats not easily available elsewhere in the region. TRADE: http://www.omanet.om/arabic/economic/images/tra03.jpg (Sources: www.Omannet.Om) The Omanis have been trader since ancient times. Their transport and group carried Omani goods including frankincense, dates and limes across the seas and over the old frankincense and silk routes, encourage cultural interactions with other peoples. Today, Oman is a part of a number of economic communities including the Arab Gulf Co- operation Council (AGCC), the Greater Arab Free Trade Zone, the Indian Ocean Rim Association for Regional Cooperation (IORARC) and the World Trade Organisation (WTO). The Sultanate has raised its laws on investment activity and has begun One Stop Shop permission facilities along with easy, transparent procedures. There is protected coordination between the bodies and authorities involved in providing services for investors, while current progress towards the establishment of e-government have led to a growing confidence on electronic channels. Commercial laws and regulations are being modernized, including the Law on Trade Marks, Descriptions, Trade Secrets and Protection against Unfair Competition, the regulation of foreign trade representation offices, the Consumer Protection Law and the Law on the Protection of Intellectual Property. Beside these measures, the country has also raised its ports and established free trade zones in all Mazyounah and Salalah. Omani goods are exported to the markets to world countries. Government authorities and departments give main concern to Omani products when making purchases and Omani goods are actively promoted in the local market through seminars and exhibitions. Broader promotion campaigns are also held in the regional and world markets, where Omani products have already begun to make their mark because of their high quality specifications. The Ministry of Commerce and Industry has established a certificate by the United Kingdoms Human Investment Programme, recognizing it as an investor in human resources. SOCIO-CULTURAL ENVIRONMENT http://www.secs.unibo.it/NR/rdonlyres/3611A3BD-7B6B-4531-8AAF-181E56EBA9CE/177588/Fotolia_895776_Ometti2Cerchi.jpg (Sources: www.google.com) INTRODUCTION OF THE SECTOR Since Oman is a Muslim country, all the activities are influenced by the Muslim culture. The main characteristic of Omani culture is respect for others and it prevents others from letting their face down. In Oman the foreigners have to make sure that they dont make any unpleasant remarks in the public places. Otherwise they feel insulted and let down in the society. Language: In Oman country Arabic is local language. LIFE STYLE OF THE OMANIS: Following are key factors that determine the living style of the population in Oman. CULTURE: In order to fully understand any country culture, is very important to know because it influence society whole. In Oman Islam culture is followed by every people. Oman is the Muslim country so majority of them follows Ibrahim sect it is very conservative culture. Islam directs every part of a Muslim life, from holidays to the food they eat to how they dress and do business. Kindness, humility and respect for others are key thought which are present in both social and professional field of life. ART: Traditional handicraft such as silver and gold jewelry, goat- and camel-hair carpet, woven baskets, water jugs, weapon and khanjar, a special type of dagger etc are generally practiced in this country. Besides these, drawing, painting, photography etc are also practiced. MUSIC: Music in Oman is a vital part of art. The traditional folk songs are very popular and practiced in the country. Arabic music has left a deep influence in the Oman music. Health: Life expectancy at birth in Oman is approximate to be 74.47 years in 2012. As of 1999, there were an approximate 1.3 physicians and 2.2 hospital beds per 1,000 people. In 1993, 89% of the population had access to health care services. In 2000, 99% of the population had access to health care services. During the last three decades, the Oman health care system has established and account great achievements in health care services and preventive and curative medicine. In 2001, O

Penetration Testing Of General Hospital Information Technology Essay

Penetration Testing Of General Hospital Information Technology Essay Penetration testing PeT appendix B has always been an important first-step in any security life cycle. By doing penetration testing, the Hospitals IT team can obtain many invaluable information about the Hospitals newly developed security system. Basically the process of penetration testing will be involved with gathering information. Using these information to identity and then try to exploit the security vulnerabilities. 1/ Why do we need to perform penetration testing: Penetration testing is one of the oldest and effective method to evaluate the security of a computer system. Nowadays many organizations are using penetration testing in order to discover and fix security weakness before the get exposed. And for General Hospital after the process of creating a new security system, it is important that we do penetration testing, not only to find out about any potential vulnerability, but also to demonstrate the effectiveness of the new system, these are just a few points on why General Hospital should do penetration testing: The main purpose still for greater understanding of the current security system and finding any gap in security. This help the Hospitals IT team to have proper action plans to minimize the threat of attack or misuse. The penetration test will be documented carefully (more information on this bellow), and these well documented results will help the managers in making a strong business case to the Hospital board, explaining, justifying all the budget had been use for creating this new security system. Security is not a one-time solution, its actually a long process of maintaining and upgrading along the way, as new threads are being discovered. This pen-test maybe the first that SGH have, but itll definitely not be the last. By doing a proper pen-test, the result will act as a good foundation for future testing. 2/ Quality of the test: Like any big project, before we actually committed to complete the task, we have to have a very clear picture of the final product as well as the strategy, and every steps of the way, committing without planning is one way to ensure to achieve failure (more information on planning in the next part). As we go on later in this document, well see that the Hospital will cooperate with a security partner in order to carry the testing, the more reason for two party to sit down and agreed on the standard quality of this test. So, what makes a good penetration testing? Scope of the test: defying a clear scope, that will be most suitable for the Hospital that will be the first and most important task, for a good scope will help to prevent wasting of resource at the same time able to cover every potential vulnerability (the scope defying will be in the next section, the planning stage). Reliable partner : after the planning, sketch out a good strategy, its the security partner job to implement, launch the test, thats why we have to chose a skilled and experienced partner, the one who know what they are doing, in the fourth section, we will chose a partner that: Legally capable. Technically capable Can abide the non disclosure agreement, and this is especially important, for we a hospital, working with highly sensitive information. Choosing correct and adequate series of test, this depends heavily on the scope that we decide on. Also the executing of the test must follow strict methodology, every test must be planned carefully, followed the plan, and the well documented. This is very important because if we treat the test just like a guessing game, to see where the weaknesses are, its very likely that we are going to miss something, and that alone make the purpose of doing penetration testing completely voided. Result oriented: the only thing we care for its the result of the test, thats why the results should be well documented, the team should pay attention also to make the result understandable, so that the Hospital board can easily understand the problems, the consultant of the security partner company should also be ready to present and explain the results. With that set of quality in mind, we are going to proceed to the planning and further steps accordingly. However, because we are not going to actually perform the test, so we are only going through: planning, defying scope, chose a strategy, choosing the tests, and lastly defying methodology and standard for these series of test, we are going to explain what do we chose and why, as for the definition and how to execute please refer to the appendix. II/ The planning stage: In this part, we will cover the planning, defying scope, that lead to a strategy plant, which will be the back bone guide line for any further tests to follow. The security priorities of different target are different, for a service net work it is important to have a high stability, availability, or in case of an e-business network, it requires high authenticity. However none of that can be apply to SGH, for a hospital the utmost priority are confidentiality, data integrity, we are dealing with patients data here, there is no point in taking the Hippocratic Oath to keep the patients information confidential while on the other hand slacking off In putting effort to protect those information. Not only that we are dealing with much higher stake game here, which involve humans lives. This is no longer just protecting data for data mean money. When I were young, I remember a movie where a patient with a broken jaw put back together by metallic platting, years latter he has cancer, and his doctor without knowing about the platting still send him to the MRI machine (highly magnetic), and lead to his gruesome death. All of which cause by lack of de ntal documentation in his medical history. So in a nut shell, SGH highest priority is data Integrity and confidentiality, but in the mean time we still have to do minimum checking on every other aspect, leave out nothing. The second as part of SGH network system is the personnel, which in this case are doctors and nurses mostly. They are among the most highly trained employees, however not in IT. Nowadays almost every hospital in Singapore has been completely digitalized, dealing with database instead of paper files, also with many medical devices are being monitored by computer programs. The combination of high tech with unexperienced user leads to a very high chance of application misuse, data input wrongly. That put application security testing (appendix B application security testing) priority a bit higher than normal. So as a conclusion for the strategy of this penetration test: we are going to do a penetration test follow Blind Testing strategy (Bind testing strategy Appendix B) to stimulate the action like a real hacking attempt by hacker to obtain confidential data, or to modify, deleteà ¢Ã¢â€š ¬Ã‚ ¦etc. In the same time we will combine with certain Internal testing (Internal testing strategy), mostly focus on application security, misuse..etc, and of course a few basic test again common threat however we are not going to deep in that. After decided on a plan and testing strategy, the next step will be vulnerability assessment III Vulnerability assessment (VA): Why should we do VA (VA appendix B)? In fact there are some confusion between VA and pen-test, sometime people lable them as the same. Pen-test mostly consis of VA, but then take one step futher, find out the weak spot then attack it. So basically before we do pen-test, the first step would be VA. For the detail of how to do VA please refer to VA Appendix A . But basically we are going to series of techniques that can be considered as research before attack. Passive research: learn as much as we can about SGH, from out site point of view. Open source monitoring: utilizes Internet meta-searches focus on specific keywords, or sensitive information to see if there are any leaking. Network mapping and OS fingerprinting: from out side view, figuring out the structure of the network, even able to draw out a network diagram from the information gatherd through different tools Spoofing: trick the targeted computer in side the Hospital, sending out packets pretending that they are from trusted source. Network sniffing: capture data as it travel in and out the network, especially we have the different site between Clinics and Hospital, this can be a good check to see if our VPN is working properly. Trojan attack: and yes the traditional, butter and bread Trojan attack, Even though its basic, but because its so popular, itll be a mistake to think that our fire wall can do all the job, when Trojans combine with social engineering can be devastating. Brute force attack: this can be optional as we mention before the availability of the network may not be our highest priority, however if the resource allow, we can still do it, as a better safe than sorry. Vulnerability scanning: finally we can use automated tools to scan the whole database looking for potential vulnerability (the how, and what tool can be found in VA appendix A) After all those test, its very likely that we may able to discover a few holes in our security system. However in order to make sure that in all those vulnerabilities weve just discover none are false positive we will go to the next step is exploit testing, meaning actually attack to see if any got through. IV penetration testing, different types of test: Exploit testing (exploit testing appendix B) normally is the final stage in the whole process of penetration testing. There are many type of test, each with different level of commitment. We have to chose which test, and how far do we want to push. This decision is based on two aspects. One is the predefined scope that everybody agreed on earlier, we will conduct the test accordingly to that scope, to the strategy. The second is based on the result of VA, attack on every potential vulnerability that weve just found. In this scenario, because we have not actually performed the test, so we are going to chose based on the scope only. 1/ Database Integrity: As we discussed in the previous section, the integrity and confidentiality of SGH database is our highest priority. The fact that in the process of VA, we have done many test and checking, sniffing, mapping, Trojan, brute force, those are not only VA testing but actually a part of testing the confidentiality and integrity level of the data base also. Thats the fine line between VA and penetration testing as many of the assessment can actually be consider as exploitive. In the same manner in this stage of exploitive testing there still are test that could be done that may very well have been a part of VA like: War dialling: (war dialling appendix B): by calling a wide range number of telephone inside SGH, we may catch a modem, remote access devices, and maintenance connection that may leave an open on the hospital network. Why do we even consider this method? The fact that nowadays not only user, but even IT staff have very high ignorance when considering the phone network, while in fact they are the very primate assess point that possible for hacker to exploit, you dont actually need to be ignorance, just careless is enough, like leaving an open modem on a critical node of the network is enough to create an opening. There are many tools we can use for war dialling: ToneLoc from Minor Threat and Mucho Maas, or its alternative ModemScan , they both can be use for Microsoft window platform. TeleSweep for Microsoft also, and its free. For Macintosh use Assault Dialer. Unix try PAWS, THC-SCAN NG, Telescan, IWAR (intelligent war dialler), or ShokDial (from: http://www.tech-faq.com). 2/ Social engineering testing: Social engineering test (appendix B SE) is part of the blind strategy testing. The environment we are working on is SGH, where most of the employee dont have in-depth training in IT, an other point is the helpful nature, answering question is kind of comes with the job description, all in one word: gullible nurses. For any cunning hacker, this is a big fat moving target for social engineering attack. For that reason, basic training in social attack is required, in the same time several test can be conduct, mainly in two forms: Non face-to-face: the test can be done over mail, or phone, pretending to be somebody who have authority, or who needs help to tricks the user to use account, password, or giving out sensitive information. Face-to-face: this is a more advance kind of social engineering, by posting as an employee of authorized personnel , gaining physical access to restricted areas getting information, from intercepting mail to dumpster divingà ¢Ã¢â€š ¬Ã‚ ¦etc Social engineering maybe no as technical as other test, but it has equal importance if not more, for the fact that there are actually no fool proof method to prevent social engineering attack other than out smart the attacker, which Is ironically we dont usually put the smartest people of the organization to the reception desk , the only thing we can do is to raise the level of awareness of the employee (there are books on this matter like: the art of deception, the art of intrusion both by Mitnick Simon ) . 3/ Application security testing: The second point from the scope as we discussed earlier is Application security: there are a series of test for application security (technical detail on appendix A AppT): Code view, Authorization testing, Input validation, cookie security, Lockout testing, there are also some test for the functionality of the application as well like: input validation, Transaction testingà ¢Ã¢â€š ¬Ã‚ ¦etc For why we need application testing we have discussed above, but then again, do we really need to do all those test? Yes, we do. The objective of doing so many test on Application alone is to fully evaluate the control we have over our application (medical application, network applicationà ¢Ã¢â€š ¬Ã‚ ¦). The focus of those test still focus mainly on protecting the confidentiality and integrity of information, how to authenticate user, and also on the using of cookies (appendix B cookies) 4/ other test: There are some other test like: denial of service testing, resource..etc but as we mention above, these are not compulsory, not that they are not important, but there are higher priority test that need to be done. But since these are common attack and easy to carry out, its recommended that if the resources allow, we should go ahead and perform the tests, even at basic level. (the detail of the test can be found at DoS testing appendix A). V Other detail of a penetration test: 1/ methodology and standards: Methodology actually is a very important factor of a penetration test. A test that acts without a formal methodology has no real meaning, just poking around. But on the other hand, methodology should only acts as a framework, a discipline guideline to follow, we should not restrict the tester rather than let him/her fully explore his/her intuitions, while acting accordingly to the guideline. There are several methodology and standards, as for their technical detail, please refer to appendix A Metho 2/ Security partner: The reason why we needs to pay money for a third party to perform the test for us is : Un unbiased point of view: like a beta tester, sometime the programmer, or in this case the SGH IT team, cannot see ones own mistake clearly, so we need to hire trained professional to look for us. Highly experienced and highly trained: for the member of the IT team, some may have done a penetration test before, some may not. But for a company that specialize in penetration testing. They have done it hundreds of time, even done it for some big organization, thats why with the experience and the training, its more likely that they can discover things that the IT team cannot. Certified result: a Certified penetration testing company will have to satisfies certain level of standards (refer to appendix A Metho). If a test done by a Certified party, it can become a potential strong legal argument for future conflicts (for example: Insurance conflicts). With all those reason weve decided to hire a security partner to perform the test for us. In Singapore there are many company that have the certification and standards to perform such test, most trustworthy must be: Cisco IBM (with the express penetration testing service) Obtechs Certified penetration testing specialist 3/ Risks in doing penetration testing: While doing penetration testing, there are certain risks that we should consider and be careful for: Risk of exposure: there are many sensitive data in the hospital, sometime these data can be expose during a pen-test it can be unintentionally or intentionally, we have to have strong agreement of the conditions and responsibility of the security partner. Time delay: Pen-test take time, and for Hospital environment we cannot simply lock down our data base for testing, thats why a strict time-frame. For the size of our Hospital system, the testing should not take more than a month. VI Conclusion: As we all know security is continuum, no absolute. Through the penetration tests we should be able to not only find out there are flaws in the security system, but we have to go further to understand the process failures that lead to those flaws. Through the test, we can see that even a brand new developed security system can have many vulnerability, its a reminder to us so that we never have a false sense of security!. Appendix A: 1/ VA (Vulnerability assessment): As documented by SANS, Vulnerabilities are the gateways by which threats are manifested. In other words, a system compromise can occur through a weakness found in a system. A vulnerability assessment is a search for these weaknesses/exposures in order to apply a patch or fix to prevent a compromise. How do these weaknesses occur? There are two points to consider:  · This newly developed security system for SGH were born with it, means while underdeveloping by mistake the developing team creat the weakness.  · Many vulnerabilities occur as a result of misconfigurations by system administrators. Misuse by user, all can lead to the result of making a hole in the security system. There are many ways to search for vulnerability, however in our scenario, it is best to do it as a out side hacker would do it, before attacking a system, the hacker also have to perform a vulnerability assessment test on the system, only different would be we are going to do it on full scale, not only from outside looking in but also from the insider view. There are however certain number of technique that could effectively point out the weaknesses if the system have one. Passive research: As the name suggests, a passive research is a method used to gather as much information about an organizations systems configuration from public domain sources such as: o DNS (domain name service) o RIPE (Rà ©seaux IP Europà ©ens) o USENET (newsgroups) o ARIN (American Registry for Internet Numbers) Passive research is generally performed at the beginning of an external penetration test. Open source monitoring: This service is an associated technique that utilizes Internet meta-searches (multiple searches of Web sites, newswires, newsgroups and other sources) targeted on keyword that are important to the organization. The data is collected and discoveries are highlighted to the organization. This helps identify whether organizations confidential information has been leaked or whether an electronic conversation involving them has taken place. This enables an organization to take necessary measures to ensure confidentiality and integrity. Network mapping and OS fingerprinting: Visualization of network configuration is an important part of penetration testing. Network mapping is used to create a picture of the configuration of the network being tested. A network diagram can be created which infers the logical locations and IP addresses of routers, firewalls, Web servers and other border devices. Additionally, this examination can assist in identifying or fingerprinting operating systems. A combination of results from passive research and tools such as ping, traceroute and nmap, can help create a reasonably accurate network map. An extension of network mapping is Port Scanning. This technique is aimed at identifying the type of services available on the target machine. The scan result reveals important information such as function of a computer (whether it is a Web server, mail server etc) as well as revealing ports that may be serious security risks such as telnet. Port scans should include number of individual tests, including: o TCP (Transmission Control Protocol) scan o Connect scan o SYN (or half open) scan o RST (or Xmas-tree) scan o UDP (User Datagram Protocol) and ICMP (Internet Control Message Protocol) scans. Tools such as nmap can perform this type of scan. o Dynamic ports used by RPC (Remote Procedure Call) should be scanned using tool such as RPCinfo. Spoofing: Spoofing involves creation of TCP/IP packets using somebody elses Internet addresses and then sending the same to the targeted computer making it believe that it came from a trusted source. It is the act of using one machine to impersonate another. Routers use the destination IP address in order to forward packets through the Internet, but ignore the source IP address. The destination machine only uses that source IP address when it responds back to the source. This technique is used in internal and external penetration testing to access computers that have been instructed to only reply to specific computers. This can result in sensitive information be released to unauthorised systems. IP spoofing is also an integral part of many network attacks that do not need to see responses (blind spoofing). Network sniffing: Sniffing is technique used to capture data as it travels across a network. Sniffing is an important information gathering technique that enables capturing of specific information, such as passwords and also an entire conversation between specific computers, if required. To perform sniffing, the network card of computer needs to be put in promiscuous mode, so that it captures all data being sent across the network. Sniffing is extensively used in internal testing where the sniffer or the computer in promiscuous mode is directly attached to the network enabling capturing of a great deal of information. Sniffing can be performed by a number of commercial tools such as Ethereal, Network Associates SnifferPro and Network Instruments Observer. Trojan attack: Trojans are malicious programs that are typically sent into network as e-mail attachments or transferred via IM chat rooms. These programs run in stealth mode and get installed on the client computer without the users knowledge. Once installed, they can open remote control channels to attackers or capture information. A penetration test aims at attempting to send specially prepared Trojans into a network. Brute force attack: A brute force attack involves trying a huge number of alphanumeric combinations and exhaustive trial and error methods in order find legitimate authentication credentials. The objective behind this time consuming exercise is to gain access to the target system. Brute force attacks can overload a system and can possibly stop it from responding to legitimate requests. Additionally, if account lockout is being used, brute force attacks may close the account to legitimate users. Vulnerability scanning/analysis: Vulnerability scanning/analysis is an exhaustive examination of targeted areas of an organizations network infrastructure aimed at determining their current state. The targets range from a single system or only critical systems to scanning the entire network. It is usually performed using automated tools that test for a multitude of potential weaknesses in a system against a database of known vulnerabilities and report potential security holes. And although they dont actively prevent attacks, many scanners provide additional tools to help fix found vulnerabilities. Some of the commonly used vulnerability scanners include: the open-source Nessus Projects Nessus, ISS Internet Scanner, GFI Softwares GFI LANguard Network Security Scanner, eEye Digital Securitys Retina Network Security Scanner, the BindView RMS vulnerability-management solutions and Network Associates CyberCop. 2/ application testing ( AppT ) For the purpose of application testing there are several test that can be done: * Code review: Code reviews involve analysing all the application-based code to ensure that it does not contain any sensitive information that an intruder might use to exploit an application. For example: Publicly available application code may include test comments, names or clear text passwords that will give an intruder a great deal of information about the application. * Authorization testing: Involves testing the systems responsible for the initiation and maintenance of user sessions. This will require testing: o Input validation of login fields bad characters or overlong inputs can produce unpredictable results; o Cookie security cookies can be stolen and legitimate sessions can be used by an unauthorised individual; and o Lockout testing testing the timeout and intrusion lockout parameters set in the application, to ensure legitimate sessions cannot be hijacked. This is performed to discover whether the login system can be forced into permitting unauthorised access. The testing will also reveal whether the system is susceptible to denial of service attacks using the same techniques. * Functionality testing: This involves testing the systems responsible for the applications functionality as presented to a user. This will require testing: o Input validation bad characters, specific URLs or overlong inputs can produce unpredictable results; and o Transaction testing ensuring that the application performs to specification and does not permit the user to abuse the system. 3/ DoS testing: Denial of service testing involves attempting to exploit specific weaknesses on a system by exhausting the targets resources that will cause it to stop responding to legitimate requests. This testing can be performed using automated tools or manually. The different types of DoS can be broadly classified into software exploits and flooding attacks. Decisions regarding the extent of Denial of Service testing to be incorporated into a penetration testing exercise depend on the relative importance of ongoing, continued availability of the information systems and related processing activities. Denial of service can take a number of formats; those that are important to test for are listed below: * Resource overload these attacks intend to overload the resources (i.e. memory) of a target so that it no longer responds. * Flood attacks this involves sending a large amount of network requests with the intention of overloading the target. This can be performed via: ICMP (Internet Control Message Protocol), known as smurf attacks UDP (User Datagram Protocol), known as fraggle attacks * Half open SYN attack this involves partially opening numerous TCP connections on the target, so that legitimate connections could not be started. * Out-of-band attacks these attempt to crash targets by breaking IP header standards: o Oversized packets (ping of death) the packet header indicates that there is more data in the packet than there actually is. o Fragmentation (teardrop attack) sends overlapping fragmented packets (pieces of packets) which are under length. o IP source address spoofing (land attack) causes a computer to create a TCP connection to itself. o Malformed UDP packet header (UDP bomb) UDP headers indicate an incorrect length. 4/ Methodology and standards (Metho): The Open Source Security Testing Methodology Manual (OSSTMM) by Pete Herzog has become a de-facto methodology for performing penetration testing and obtaining security metrics. According to Pete Herzog, The primary goal of the OSSTMM is to provide transparency. It provides transparency of those who have inadequate security configurations and policies. It provides transparency of those who perform inadequate security and penetration tests. It provides transparency of the unscrupulous security vendors vying to sponge up every last cent of their preys already meager security budget; those who would side-step business values with over-hyped threats of legal compliancy, cyber-terrorism, and hackers. The OSSTMM covers the whole process of risk assessment involved in a penetration test, from initial requirements analysis to report generation. The six areas of testing methodology covered are: * Information security * Process security * Internet technology security * Communications security * Wireless security * Physical security The OSSTMM focuses on the technical details of exactly which items need to be tested, what to do before, during, and after a security test, and how to measure the results. New tests for international best practices, laws, regulations, and ethical concerns are regularly added and updated. The National Institute of Standards and Technology (NIST) discusses penetration testing in Special Publication 800-42, Guideline on Network Security Testing. NISTs methodology is less comprehensive than the OSSTMM however it is more likely to be accepted by regulatory agencies. Standards in penetration testing Lets take a look at some of the standards and guidelines available: Standards for Information Systems Auditing (ISACA): ISACA was established in 1967 and has become a pace-setting global organization for information governance, control, security and audit professionals. Its IS auditing and IS control standards are followed by practitioners worldwide and its research pinpoints professional issues challenging its constituents. CISA, the Certified Information Systems Auditor is ISACAs cornerstone certification. CHECK: The CESG IT Health Check scheme was instigated to ensure that sensitive government networks and those constituting the GSI (Government Secure Intranet) and CNI (Critical National Infrastructure) were secured and tested to a consistent high level. The methodology aims to identify known vulnerabilities in IT systems and networks which may compromise the confidentiality, integrity or availability of information held on that IT system. CHECK consultants are only required when the assessment for HMG or related parties, and meets the requirements above. In the absence of other standards, CHECK became the de-facto standard for penetration tests and penetration testing in the UK. Companies belonging to CHECK must have employees that are security cleared and have passed the CESG Hacking Assault Course. However, open source methodologies such as the following are providing viable and comprehensive alternatives, without UK Government association. OSSTMM: The aim of The Open Source Security Testing Methodology Manual is to se

A Technical Analysis of Ergonomics and Human Factors in Modern Flight D

I. Introduction Since the dawn of the aviation era, cockpit design has become increasingly complicated owing to the advent of new technologies enabling aircraft to fly farther and faster more efficiently than ever before. With greater workloads imposed on pilots as fleets modernize, the reality of he or she exceeding the workload limit has become manifest. Because of the unpredictable nature of man, this problem is impossible to eliminate completely. However, the instances of occurrence can be drastically reduced by examining the nature of man, how he operates in the cockpit, and what must be done by engineers to design a system in which man and machine are ideally interfaced. The latter point involves an in-depth analysis of system design with an emphasis on human factors, biomechanics, cockpit controls, and display systems. By analyzing these components of cockpit design, and determining which variables of each will yield the lowest errors, a system can be designed in which the Liveware-Hardware interface can promote safety and reduce mishap frequency. II. The History Of Human Factors in Cockpit Design The history of cockpit design can be traced as far back as the first balloon flights, where a barometer was used to measure altitude. The Wright brothers incorporated a string attached to the aircraft to indicate slips and skids (Hawkins, 241). However, the first real efforts towards human factors implementation in cockpit design began in the early 1930's. During this time, the United States Postal Service began flying aircraft in all-weather missions (Kane, 4:9). The greater reliance on instrumentation raised the question of where to put each display and control. However, not much attention was being focused on this area as engineers cared more about getting the instrument in the cockpit, than about how it would interface with the pilot (Sanders & McCormick, 739). In the mid- to late 1930's, the development of the first gyroscopic instruments forced engineers to make their first major human factors-related decision. Rudimentary situation indicators raised concern about whether the displays should reflect the view as seen from inside the cockpit, having the horizon move behind a fixed miniature airplane, or as it would be seen from outside the aircraft. Until the end of World War I, aircraft were manufactured .. ...anifest. The discussion of biomechanics in chapter three was purposely broad, because it is such a wide and diverse field. The concepts touched upon indicate the areas of concern that a designer must address before creating a cockpit that is ergonomically friendly in the physical sense. Controls and displays hold a little more relevance, because they are the fundamental control and feedback devices involved in controlling the aircraft. These were discussed in greater detail because many of those concepts never reach the conscious mind of the operator. Although awareness of these factors is not critical to safe aircraft operation, they do play a vital role in the subconscious mind of the pilot during critical operational phases under high stress. Because of the unpredictable nature of man, it would be foolish to assume a zero tolerance environment to potential errors like these, but further investigation into the design process, biomechanics, control and display devices may yield greater insight as far as causal factors is concerned. Armed with this knowledge, engineers can set out to build aircraft not only to transport people and material, but also to save lives.

Comparing the Movies Wall Street and Boiler Room Essay -- Film Compare

Comparing the Movies 'Wall Street' and 'Boiler Room' Profit, profit and more profit - the golden pillars of capitalism. In the movies 'Wall Street' and 'Boiler Room' this is the ideology that the characters uphold. While, there are many variances in the two movies, the basic aim of both lead characters i.e. Gordan Gekko (Wall Street) and Seth Davis (Boiler Room) is to make money. Both men are stockbrokers who deal in high finance in the exclusive world of Wall Street. However, with both movies are set in different decades the way they go about doing so differs. 'Wall Street' is set in the 'roaring eighties' - a decade that has become synonymous with greed, the so-called era of plenty. With an economy just recovering from recession, as well as oil crises (which incidentally led to higher gas prices, that in turn led to the introduction of a nationwide speed limit in America). The eighties was the time that Regan took office and instituted his economic policies that were to pull America out of the recession and resuscitate its economy. His approach, known as 'Reganomics' - did in...