text:
\section{Acknowledgements}

The authors would like to thank BitSight for providing access to their data to
make this research possible.

\section{Analysis of Risk Vectors and Infections}
\label{sec:analysis}

This section examines the data aggregated in~\ref{sec:data}. First, we
investigate some of the basic properties of the data. Next, we ask whether our
risk vectors (peer-to-peer file sharing, TLS errors, and publicly accessible
services), correlate with botnet infections. We find that risk vectors are
correlated with botnet infections in ways we would expect.

\subsection{Risk Vectors}

We begin the analysis by visualizing the distribution of each risk vector and
infection variable plotted as histograms in Figure~\ref{fig:distribution}.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./pooled-variables.pdf}
  \caption{Histograms of risk vectors and botnet infections. Note that plots of
  botnet infections per employee (A) and peer-to-peer file sharing per employee
(B) are plotted on log scales, as they span several orders of magnitude. All
others are on linear scales. (A) appears as a slightly different color as it is
an outcome as opposed to the other variables which are risk vectors.}
  \label{fig:distribution}
\end{figure}

Figure~\ref{fig:distribution} demonstrates that organizations that have
botnet activity, tend to have relatively low levels of botnet infections (90\%
of organizations with observed botnets, have less than one bot per 12
employees). This does not account for the 67\% of organizations that
have no botnet activity at all. However, the data are highly skewed with botnet
infections per employee spanning several orders of magnitude. Peer-to-peer file
sharing has similar properties with the majority of organizations having no
peer-to-peer activity, and among those that do 90\% have less than 0.02 shares
per employee.  In several cases there are more total infections (or shares)
than our estimate of the number of employees. For organizations such
universities or telecommunications companies, this is likely the case, as there
are far more machines with the potential for bots and peer-to-peer sharing than
actual employees. We discuss possible alternative approaches to normalization
in section~\ref{sec:discussion}.

To account for the large number of zeros in the data we analyze both the
\emph{presence} and \emph{prevalence} of botnet infections and peer-to-peer
file sharing in our analysis.
Figure~\ref{fig:distribution} also shows a large percentage of the measured
values of certificate and service errors are either zero or one. That is, for
many organizations either all of their TLS services were misconfigured or none
were.  In between these two values we see a relatively smooth distribution.  A
similar property can be seen in risky and reasonable services, though it is not
as pronounced, with both types of services experiencing relatively high density
at one. We discuss the implications of this type of distribution in
section~\ref{sec:discussion}.

\subsection{Identifying Correlations Between Risk Vectors and Infections}

To establish whether a relationship exists between risk vectors and security
outcomes we use three statistical methods. When both measures are continuous,
we use Spearman's $\rho$, a nonlinear measure of
correlation~\cite{daniel1990applied}. We use Spearman's $\rho$ instead of the
traditionally used Pearson's correlation coefficient, because some of the
relationships may be nonlinear and we would like to capture any dependence
between the values.

When one value is continuous and the other is discrete, for example the
presence the existence of botnets and the fraction of services which employ
encryption, we use Mann-Whitney-Wilcoxon rank-sum text~\cite{mann1947test}.
This test is similar to the Student's $t$-test in that it tests whether one
particular distribution is larger than another, except it does not rely on an
assumption of normality for the underlying distributions~\footnote{We do not
  use the test to identify a difference in medians, which requires stronger
assumptions about underlying shapes of the distributions}. Finally, when both
values are discrete, we use a G-test, which is a measure of statical dependence
in discrete variables. It is recommended that the G-test be used in situations
where the $\chi^2$-test was traditionally used, as the $\chi^2$-test was
conceived as an easily calculable approximation of the likelihood ratio
test~\cite{sokal1969principles}.

\subsection{Risk Vectors and Infections}

Because a large number of organizations experience no botnet activity, we first
test whether any of the risk vectors are associated with the presence of bots
in an organization. To do this, we consider the distribution of each of the risk
vectors for organizations which we have measured botnet activity and those
which we have not. The results can be see in figure~\ref{fig:violin}.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./bot-nobot-allvars.pdf}
  \caption{A) shows the percentages of organizations with and without bots and
  the relative number of those organizations that have peer-to-peer activity.
B) C) D) E) and F) are violin plots of the distributions of risk vectors in
organizations measured to have botnet activity and those without botnet
activity. Each subplot contains a violin plot which is a representation of the
underlying distribution of values as represented by a Kernel Density Estimate.
Box and Whisker plots are also included showing the 25\% 50\% and 75\%
quartiles(Box) and 1.5 times the inner quartile range (Whiskers).}
  \label{fig:violin}
\end{figure}

A very clear relationship can be see in panel A) of figure~\ref{fig:violin}:
organizations with peer-to-peer activity tend to have some botnet activity,
while those without peer-to-peer activity tend to lack botnet
activity($p<10^{-12}$). For the other risk factors the results are not easily
visually discernible; however, we can establish the difference using
statistical tests. For three of the five remaining risk vectors, the
relationship between botnet infections and the risk vector is what we would
expect, organizations with bots generally have higher levels of TLS certificate
errors (D), risky services (E) and lower levels of reasonable services (F).
These differences are statistically significant using the Mann-Whitney-Wilcoxon
rank test ($p<10^{-4}$).

Counter-intuitively the prevalence (shares per employee) is slightly higher for
organizations without bots ($p<10^{-12}$). This is also the case in the
difference in the distribution of TLS configuration errors between
organizations with bots ($p<10^{-2}$), and those without. We discuss possible
explanations for these results in section~\ref{sec:discussion}.

\subsection{Botnet and Risk Vector Correlation}

The relationship between the count of IP addresses associated with botnets per
employee and various risk vectors is plotted in Figure~\ref{fig:scatter}.
Values of the Spearman's Correlation Coefficients can be seen in
table~\ref{tbl:coeff}.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./correlated-with-botnets.png}

  \caption{Scatter plot of botnet activity and risk vectors. Colors indicate
  the density of points in an area (lighter colors are higher density, darker
colors are lower density). Densities in range from 0 to 0.041 in A), 0 to 0.36
in B), 0 to 0.35 in C), 0 to 0.59 in D), and 0 to 1.10 in E)}

\label{fig:scatter}
\end{figure}

We can see that peer-to-peer sharing has a strong positive relationship to
botnet infections. In particular we note that it appears roughly linear on a
log-log scale\footnote{Bivariate linear regression on log transformed variables
revealed a slope of 0.879}. This may indicate the existence of a power-law
relationship. The other variables have weak, but statistically significant
linear relationships to botnet infection rates.

\begin{table}
  \caption{Correlation Coefficients between risk vectors and botnet count per
  employee. All correlations are significant at the $p<10^{-12}$ level.}
  \label{tbl:coeff}
  \centering
  \begin{tabular}{|c|c|}
    \hline
    \textbf{Variable} & \textbf{Spearman's} $\rho$ \\
    \hline
    Concentration of Peer-to-Peer & 0.725 \\
    \hline
    TLS Configuration Errors & 0.176 \\
    \hline
    TLS Certificate Errors & 0.174\\
    \hline
    Risky Services & 0.138\\
    \hline
    Reasonable Services & -0.151\\
    \hline
  \end{tabular}
\end{table}

The other risk vectors show weak but significant correlations. The negative
correlation between reasonable services and botnet infections may at first seem
counterintuitive, as running any services, even if they are reasonable, would
increase an organizations attack surface, increasing the potential for
infections. However, because we are measuring the fraction of services which
are reasonable, organizations with a high fraction of reasonable services (and
necessarily a lower fraction of risky services), are likely to have a smaller
attack surface than those with a high fraction of risky services.

\section{Conclusions}
\label{sec:conclusion}

The ability to assess security risks in organizations is critical,
both internally and externally.  Internally, those who are most
responsible for a company's performance, e.g., the CEO or Board of
Directors, often lack the technical skills to assess their own IT
systems, especially for security risks.  The evidence-based approach
described in this paper provides an objective and quantitative method
that goes beyond self-reporting or qualitative audits.  From an
external perspective, these methods could be used by one organization
to guide decisions about outsourcing or partnerships, and they could
potentially be used in settings like insurance where quantifying risk
is essential.  Current approaches provide only the most general idea
of exactly what practices and vectors expose organizations to minor
incidents such as malware infection or major incidents such as data
breaches, business interruptions, and financial and intellectual
theft.  Although the results in this paper represent a first cut at
developing a robust quantitative approach to assessing security risks,
the methods could readily be applied to other data sources, other risk
vectors, and other security problems.

Even as a first cut, our results are promising. We found that 90\% of
organizations have low levels of botnet infections (fewer than 1 botnet
infection per 12 employees) however, infection rates can span many orders of
magnitude.  Using a simple, linear regression approach, we found that the
presence and prevalence of peer-to-peer file sharing through the BitTorrent
protocol, TLS errors, and publicly available services are all correlated with
concentrations of botnet infections. In particular we find that organizations
which have peer-to-peer activity have, on average, 318 times higher
concentrations of bot. When we evaluate different industries separately, a
similar large effect was consistently observed all different industries;
however, other risk vectors are only significantly related to botnet infections
in a handful industries.

In conclusion, we argue that a data-driven, statistically principled approach
is the best way to identify objective risks within an organization. Identifying
what risk vectors and minor incidents are correlated with major incidents such
as data breaches is an important next step in understanding security maturity.

\section{Data Collection and Processing}
\label{sec:data}

This section describes the data collection and processing that were used in
this study. The dataset was collected throughout 2015 by BitSight for use in
their commercial service. We discuss how the data was used to develop the
mapping of IP space to organizations, the measurement of risk vectors, and the
measurement of security outcomes.

\subsection{Identifying an Organizations Network Footprint}

The first step to measuring an organizations security practices is to identify
its overall network presence. Over the past four years, BitSight has developed
a process for identifying the IP addresses associated with individual
organizations, which they use for in their commercial service. In this section
we give an overview of our process. A variety of methods could be used to
construct a mapping of IP space to organizations, but it is crucial to make
this mapping as accurate as possible. Given the heavy tailed nature of security
incidents~\cite{edwards2016hype,edwards2015analyzing}, misc attribution of a security incident could
alter the assessment of an organization.

For this reason the process presented here utilizes a manual verification step.
Specifically, individual researchers construct mappings for each organization,
which is then independently checked by another researcher. This process
presented here is an improvement over the one used in~\cite{liu2015cloudy} as
it uses additional information sources and completed and verified manually.

Organizations are selected because they are economically prominent (such as the
Fortune 500 companies) or are referred for mapping through industry partners. A
researcher starts the mapping process by first identifying an organization's
web presence and main company domain. Next, a company's presence on social
media as well as other public sources are examined and information about the
company is gathered. This includes the industry in which the organization
operates and its number of employees.  The number of employees gives a rough
estimate of the organization's size, which we use to normalize some of our
other measurements so meaningful comparisons between different organizations
can be made. This is an imperfect measure of size however, and we discuss some
consequences in section~\ref{sec:analysis}, and suggest how it might be
improved in~\ref{sec:discussion}. Next, media sources and financial fillings
are used to identify any fully owned subsidiaries of an organization.  After
this organizational information is gathered, a manual search of BGP routing
information, regional internet registries, and other proprietary services are
consulted to identify IP addresses which are allocated to that organization and
its subsidiaries.

We believe this represents a best-effort approach to accurately identifying
organizational ownership of IP addresses and thus observed events and services.
At the time these data were collected, BitSight has mapped 1.8 billion IPv4
addresses (42\% of the IPv4 Internet), enabling us to observe 36,982 distinct
organizational entities in 2015. This includes all of the Fortune 500
companies. However, any methodology which endeavors to associate IP addresses
to organization will face many challenges, such as the deployment of DHCP and
NAT and the increasing use of cloud services. We believe our approach improves
on previous similar mapping techniques~\cite{liu2015cloudy} by consulting
multiple additional sources, manual identification of IP ranges, and includes a
manual verification step.

\subsection{Risk Vectors}

Here we describe a handful of externally observable events and system states,
which we refer to as ``risk vectors'' (also known as risk factors). Most are
unlikely to directly cause malware infections in and of themselves (though
peer-to-peer activity might be an exception); rather, they are indicators of
conditions in an organization that may lead to malware infection or other
security problems.  That is, risk vectors relate to an organization's security
maturity.  We consider three classes of risk vectors: peer-to-peer file
sharing, transport layer security, and network services.

\subsubsection{Peer-to-Peer File Sharing}

Peer-to-peer file sharing protocols are well-known security risks.
Research has shown that as many as 35\% of torrent files are infected with
malware~\cite{cuevas2014torrentguard}, and the infrastructure itself can be
used to propagate worms~\cite{hatahet2010new}.  Since peer-to-peer file sharing
has only limited use in most enterprises, many security-conscious organizations
block BitTorrent by default within their networks or prevent their users from
installing and running torrent clients. While other peer-to-peer file sharing
protocols exist we focus on BitTorrent because it is the most popular
protocol~\cite{sandvine2015global}.

We identify peer-to-peer file sharing by collecting torrent tracker lists from
two of the largest open and public trackers.
For each torrent in the tracker list we collect a list of IP addresses are
`seeding' the file, meaning the IP addresses that have downloaded the complete
file and made it available for download by others. The IPs are then mapped to
organizations as described above.  This provides a count of the number of files
actively shared by each organization, which we normalize by the number of
employees to produce a per employee concentration. By counting the total number
of files rather than IP addresses sharing, we believe we obtain a more accurate
representation of the prevalence of file sharing than would be obtained by raw
IP counts.

\subsubsection{Transport Layer Security}
\label{subsec:TLS}

Transport Layer Security (TLS) is the backbone of encrypted internet
communication and is often the target for new attacks and vulnerabilities.

We track two different types of possible errors in the TLS protocol, software
configuration weaknesses and certificate weaknesses.  Software weaknesses are
caused either by out-of-date software or an administrative error in the
configuration of the service. Out-of-date software leaves the network
susceptible known vulnerabilities such as
Heartbleed~\cite{durumeric2014matter} and FREAK~\cite{beurdouche2015messy},
while the use of weak versions of the Diffie-Helman key exchange could lead to
eavesdropping~\cite{adrian2015imperfect}.
It is unlikely that TLS weaknesses would lead directly to malware infections at
any measurable scale.  More commonly, the result is
that some data are no longer communicated confidentially.  However, TLS issues
provide an excellent indicator of the state of an organization's security
maturity.

We derive data on the number, type, and configuration of TLS services from
Internet wide scans of IPv4. These scans probe all of IPv4 space and attempt to
identify any running services across a number of ports utilized for common
services~\cite{durumeric2013zmap}. 250 different ports commonly used for a
variety of services were scanned. We limit our investigations to ports offering
TLS and 21 ports commonly associated with popular services (see
section~\ref{subsec:services}).
Scans were completed roughly once per month, and if a TLS service was present,
a connection was established with the server, and the certificate presented as
part of the process was saved for analysis.
While faster scanning processes exist~\cite{durumeric2013zmap}, our approach
utilizes more in depth scanning, for example it tests all possible encryption
suites and protocol versions when establishing a TLS connection. This less
frequent scanning also reduces the chance that the scans will be perceived as
malicious and blocked.
Since we find little variance in the total number of TLS services for each
organization each month, we believe that the scans are accurate enough for our
purpose.

Certificate errors refer to problems with the certificates used for
authentication and the Public-Key Infrastructure. The collected certificates
were examined to determine if they used keys created using weak cryptographic
protocols, were signed using cryptographically weak hash functions, or had a
suspicious chain of trust.
Specifically, we collect information on chain of trust issues including expired
certificates, certificates that were issued for a future date, self signed
certificates, and certificates whose chain of trust is broken. Any of these
errors alone could be benign, but all are potentially exploitable by a
determined attacker and relatively easy to fix, and therefore a good candidate
indicator of the maturity of the organization.

Specifically, we looked for the following errors in software configuration:
\begin{compactitem}
  \item TLS version less than or equal to SSLv3;
  \item The presence the Heartbleed or FREAK bugs;
  \item The presence of weak Diffie-Helman Key exchange, either keys with
    less than 2048 bits or with commonly used prime numbers;
\end{compactitem}

\noindent and certificate errors, including:
\begin{compactitem}
  \item Self signed certificates,
    expired certificates, certificates that were issued in the
    future, certificates with nonstandard roots,
    and certificates with a broken chain of trust;
  \item Certificates with weak keys, specifically using RSA or DSA with 1024
    bits or less, or ECC with less than 224 bits;
  \item Certificates with weak signatures, including those signed with SHA1, MD5,
    and MD2.
\end{compactitem}

Larger organizations are likely to have a higher number of TLS services.  To be
able to make comparisons across organizations, we calculate the fraction of TLS
services that have configuration and certificate errors. Each of these
fractions is used as a separate risk vector in our analysis.

\subsubsection{Services}
\label{subsec:services}

Finally, we measure how many and what kind of network services the organization
makes publicly available. While scanning for TLS services we also scanned for
other types of services on other ports. Although any external communication
service increases the attack surface of an organization, some services are
safer than others. For example, remote terminal access through SSH is encrypted
and supports key-authentication, so it is preferred over terminal access
through Telnet, which transmits all data through plain text, leaving an
organization susceptible to eavesdropping and interception of passwords and
data~\cite{wagner2001address}.

We scanned 250 different services and categorized 21 frequently used services
into \emph{risky}, \emph{neutral}, and \emph{reasonable}. These services
account for just under 95\% of all services seen in the scans and were selected
because they were popular or posed significant security risks.  Reasonable
services are those that can be exposed to the Internet with relative little
fear of easy exploit such as SSH, while risky services should not be open to
public access(telnet). Neutral services are those which may be exploited given
misconfiguration or unpatched software, but are not inherently dangerous or are
required to be exposed to the outside world to be useful, for example HTTP.\
These services are summarized in table~\ref{tbl:services}.

\begin{table}
\caption{Classification of publicly available services.}
  \label{tbl:services}
  \centering
  \begin{tabular}{|l|l|l|}
    \hline
    \textbf{Service} & \textbf{Class} & \textbf{Classification Reason}\\
    \hline
    FTP & Risky & Clear text communication \\
    \hline
    TELNET & Risky & Clear text communication\\
    \hline
    SMTP & Risky & Clear text communication\\
    \hline
    POP3 & Risky & Clear text communication\\
    \hline
    SUNRPC & Risky & Multiple vulnerabilities~\cite{sunrpc}\\
    \hline
    NETBIOS & Risky & Network foot-printing~\cite{netbios} \\
    \hline
    IMAP & Risky & Clear text communication\\
    \hline
    SNMP & Risky & Multiple vulnerabilities~\cite{snmp}\\
    \hline
    SMB & Risky & Multiple vulnerabilities~\cite{smb}\\
    \hline
    MYSQL & Risky & Direct database access\\
    \hline
    MSSQL & Risky & Direct database access\\
    \hline
    RDP & Risky & Multiple vulnerabilities\\
    \hline
    POSTGRES & Risky & Direct database access\\
    \hline
    DNS & Neutral & Vulnerable but necessary\\
    \hline
    HTTP & Neutral & Vulnerable but necessary\\
    \hline
    NTP & Neutral & Vulnerable but necessary\\
    \hline
    SSH & Reasonable & Encrypted\\
    \hline
    HTTPS & Reasonable & Encrypted\\
    \hline
    SMTPS & Reasonable & Encrypted\\
    \hline
    IMAPS & Reasonable & Encrypted\\
    \hline
    POP3S & Reasonable & Encrypted\\
    \hline
  \end{tabular}
\end{table}

For each organization we normalize by calculating the fraction of known
services that were classified as reasonable, neutral and risky.

\subsection{Botnet Infections}
\label{subsec:bots}

The above measures identify the network properties of an organization, but do
not directly measure security incidents. In this paper we examine a common
security incident: botnet infections. In this section, we describe how data
from a diverse number of botnets is collected as a measure of security
incidents within a company.

Botnet infection data is collected through Anubis Networks. Anubis Networks
uses several techniques to infiltrate botnet command and control structure so
measurements of individual infections can be taken. First, samples of malware
are obtained and are reverse engineered to identify how a particular bot
communicates with its command and control infrastructure. Many botnets
communicate through randomly generated domains, created using Domain Generating
Algorithms(DGA) which are controlled by the botnets
master~\cite{porras2009analysis}. By reverse engineering the DGA used to create
these random domains, Anubis is able to register domains consistent with the
algorithm. Communications from the infected client to these domains allows for
the monitoring of IPs associated with infections~\cite{dagon2006modeling}.

Some botnets have attempted to circumvent this type of infiltration by using a
peer-to-peer architecture to communicate with the botnet
master~\cite{grizzard2007peer}. In these cases, a machine controlled by Anubis
executes the malware and communication with other members of the botnet is
monitored. These bot peers can then be queried to further investigate the
peer-to-peer structure.

Using this methodology, the activity of 120 different botnets was monitored in
2015. In this time period over 650 million unique infection days were
identified, where an infection day is a unique IP address infected on a
specific day. For each organization we measure this count of infection days on
a monthly basis. For example, if an organization has a single IP address which
is infected for a single day in a month, its infection day count is 1. Whereas
if that single IP address is infected for a week its infection day count is 7.
This measure allows us to measure the severity of infection by both the total
number of infected IP addresses and the duration of infections. We then
normalize these counts by employee count to obtain a concentration of infection
days per employee per month. Because of the presence of NATs and DHCP, these
measurements represent a lower bound on infection concentrations. We discuss
how we might address this in the future in section~\ref{sec:discussion}.

\subsection{Data Aggregation}

While it is conceivable that some of these data could be collected
continuously, for example the botnet data could be collected in real time, most
collection requires longer time scales. Scanning available services requires
roughly a month to scan all the possible IPs associated with the organizations
we are monitoring.  Therefore, we aggregate the data by month,
producing monthly counts and rates for each organization.  We found little
variation in any of the measures over time, so we averaged the values of the
measured quantities over the entire year.
Future research could investigate the impact of time, for example, how risk
vectors and infections change after major security incidents such as data
breaches.

\section{Discussion}
\label{sec:discussion}

In this section we highlight some of the more interesting results arising from
our analysis, and we discuss threats to the validity of the results.  We
conclude by exploring a number of possible future research opportunities
suggested by this rich data set and the analysis.

Figure~\ref{fig:violin} showed, counterintuitively, that organizations with
bots tend to have lower concentrations of peer-to-peer file sharing as opposed
to those with no botnet activity.  A second
surprising result is organizations with botnet infections do not have more TLS
configuration errors than those without bots.  Although we do not have a
definitive explanation for these two unexpected results, we speculate that they
could be caused by having set an unrealistic threshold of zero for low botnet
activity.  It is unlikely that over the course of an entire year any
organization would be completely free of botnet infections. Other more
reasonable thresholds for errors may provide a clearer and more intuitive
picture.

Among the risk vectors we studied, the presence and prevalence of peer-to-peer
file sharing through BitTorrent had the largest effect on botnet
concentrations among organizations that showed signs of infection.
Initially we hypothesized that this was an artifact of normalizing
organization size using employee counts rather than number of
computers.  If true, we would expect to see differences in the
un-pooled regression study.  However, peer-to-peer file sharing had a
consistent effect across all industries.
Research on file sharing has focused on the performance and
security of the protocol itself, rather than on the security risks it
creates as a side effect (see section~\ref{sec:related}).

We reiterate that our analysis has identified correlations and that the risk
vectors are not necessarily causal. For example, it is unlikely that an expired
TLS certificate would lead directly to a botnet infection.  However, given the
prevalence of malware present in files shared through
BitTorrent\cite{cuevas2014torrentguard}, it is possible that some of the
infections we measured are the direct result of file sharing.  The most likely
cause for the relationships we see is that both risk vectors and botnet
infections arise from the same common cause: security immaturity. For example,
organizations that don't prevent the use of peer-to-peer file sharing may also
have difficulty identifying and cleaning up botnet infections.

When we created the un-pooled regression model by industry we found only
one surprising result: in the real estate industry, a high fraction of risky
services is associated with lower levels of botnet infections.  This
anomalous result does not have an obvious explanation.

Many of the risk vectors did not have significant statistical effects in the
un-pooled regression.   This could be an artifact of how we defined the risk
vectors originally.  For example, we give equal weight to all TLS errors, but
some errors may be more indicative than others.  A second possibility is that
there are real differences in risks in different industries.  For example,
correct TLS configuration may be less important in the aerospace industry
because its main business does not involve communicating customer data.  In the
future, an organization might use the kind of analysis presented here to
prioritize which security issues to address first.

\subsection{Caveats and Threats to Validity}

As with any large-scale study, our data might be incomplete or biased.
Variation in monthly scans was small, but even this small amount of variation
may indicate that we are missing some data.
We mitigate this issue by aggregating monthly data into a single yearly measure
for each organization.  In the future, higher resolution data might provide
additional insights.

As discussed earlier, we measure organization size in terms of employee counts,
assuming that this is a good proxy for of the actual number of computers within
the organization.  What we actually care about is the number of computers
connected to each organization's network. However, to our knowledge there is no
straightforward way to obtain such a count.  We know, for example, that
employee count is not particularly accurate for Telecommunications companies
(because employee counts miss all the customers and their computers).  We also
know that in educational institutions, students are not included in employee
counts.
A potential alternative would be to estimate organization by counting the total
number of IP addresses associated with it. We have experimented with this
measure informally with similar results.

Any measurement that assesses network properties based on IP addresses will be
inexact. The presence of NATs and DHCP and cloud service technology will affect
the accuracy of our mapping.  For example, the extensive use of cloud services
may shrink the perceived network footprint of an organization while inflating
that of the cloud service provider. Network volatility, specifically the
reallocation of IP addresses, also make identifying the exact network
boundaries of an organization difficult.  We did our best to mitigate the
effects caused by these network practices. For example, file sharing was
measured on a per file basis rather than a per IP basis and infections were
measured on an infection per day basis. In both cases our measurements provide
a lower bound on the measurement of interest. In the future, some of these
measurements could be refined. Indirect methods for measuring botnet size have
been proposed~\cite{fabian2007my}, and some botnets utilize unique identifiers
for individual infections which could separate infections on a single IP
address~\cite{stone2009your}. Additionally, data on the internal structure of
organizational networks may provide more accurate measures of risk vector and
infection concentrations.

One of our main results indicates that peer-to-peer communication has a strong
correlation with botnet infections. Previous work has demonstrated that some
botnets have adopted peer-to-peer communication in attempt to grow more
robust~\cite{grizzard2007peer}. It has also been shown that the BitTorrent
protocol itself can be used as a cover channel~\cite{cunche2014asynchronous},
though no study has observed this channel used in a botnet in the wild.
However, our measurement of peer-to-peer file sharing focuses on IP addresses
that are advertising popular files for download, and we believe it is unlikely
that these popular files are being used for covert communication.

We use linear modeling in section~\ref{sec:models}, because our preliminary
analysis (section~\ref{sec:analysis}) indicated that for most risk vectors
linearity (under transformation) was a reasonable assumption.  However, we note
that in figure~\ref{fig:distribution} many of the variables have a multi-modal
distribution, which implies more complexity than we have captured in our linear
regressions.
However, figure~\ref{fig:scatter} suggests that these extrema are unlikely to
bias our our results. We also explored using multiple variables to represent
these multimodal distributions (similar to the way we handled peer-to-peer
sharing with equation~\ref{eq:torrent_zero}), but models with these transformed
variables did not improve the fit of the model and yielded equivalent results
to those seen in section~\ref{sec:models}.

\subsection{Future Work}
\label{subsec:future}

Future work could address the completeness of the data set by using statistical
techniques to identify the true population size, both for risk vectors and for
outcomes. Mark and recapture methods, originally developed for estimating
species populations in ecology, have already been used to estimate the true
size of botnets~\cite{weaver2010probabilistic}. These methods could be used to
improve our estimates of botnets and risk vectors.

We have simplified some risk vectors, for convenience and ease of
interpretation.  For example, we weight all TLS software errors equally,
although it is unlikely that they are all equally risky.  For example, an
organization that uses the theoretically weak 1024-bit Diffie-Helman key
exchange may not actually experience more attacks.  Similarly, we made a rough
classification of services into risky and reasonable. Services we did not
investigate may be strong indicators of negative organizational outcomes.
These nuances may explain the multi-modal distributions observed in
figure~\ref{fig:distribution}. However, separating out these effects is
challenging because of concerns about statistical independence.
More complex modeling approaches, such as hierarchical models, could help
identify more precise relationships.

While the current set of risk vectors can explain nearly half the variation we
seen in botnet infection rates ($R^2=0.49$), there are certainly other measures
of security maturity that could be include to give a more complete picture of
security maturity. We analyzed 21 different services and roughly categorized
them into risky, neutral and reasonable. Other services and a finer
categorization may provide more detailed results. Additionally, internal
organizational practices are likely a good measure of security maturity. For
example, password policies, security training, and internal access control
policies are likely to reflect the security maturity of an organization and
correlate with outcomes like botnet infections. Quantifying these properties
and identifying their effect is rich ground for future work.

Although we examined several different methods to account for difference across
industries, there are many more possibilities.
Figures~\ref{fig:botnet-by-industry} and~\ref{fig:UnpooledResults} show botnet
infections and the effect of risk vectors vary across industries.
However, it is possible that better groupings of industries could provide more
insight in how risk vectors affect security outcomes.

In this paper, we focused on botnets as a measure of negative outcomes for
organizations. However, the methodology can easily be applied to other security
problems, such as data breaches or
blacklists (for sending spam, port scanning, or hosting malware).  Our
preliminary results on these other outcomes are consistent with those presented
for botnets.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./by-breaches.pdf}

  \caption{Percentages of organizations which experienced breaches with and
  without botnet activity and peer-to-peer activity.}

\label{fig:breaches}

\end{figure}

As one example of generalizing to other problems, we examined a small set of
data breaches experienced by the organizations in our study.  The data were
collected in a variety of ways, such as scraping news articles, Freedom of
Information Act requests, and some private data streams.
We considered two possible risk factors (peer-to-peer or botnet
activity\footnote{Although botnet activity is an outcome in the earlier
sections, here we treat it as a risk factor itself.}), and found that
organizations with data breaches are likely to also have these risk factors
(Figure~\ref{fig:breaches}). This effect is statistically significant according
to the G-test ($p<10^{-12}$).   This preliminary work is promising but requires
additional study and validation before we can draw firm conclusions.

\section{Introduction}
\label{sec:intro}

In an increasingly connected world, organizations frequently partner with third
parties. A 2014 report by the Institute for Internal Auditors found that 91\%
of organizations partnered with technology vendors, 76\% with business service
providers, and 40\% formed strategic partnerships with third
parties~\cite{warren2014closing}. These partnerships often entail sharing
confidential data and integrating network infrastructure, potentially
increasing an organization's attack surface and risk. One high profile example
was the 2014 Target breach, which exposed credit card information about 40
million customers~\cite{harris2014target} when attackers stole a third
party vendor's credentials and used them to infiltrate the
network~\cite{perlroth2014heat}.

Traditional approaches to managing the risk in such partnerships use risk
assessment
questionnaires~\cite{assessments2010standardized,brock1999information} and
audits~\cite{council20142015}.  The results are then interpreted with cyber
threat matrices~\cite{mateski2012cyber}, which provide a rough, qualitative
snapshot of risk. Such strategies are time consuming, expensive, and it is
unclear how effective they are.  Although some efforts have been made at
standardization~\cite{assessments2010standardized}, there is currently no
standard quantitative and objective approach to assessing risk in these
environments.
Finally, although assessments, audits, and compliance standards can point to
vulnerabilities (potential avenues of attack), they do not link these
vulnerabilities to actual outcomes.  Thus, there is a need for a different
approach to the problem of understanding and mitigating security risks in
organizations.  Ideally, such an approach will be objective (not subject to
self-interpretation), noninvasive, quantitative, and it will reflect actual
risk, rather than hypothetical threats.

This paper addresses the need by presenting a rigorous, data-driven methodology
for assessing organizational risk vectors. The methodology can inform an
organization about the risks posed by third-party partnerships, and it can help
it better understand its own risk profile, ultimately providing guidance on how
to improve the security of its internal networks. The methodology consists of
three components: 1)a mapping of network (IP) space to individual organizations
2) measurement of possible avenues of attack which we dub `risk vectors' and 3)
measurement of externally observable security incidents.

We focus on risk vectors that can be measured externally and objectively and
show how  they correlate with actual security incidents. We investigate three
broad classes of risk vectors: peer-to-peer file sharing, incorrect
configuration of Transport Layer Security (TLS) services, and the presence of
publicly available insecure communication protocols. For simplicity, we focus
on assessing risk using one type of security incident, the presence and
prevalence of botnet infections within an organization. While there are myriad
possible security incidents to measure, botnets are a critical part of the
cybercrime infrastructure, and cost users upwards of \$10 billion in cleanup
costs alone~\cite{anderson2013measuring}.  Because our method is statistical in
nature, it doesn't identify root causes of any particular security incident.
Rather, it provides an overall assessment of the security \emph{maturity} of an
organization, in the same spirit as assessments and audits.

To investigate the link between risk vectors and botnet infections, we begin
with a large dataset consisting of over 3.2 billion network events measured
across almost 37,000 organizations throughout 2015 (Section~\ref{sec:data} C).
IP addresses are associated with specific organizations through a rigorous and
unique mapping process (Section~\ref{sec:data} A). The mapping allows us to use
large-scale scans of the Internet and associate specific kinds of events with a
particular organization.  Combining these data with information about an
organization's size and other properties (Section~\ref{sec:data} B) allows us
to normalize measures of risk and botnet infection, study different types of
organizations, and make comparisons across similar organizations.

With these data in hand, we show how they can be leveraged to develop
statistical models to establish quantitative relationships between risk vectors
and botnet infections. We find that each of the three categories of risk vector
correlates with the presence and prevalence of botnets within an organization.
We also study how the effect\footnote{We use the term \emph{effect} in the
statistical sense to indicate the quantitative magnitude of a
phenomenon~\cite{kelley2012effect}. Specifically we do not mean it to imply a
\emph{causal} relationship.} of each risk vector varies with the type of
organization, finding significant differences between different organization
types.

We do not claim that the link between risk vectors and botnet infections is
causal. However, we do suggest that they have a common cause---security
immaturity.  Failure to configure TLS services correctly,
making known insecure protocols publicly available, and allowing
employees to download files that are likely infected with malware, are all
indicative of poor network security practices. Similarly,
the failure of an organization to detect and remove botnet infections suggests
that it probably lacks a systematic and thorough approach to security.  In this
way, the paper shows how security maturity
can be effectively assessed through external measurements of risk vectors and
infections.

Our results only focuses on a handful of risk vectors which
are externally observable, and one type of security incident. However, our
methodology is general and could easily be expanded to more risk vectors and
different security incidents, e.g.\ data breaches and service interruptions. We
believe that moving towards a more quantitative data-driven view of risk
assessment will be crucial in the future. Not only will provide a
clearer picture of cyber risk, but will help to assess whether specific
security lapses are associated with incidents. This in turn will help security
practitioners assess and triage emerging threats for their specific
organization.
In summary the paper makes several contributions:

\begin{compactenum}

  \item A methodology for collecting security data about organizations using
    external measurements.

  \item A demonstration of how to analyze the collected data to gain insight
    about the relative security of organizations

  \item Insights from the data including: a strong relationship between
    peer-to-peer sharing activity and botnet infections, and differentiation of
    risk vectors across different industries.

  \item A thorough discussion of how the methodology could be expanded and used
    to cover other types of incidents and risk vectors.

\end{compactenum}

The rest of the paper is organized as follows: Section~\ref{sec:data}
elaborates on our process for data collection, organization, and aggregation.
Next section~\ref{sec:analysis} provides an initial analysis of the data and
examines some of it's basic properties. Section~\ref{sec:models} builds several
models of risk vectors and botnet infections. Section~\ref{sec:related} cover
related work. We conclude with a discussion of the implications of our results
and opportunities for future work in section~\ref{sec:discussion}, and some
final remarks in section~\ref{sec:conclusion}.

\section{Modeling Botnet Infections}
\label{sec:models}

This section examines the effect of the organizational risk vectors on botnet
infections. We start by constructing a model that quantifies how the risk
vectors are correlated with botnet concentration. Next, we consider how these
correlations vary across different industries.

\subsection{Modeling Approach}

We use simple linear regression to model the effect of the various risk vectors
presented in sections~\ref{sec:data} and~\ref{sec:analysis} on botnet
infections. The relationship between peer-to-peer sharing and botnet infections
appears to be linear in figure~\ref{fig:scatter}.  This suggests
that a linear multiple regression with appropriately transformed variables is a
reasonable method for studying the effect of each risk vector on botnet
infections~\cite{christensen2006log}.

\subsubsection{Variable Transformation}

Beginning with the peer-to-peer file sharing data shown in in
section~\ref{sec:analysis}, the apparent linear relationship with botnet
infections a log/log scale suggests a type of power-law relationship
To incorporate this variable into our linear regression, we would expect to
log-transform the data first. However, this would entail removing the 13.5\% of
organizations with zero peer-to-peer file sharing and non-zero concentrations
of botnet infections, possibly biasing our results.  To avoid this problem,
we separate the peer-to-peer data into two variables~\cite{hosmer2004applied}:
1) an indicator random variable (binary variable) that is one if the
peer-to-peer file sharing value is zero and 2) a transformed variable
calculated as $log(\text{concentration of peer-to-peer shares})$.
Specifically, if  $t$ is the number of files being shared per employee, we
calculate the indicator random variable, $t_{0}$, as

\begin{equation}
  \label{eq:torrent_zero}
  t_{0} =
  \begin{cases}
    1,& \text{if } t=0\\
    0,& \text{otherwise}
  \end{cases}
\end{equation}

\noindent and the transformed variable $\hat{t}$ as

\begin{equation}
  \label{eq:torrent_hat}
  \hat{t} =
  \begin{cases}
    \log(t),& \text{if } t>0\\
    0,& \text{otherwise}
  \end{cases}
\end{equation}.

This transformation is useful in two ways. First it allows us to incorporate
the observed log/log relationship while including all of data points.  Second,
it allows us to measure both the effect of both presence and prevalence of file
sharing.

\subsubsection{Regression Model}

Because the rest of the variables presented in section~\ref{sec:analysis} do
not span multiple orders of magnitude and have a roughly linear relationship
with botnet infections, we can include them as linear terms in the regression.
Our final regression model is

\begin{align}
  \label{eq:regression}
  \log (b) =& \beta_1 t_0 + \beta_2 \hat{t} + \nonumber \\
            & \beta_3 T_{CF} + \beta_4 T_{CT} + \nonumber \\
            & \beta_5 S_{Ri} + \beta_6 S_{Re} + \nonumber \\
            & \beta_0 + N(0,\sigma)
\end{align}

\noindent where $b$ is botnets per employee, $t_0$ and $\hat{t}$ are the
transformed variables from equations~\ref{eq:torrent_zero}
and~\ref{eq:torrent_hat} respectively; $T_{CF}$ is the fraction of TLS services
with configuration errors; $T_{CT}$ is the fraction of TLS certificates with
certificate errors; $S_{Ri}$ is the fraction of risky services; $S_{Re}$ is the
fraction of reasonable services; $\beta_0$ is the intercept; and $N(0,\sigma)$
is the normal distribution of residuals with mean 0 and standard deviation
$\sigma$.

\subsection{Regression Results}
\label{subsec:regression}

We determined the coefficients $\beta_i$ in equation~\ref{eq:regression} using
ordinary least squares.
Post-regression diagnostics indicate that it is unlikely our coefficients
estimates are biased.  The exact coefficients are shown in
table~\ref{tbl:pooledRegression} and depicted visually in
Figure~\ref{fig:pooledBotConcentration}.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./pooled-model.pdf}

  \caption{Plot of the regression coefficients from
  equation~\ref{eq:regression}. An estimate of each coefficient's distribution
is given as a Kernel Density estimate on each line. Solid lines below represent
98\% confidence intervals and dark blue lines are significant at $p<0.01$.}

\label{fig:pooledBotConcentration}

\end{figure}

\setlength{\tabcolsep}{2pt}
\begin{table}
  \caption{Estimated Coefficients for the model described
  in~\ref{eq:regression}. All value are statistically significant at the
$p<.005$ level, except for the Intercept which is significant at the $p<0.1$
level.}
  \label{tbl:pooledRegression}
  \centering
  \begin{tabular}{|l|c|c|}
    \hline
    \textbf{Variable} & \textbf{Coefficient} &\textbf{Estimate} \\
    \hline
    Peer-to-Peer Blocked ($t_0$) & $\beta_1$ & -5.763 \\
    \hline
    Peer-to-Peer Concentration ($\hat{t}$) & $\beta_2$ & 0.841 \\
    \hline
    TLS Configuration Errors ($T_{CF}$) & $\beta_3$  & 0.512\\
    \hline
    TLS Certificate Errors ($T_{CT}$) & $\beta_4$ & 0.638 \\
    \hline
    Risky Services ($S_{Ri}$) & $\beta_5$ & 0.509 \\
    \hline
    Reasonable Services ($S_{Re}$) & $\beta_6$ & -0.493 \\
    \hline
    Intercept & $\beta_0$ & -0.167\\
    \hline
    \hline
    \multicolumn{2}{|c|}{$\mathbf{R^2}$} & 0.458\\
    \hline

  \end{tabular}
\end{table}
\setlength{\tabcolsep}{5pt}

The results of the regression indicate that the measured risk vectors affect
the concentration of bots in the expected way.  Organizations with high
concentrations of peer-to-peer sharing, risky services, and configuration and
certificate errors, tend to have higher concentrations of botnet infections.

Figure~\ref{fig:pooledBotConcentration} illustrates the difference in effect
size between each of the variables. Interestingly, we see that the indicator
variable for peer-to-peer sharing has the largest effect. In particular, we
calculate using the model (equation~\ref{eq:regression}) that organizations
that allow peer-to-peer file sharing have, all other things being equal, more
than 318 times the number of bots per employee\footnote{When the dependent
  variable is log-transformed, a one unit change in an independent variable
results in an $e^{\beta_i}$ change in the dependent variable. Organizations
that block peer-to-peer sharing have $e^{-5.763} = 0.00314$ times lower botnet
infections rate, or inversely $1/0.00314=318$ higher botnet infection rate}. We
explore the reasons for this large effect in the next section and the
section~\ref{sec:discussion}.  We can calculate the effects for other
variables, for example, organizations with 10\% higher peer-to-peer file
sharing per employee have an 8.3\% higher rate of botnet infections.
Organizations with no TLS certificate errors have 14\% lower botnet infections
than those with a 25\% misconfiguration rate.

The variation in the estimates for each variable seen in
figure~\ref{fig:pooledBotConcentration} is also interesting. The narrow
variation in the concentration of peer-to-peer sharing indicates a consistent
effect across different organizations, while the wider variation seen in risky
services indicates an inconsistent effect which perhaps varies significantly
across different organization types.  For example, we hypothesize that the
reason for the weak effect is that in some organizations, risky services might
be necessary and appropriately handled, even if in general this risk vector is
associated with higher levels of botnet infections. We explore how the effect
of different industries influences these relationships in the next section.

\subsection{Industry Effects}
\label{subsec:industry}

Next, we ask whether or not the risk vectors have different effects in
different industry types.  For example, telecommunications companies and
universities typically have less control over the computers connected to their
networks and this may lead to higher botnet infection rates. This effect can be
see in figure~\ref{fig:botnet-by-industry}, where the distribution of botnet
infections for various industries is plotted. As a more rigorous test, we
conducted a pairwise comparison of botnet infection distributions between all
industries using a Kolomogorov-Smirnov test~\cite{smirnov1948table}. Among the
231 possible industry comparisons, 63\% indicated that botnet distributions
between industries differed. We discuss more refined groupings of industries in
section~\ref{sec:discussion}.

\begin{figure}[t!]
  \includegraphics[width=\columnwidth]{./botnet-by-industry.pdf}

  \caption{Distribution of botnet concentration by
  industry. Note the log scale, indicating that some industries typically have
many orders of magnitude more botnets per employee than others.}

\label{fig:botnet-by-industry}

\end{figure}

This suggests that the model in equation~\ref{eq:regression} captures only some
of the relevant behavior and that more detailed industry-specific models may be
appropriate.  There are several possible approaches that could be used, e.g.,
we could include an indicator random variable for each industry (fixed effect
model), we could allow a different intercept for each industry (random effect
model), or we could refit the regression model once for each industry (an
un-pooled model). Each of these approaches will result in a more accurate
representation of the data, but at the expense of potentially unnecessary
complexity. We use Akaike Information Criteria (AIC)~\cite{burnham2003model} to
select among different possible models  AIC considers the model's goodness of
fit and penalizes its complexity.  We found that the most complex model, a
separate regression for each industry, gives the minimum (preferred) AIC
despite the large number of variables (154). The results are shown in
figure~\ref{fig:UnpooledResults}\footnote{For brevity, we do not give the exact
values of all 154 coefficients and their standard errors here; however, we will
make them available before publication.}.

\begin{figure*}[t!]
  \includegraphics[width=\textwidth]{./industry-model.pdf}

  \caption{Visual representation of coefficients for the un-pooled
    regression model. Each panel (A-G) shows the coefficients for each
industry in the vertical axis. Each bar represents the 98\% confidence interval
around the coefficient estimate. Estimates which are statistically significant
at the $p<0.01$ level are blue. Non-statistically significant estimates are in
grey.}

\label{fig:UnpooledResults}
\end{figure*}

The above plot shows how the effect of risk vectors varies across
industries.  The only consistent effect across all
industries is peer-to-peer file sharing (Columns A and B).
This indicates that the large
effect observed in section~\ref{subsec:regression} is not confined to
organizations with a large number of hosts per employee, e.g.,
telecommunications and education.
In particular, Column A has one of the smallest effects
for educational organizations.  And, Column B
(concentration of peer-to-peer file sharing) is one of
the most consistent across industries, with comparatively low variation
compared to the other coefficients.

Among industries, the effect of the other variables is mixed. For most variables
and most industries, when significant effects are present, they affect botnet
infections in the direction we would expect. TLS configuration, certificate
errors, and risky services all increase botnet
infections, while infection rates decrease as the fraction of safe
services increases.  There is one possible exception to this trend, in
Column E (risky services).
The presence of a large fraction of risky services decreases
botnet infections within the real-estate industry. This effect is not
significant at the $p<0.01$ level but is at the $(p<0.015)$ level. This
puzzling finding is warrants further investigation.

Finally, for most industries not all risk vectors have a significant effect on
botnet infections. For example, having a high fraction of reasonable
services is significant in only Government/Politics, Business Services, and
Telecommunications industries. Similarly, TLS configuration and certificate
errors only affect a handful of industries.

\section{Related Work}
\label{sec:related}

In this section we review work related to that presented in this paper. We find
that research as focused on identifying vulnerabilities and elaborating on why
they might put organizations at risk, there has been surprisingly little work
linking risk vectors to actual outcomes such as botnet infections.

Work on BitTorrent has primarily focused on measuring the use of the protocol
as a method for peer-to-peer file distribution~\cite{pouwelse2005bittorrent},
it's performance~\cite{bharambe2005analyzing}, the security of its distributed
hash table algorithm~\cite{timpanaro2011bittorrent}, and studies of attacks
against the protocol~\cite{konrath2007attacking,hatahet2010new}. However, there
has been little work studying the potential danger of the use of the protocol
in the wild. To our knowledge, only one paper by Cuevas examined the dangers of
BitTorrent identifying that 35\% of files shared on through BitTorrent are
fake, and of those more than 99\% contain malware or phishing
attempts~\cite{cuevas2014torrentguard}. Our work is the first which actually
examine this correlation between the use of peer-to-peer file sharing in
organizations and botnet infections.

In contrast, the Transport Layer Security protocol, and its predecessor the
Secure Socket Layer protocol, have been widely known to be a source of
vulnerabilities. One recent and widely publicized was the ``Heartbleed''
vulnerability which allowed attackers to remotely read protected memory on
servers hosting vulnerable websites~\cite{durumeric2014matter}. Other research
has shown that many of the available cryptographic protocols used to
communicate, and hash functions used to sign certificates are vulnerable to a
variety of attacks~\cite{beurdouche2015messy,
adrian2015imperfect,FoxIT2011,wang2005finding,dobbertin1996status,rogier1997md2}.
There have also been work suggesting that the certificate infrastructure itself
is a target for hackers, in particular one of the major certificate
authorities, Verisgn, was the subject of numerous successful attacks in
2010~\cite{menn2012key}. While this work speaks to the insecurity of various
implementations and configurations of TLS, and the certificate infrastructure
in general, it does provide a direct link between the problems of TLS and
outcomes for organizations. Reports have linked exploitation of the Heartbleed
bug to the compromise of 4.5 million patient records in an attack against
Community Health Systems~\cite{leyden2014heartbleed}, an unknown number of
records against the website ``Mumsnet''~\cite{quinn2014parenting}, and a
compromise of an unknown number of records from Canadian Revenue
Agency~\cite{seglins2014CRA}. However, no work to our knowledge has
investigated the relationship between vulnerable TLS services and botnet
infections.

The case is similar for various types of services. As we outline in
section~\ref{sec:data}, there has been extensive research on developing attacks
for a number of the protocols we collect data on including
FTP~\cite{manadhata2006measuring}, TELNET~\cite{joncheray1995simple}, and
Microsoft SQL~\cite{cerrudo2002manipulating}. Moreover, techniques have been
developed for automatically generating attacks against a variety of
protocols~\cite{guruswamy2011portable}. However, as of now we find no work
linking the presence or use of these services to negative outcomes, as we do in
this paper.

Botnets are recognized as a costly part of the cybercriminal
infrastructure~\cite{anderson2013measuring}, and a good deal of research has
been devoted to detecting~\cite{feily2009survey},
measuring~\cite{abu2006multifaceted,dagon2006modeling},
classifying~\cite{dagon2007taxonomy} and fighting
them~\cite{van2010role,bailey2009survey}. Similar to the research presented in
this paper, some work focuses on measuring relative botnet infections within
various types of organizations. For example Stone-Gross et al.\ focused on ISPs
with persistent malicious behavior~\cite{stone2009fire}.  Edwards et al.\
studied the concentration of spam sending IP addresses within Internet Service
providers, and examined some risk vectors(including economic, geographic, and
connectivity) for high levels of spam
concentrations~\cite{edwards2015analyzing}. Other work has focused identifying
high concentrations of infected IP addresses in certain parts of the
Internet~\cite{moura2013internet,ramachandran2006understanding,collins2007using}.
Yen et al.\ explored malware infections in a single large enterprise, and
identify possible entry points for infection on individual hosts, but do not
provide a comparison across a large number of organizations as we do
here~\cite{yen2014epidemiological}.

Little work linking the network characteristics of organizations with security
incidents across a broad number of organizations. Zhang et al.\ found that
higher concentrations of different types of network mismanagement such as open
DNS resolvers and SMTP relays lead to high concentrations of infected PCs
within different Autonomous Systems~\cite{zhang2014mismanagement}. Our work
focuses on an organizational level, and considers a broader scope of risk
vectors which are correlated with network infections. Liu et al.\ use a similar
but much larger set of network features (258) of organizations and machine
learning to predict data breaches~\cite{liu2015cloudy}. While they make some
effort to rank features on their relative importance, using a random forest
limits their ability to directly quantify the impact of risk vectors as we do
here.

In the past there have been calls to better understand security at the
organizational level~\cite{whitman2003enemy}. However, research developing
qualitative models of organizational security have been difficult to
validate~\cite{kotulic2004there,siponen2000conceptual}. Others have tried to
investigate organizations security culture. Merete et al.\ study common
information security practices across organizations in
Norway~\cite{merete2008implementation}, and Furnell et al.\ investigate how
organizational culture can be utilized to increase
security~\cite{furnell2005organizational}. Recent work has tested organizations
response to being told informed about spam sending infections, both publicly
and privately~\cite{he2015designing}. However, none of this work makes a direct
connection to organizational maturity and the likelihood of incident such as
botnet infections.

redpajama_set_name: RedPajamaArXiv


Just because little girls have wiggly fingers and toes, as well as a bit of trouble sitting still without touching anything long enough for their nails to dry, doesn't mean they can't flaunt the perfect statement nails anyway! In the last precious few days of summer, when pedicures are still out for all to see, and bright, colorful manicures look great matched to bathing suits, here are a few essential tips for how you can take advantage of any extra few moments you and your daughter have together to create a quick, easy, and unforgettable mani-pedi statement with self-adhesive nail stickers (also known as nail decals) from Townleygirl.
You wouldn't want to jump up all of a sudden to grab the nail polish remover in case there's a spill or to leave your daughter alone with "wet paint" while you grab the top coat. At the very least, you'll need a file and your chosen nail decals (we like the Trolls Nail Art Set, which comes with over a hundred nail stickers), but we also recommend choosing at least one polish color (more is always cute for rainbow nails) and a two-in-one clear top and base coat. Having a bottle of nail polish remover and cotton swabs on hand is a good idea, and a hairdryer is always helpful for impatient little fingers.
Nail art looks best when you start with clean hands (or feet) and nails. Greasy, grimy nails, or nail beds that have old polish on them, will contribute to bumpy, uneven nail art. So, wash up! Use a nail brush and soap under the nails, and if anything is still stuck on them, use a quick swipe of nail polish remover before you start. Then use a file with long, even strokes to smooth away any nicks or uneven spots and to create a pretty, rounded shape. Our Despicable Me 3 Nail Polish Set includes a cute, printed nail file, as well as five polish choices, and dozens of nail stickers. If some nails are long and some are short, it's usually best to file them all to one matching length.
This step is optional since you can create adorable nails with nothing but stickers, but combining nail decals with color makes a real style statement. Have your daughter sit across from you (at a table, if you're doing a mani, and just on a wood or tile floor is fine if you're doing a pedi), and carefully paint a clear base coat. Dry with a hairdryer. Then add your stylish base color. Allow nails to dry almost completely. A little stickiness is actually good to help the decals stay on.
Does your girl want pink princess nails with shiny gem decals? Or trendy yellow nails with emoji stickers? The design is up to you. If you decided to apply the nail stickers directly on nails without a polish base, your girl can actually place them on herself. If you decided to paint them too, it's better if Mom applies them carefully, to avoid smudging. If you didn't use polish, all you have to do is have your girl avoid fiddling with her nails until the sticker glue dries a bit.
If you're using polish with your stickers, go ahead and swipe a layer of clear coat right on top of the stickers. While Townleygirl's nail decals are self-adhesive, a touch of top coat will help them last even longer! Dry thoroughly with a hairdryer (set to warm or cool), and enjoy! And if your daughter's nails turn out amazing (and we know they will), send us a pic!
For more non-toxic, kid-safe nail art accessories, visit us here!


From Common App prompts to supplementary essays, we break down the most common application essay topics. ... The college essay is your opportunity to show admissions officers who you are apart from your grades and test scores (and to distinguish yourself from the rest of ... Share an essay on any topic of your choice.
Read about the top 10 tips to help international students write the best possible college admissions essay. ... Before you write your college admissions essay, take a few minutes and jot down some answers to the following questions: .... Your word choice reveals a great deal about your personality, education and intellect.
Office of University Admission ... In addition to the essay included with the Common Application and as part of Villanova's Member Section of the Common Application, Villanova requires that you submit one Villanova Essay (of 250-1000 words per ... Please also submit the essay of your choice from the Common Application.


text:
Apple-IBM deal threatens Android's enterprise push
Why Microsoft isn't spooked by the Apple-IBM alliance
Why the Apple-IBM deal matters
Apple and IBM team up on 'historic' enterprise push
Apple-IBM news
Apple fashions 'brilliant' partnership with IBM for instant enterprise cred
Co-opts IBM's reputation, global reach in deal to sell iPhones and iPads, build industry-specific mobile solutions for big biz
By Gregg Keizer
Senior Reporter, Computerworld |
Apple and IBM in major deal to tackle...
Apple fashions 'brilliant' partnership...
Tuesday's deal between Apple and IBM was "brilliant," one analyst said, while others called it a huge win for the former, which now gets into the enterprise through the front door rather than having to sneak in through the back.
"This is a very big deal for Apple, which just outsourced a high quality sales, support and service organization in the likes of IBM," said Frank Gillett, an analyst with Forrester Research. "What's brilliant about this is that it lets Apple preserve its focus, but partners on a large scale with someone who can totally represent them in the enterprise."
The Apple-IBM partnership was announced with joint press releases and an interview on CNBC with CEOs Tim Cook and Ginni Rometty, after the stock market closed. The deal, which is exclusive, will meld IBM's big data and analytics capabilities with Apple's iPhone and iPad.
IBM will sell the Apple devices; craft more than 100 industry-specific enterprise solutions that will include native apps; optimize its cloud services for iOS; package device supply, activation and management services; offer financing and leasing plans; and provide on-site support to customers. Apple will handle telephone support with new AppleCare options designed for enterprises.
"It's huge, it's landmark," Cook said in the CNBC interview. "This is all about transforming the enterprise."
"This is all about unlocking mobility in the enterprise," countered Rometty.
Analysts applauded the deal, and generally saw Apple getting more from it than IBM.
[ Further reading: The wireless road warrior's essential guide ]
"Apple has gained tremendous traction with enterprises, but it's primarily the result of end users bringing the devices in, and only secondarily from CIO or IT initiative," said Charles Golvin, formerly with Forrester, but now the principal analyst at Abelian Research. "This deal changes that, and as a result adds enterprises to the other forms of investment -- monetary, informational, temporal/experiential, social -- that secure loyalty to the Apple ecosystem."
Several others also pointed out that while Apple has made large inroads into enterprises, first with the iPhone, then with the iPad, it did that through the figurative back door as employees brought their devices to work and first demanded support from their companies' IT departments, then access to the corporate digital infrastructure and the information stored there.
"This is all about Apple getting into the enterprise," said Patrick Moorhead, principal analyst at Moor Insights & Strategy. "Apple has market-owning strategies in the consumer space, but it's not been able to convert that into strategies for the enterprise. Now Apple has an advocate in the enterprise."
"It legitimizes the iPhone and iPad as business tools," echoed Ezra Gottheil of Technology Business Research. "This really says to IBM customers, 'If you want to be able to get to the big back end with mobile, Apple is the one. IBM will provide a complete solution.'"
That argument -- that IBM has promised an end-to-end solution on integrating mobile with corporate systems and services already in place -- is what made the deal, from Apple's perspective, so enticing.
"As a one-stop shop, I can think of only one that could do that, and that's IBM," said Forrester's Gillett.
But Gottheil called out another reason Apple did this with IBM, rather than another major technology player -- a Hewlett-Packard or Dell -- for instance: IBM doesn't sell devices any longer, and has zero footprint in the consumer market, where Apple excels. "They don't conflict in any way, shape or form," said Gottheil. "There's no collision, there's no conflict, it's all upside."
The experts were split on whether the partnership would result in a major uptick in iPhone and iPad sales, but most agreed that Apple will benefit in other ways. "From a brand perspective, IBM is all about the enterprise, so this says, 'Apple is ready for the enterprise,'" said Moorhead.
Perception, in fact, was one area where Apple will come out smelling sweeter. "This should give a nice boost for IBM but is a considerably bigger deal for Apple, maybe more for the changed perception," said Gottheil. "The idea is that Apple must now be a real business vendor if IBM is building for you and selling for you. Little Apple has just grown up."
"There's a big perceptional element to this," agreed Moorhead. "Apple's not the corporate standard. But IBM has credibility there, it's known for the enterprise, so the perception will be, 'If it's good enough for IBM, it's good for everybody else,'" Moorhead added, perhaps intentionally echoing the old phrase, "No one ever got fired buying IBM."
Not all were willing to say that all Apple got out of the deal was a newly-burnished reputation among business customers. "It's more than perception. Apple will now be easier for businesses to do business with," argued Gillett, who cited the enterprise-necessary experience that IBM brings to the table, especially its global reach in sales, service and support for Apple's hardware.
The analysts did have concerns, however, ones that might not be addressed for some time.
"IBM can do the first part, sell the iPhone and iPad, falling out of bed," contended Gillett. "But can IBM deliver on the promise of unique app experiences for IBM software products? Tying these devices to this wonderful infrastructure is a tall order, and will take time to prove out. Apple wins regardless, I think, but it wins much bigger if IBM comes through with what they promised."
Moorhead, too, had unanswered questions. "How will things change at Apple for longevity of support?" Moorhead asked. Microsoft has a 10-year support cycle for its operating systems, he noted, while Apple's is, well, undocumented.
The timing of the deal -- Cook said that the partnership had been in the works for two years -- also stuck with some of the experts.
"I think Apple has been much easier to deal with since Cook took over," said Gottheil, referring to co-founder and former CEO Steve Jobs' known ambivalence -- and that may be putting it kindly -- toward corporations as customers.
Historically, Apple has been at best a minor leaguer in business, with its Mac often limited to startups, small firms, or design departments in larger organizations. The iPhone and iPad changed that to a large degree, but even then no one has made the mistake of saying Apple was all about "productivity and platforms," the latest mantra of its rival Microsoft.
Yet Jobs might have struck a deal with IBM as easily as did Cook, countered Gillett. Apple has changed in the last three years, and Jobs was, if anything, a pragmatist. "The scale and ambition that Apple has achieved now, I think Steve would have done the same," Gillett said.
By striking a deal with IBM, Apple has gained enterprise credibility overnight, the analysts agreed, and put it in a market where Microsoft, and to a lesser extent, Google, dominate.
"Apple increases its business presence, at the expense of Android, Windows, and Blackberry," asserted Gottheil.
"Android has struggled in enterprise, for security and other reasons, but resistance has diminished recently by dint of Samsung's Knox and efforts by Google," chimed in Golvin. "This raises the bar significantly for Android."
Tim Bajarin of Creative Strategies went further than that in tallying the damage to Google.
"This is not good news for the Android crowd," Bajarin wrote on Techpinions after the Tuesday announcement. "Google, and especially Samsung, had been on a course to try and get more Android devices into IT. However, this Apple/IBM deal will make that very, very difficult now."
Microsoft may not come out unscathed either. "This will also have an impact on Microsoft's quest to make Windows 8 tablets and smartphones the de facto standard in IT," he said, referring to a Microsoft strategy that has thus far met with little success. "That would have been a tough thing to do even if Apple and IBM had not gotten together, but it will be even more difficult for them to gain a lot of ground now."
And as for the talk by Gottheil and Gillett about Jobs? Bajarin had his take, too.
"I suspect Steve Jobs has a big grin on his face up in the sky," Bajarin said.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.
See more by Gregg Keizer on Computerworld.com.
Senior Reporter Gregg Keizer covers Windows, Office, Apple/enterprise, web browsers and web apps for Computerworld.
Apple and IBM in major deal to tackle corporate market
Apple is making a big push for the corporate IT market through a partnership with IBM, which will...
Apple fashions 'brilliant' partnership with IBM for instant...
The business-focused deal between Apple and IBM unveiled Tuesday is 'brilliant,' one analyst said,...
Apple's partnership with IBM to tackle the mobile enterprise could have lasting ramifications for...

redpajama_set_name: RedPajamaCommonCrawl


Robin Lord Taylor was on a Television Critics Association panel for the final season of Gotham. After the panel, he spoke with reporters further and /Film asked him about his role in John Wick: Chapter 3 – Parabellum. IMDB calls his character The Administrator and Taylor confirmed it was a small part.
"In the hiatus, between season four and season five, I had one day on John Wick, just their very first day of principal photography," Taylor said.
The Administrator sounds like someone who could be an administrator in the Continental hotel. Taylor wouldn't specify.
"I don't want to say too much but it's definitely an important person in that world," he said.
The creators of John Wick are also developing a TV series for Starz called The Continental. I, for one, will be scouring the supporting cast of John Wick 3 to see which characters might become stars of the series. Taylor is certainly up for it.
After playing Oswald Cobblepot, AKA The Penguin, for five years on Gotham, Taylor is eager for audiences to see him in a new light. He used his part in John Wick 3 to showcase a different look.
What he didn't get to do is have a gunfight with Keanu Reeves.
John Wick: Chapter 3 – Parabellum opens on May 17, 2019.


Sports Authority releases an ad circular almost every Sunday. In this week's Sports Authority weekly ad they show a Warm up their Holidays sale, which is valid from 12-6-15 through 12-12-15. If you are looking for outdoor winter gear such as jackets, snowboard, skis, and boots now is the time to buy them. Sports Authority is running some great sales this week for the holiday.
Sports Authority sells athletic gear and apparel for sports including tennis, soccer, golf, running, snowboarding, basketball, weight training, yoga, and more. They have more than 450 stores throughout the US. The Sports Authority weekly ad is released in the Sunday newspaper every couple of weeks.


text:
CTMQ > Museums > Gasoline Alley Automotive/Ford Museum
Gasoline Alley Automotive/Ford Museum
Full Gas
Stafford (Google Maps location)
I do not know if Donald Passardi still opens his private museum to visitors. Information on it is very hard to come by these days – not that it was ever easy. Heck, I've never been sure what the name of this place is. I've seen it as Gasoline Alley Automotive Museum and I've seen it as Donald Passardi's Ford Museum.
Whichever is correct, just know that this is a private museum on Mr. Passardi's property that is only open very rarely via appointment… if even at all anymore. But if it is when you read this, and you are interested in automotive history, you'll want to figure out how to see the priceless collection.
I received an invite from a reader to some sort of "locals only" open house in 2017. I believe it was done in partnership with the Stafford Historical Society Museum. Like, only museum members were invited. I am not a local nor a SHS member, but hey… I should get a few perks like this, right?
Right. I don't know if Passardi lives in Stafford because of its proximity to the Stafford Motor Speedway, but that's a nice happenstance if not.
Regardless of its accessibility or proximity to this or that, Passardi has amassed an amazing collection. I've said often that I don't collect anything, but am always fascinated by people who devote their lives to doing so. Many of these types of collectors aren't millionaires either. It takes passion, dedication, persistence, and decades of effort.
In Passardi's case, he worked the overnight shift at the Stop & Shop in Glastonbury and spent his days collecting automobile relics. Rather than be squeezed out of his home, he built a 4,800-square-foot museum next door, exclusively for his collection.
Passardi began collecting all things Ford decades ago – he purchased a 1930 Ford Model A pickup truck when he was 15 – but was focused on selling them off to make a small profit. Then one day he decided to start keeping these Ford treasures for himself. I guess he realized that the things he was seeking wouldn't be around forever – especially the one-of-a-kind items. And so the collection grew and grew. It filled his garage and more.
Over the years, Passardi became pretty well known to Ford collectors and he eventually opened his "museum" to anyone to visit, free of charge. My own conversation with Passardi was very short as there were dozens of others there during my visit, and I had Damian with me.
The museum is hard to miss from the road. There's a vintage gas station pump in front of a white garage. (There were also a bunch of llamas and emus right next to the property which I guess is normal in Stafford.)
He's been host to visitors from all over the world. They come to see things like the 1930s-era antifreeze display; the '40s- era Gulf motor oil cans, still full; the ornate gas pumps with glass globes; and the fleet of restored cars, including a 1946 Ford Sportsman, one of just 743 manufactured. This is an astonishing collection.
In fact, Passardi has things that no one else has. He has developed a relationship with the Henry Ford Museum of American Innovation in Dearborn, Michigan because they have come calling for items that they are missing.
Some of the more unique items in his collection: The 1934 Chicago Century of Progress Ford Rotunda architect model that he bought in Michigan many years ago and was featured in the V-8 Times magazine; a Henry Ford wax figure which was purchased at an auction when the Gaslight Village wax museum in Lake George, NY closed; a "globe" trophy from a 1937 Ford sales winner; a baseball marked "1933 Exposition V8" and signed by Henry Ford along with photo of Henry signing baseballs.
If you need another example of why collectors are a bit odd – actually, there are dozens of items here that prove this, but this one stood out to me – Passardi has some Ford charcoal briquets and barbecue stuff. This is one of the most prized possessions here. Not the actual antique cars, but some old charcoal.
I do appreciate that the collection extends beyond car stuff. Ford got involved in all sorts of business ventures, and Passardi is here to prove it. Ford produced his own tomato juice from the thousands of acres of farmland he owned. Since he couldn't market the juice on his own, he sold his business to the Ford Motor Co. Passardi has several of the original tomato juice bottles in display cases. Ford also produced fertilizer, and experimented with gasoline made out of soybeans in the late 1930s and 40s, according to the museum.
But back to the charcoal, as there's more to it than just Ford's name on the bag. It turns out that Ford himself was involved in the creation of the briquette. I encourage you to read this story from the New York Times which explains how Ford, along with a Michigan real estate agent named Edward G. Kingsford, Thomas Edison, and tire magnate Harvey Firestone went on a camping trip during which they discussed all the wood used for the millions of Model T's Ford was selling. Ford hated the wasted wood so they worked with a guy in Oregon to use the sawdust and stumps to make briquettes.
Ford marketed them to be sold at dealerships, and well, okay, I get why there's a bag of 80-year-old charcoal in Stafford now.
And one of the things Passardi wishes he had? A boxed piece of cake from Henry and Clara's 50th Anniversary. He had a chance to buy one some years ago but thought it must be a fake, until he saw some on display somewhere. So odd to me.
There are things here like an actual copy of the Detroit Times from the day Henry Ford died in 1947. That makes more sense. And a rare 1946 Ford Sportsman convertible with side panels made of maple and mahogany? Totally fair.
Original political advertisements promoting Ford's little-known bid for the presidency? Oh yeah. China used in the cafeterias of Ford factories? Okay, getting weird again. Passardi's extensive collection includes more than 10,000 original items, most dating between 1903 and 1953.
It goes without saying that Passardi has spent a good deal of his money on his collection. I'm sure his numbers fluctuate, but I believe he had about 15 antique Ford automobiles when I visited.
One thing I learned is that Passardi is obsessive about cataloging his collection. He does the research and tries to find corroborating evidence that what he has is original. (For example, he found pictures of people eating off his Ford cafeteria china to go with his Ford china set.) I very much appreciate that and can relate to that bit of his obsession.
The rarest items here, I think, are those related to Ford's short-lived political career. In 1918, Ford ran for the U.S. Senate, but lost. He also ran for president in 1924, but dropped out after winning the Michigan primary to support Woodrow Wilson.
Passardi has original advertisements, campaign pins, and other Ford presidential memorabilia. He even has a sign from the 1920s that reads "Wilson needs Henry Ford."
Passardi has badges from almost every Ford plant in the country. Let's see… what else… Ford pedal cars, trophies given out to employees in the early 1940s, ladies compacts from the 1930s, gear shift knobs sold at expositions, salt and pepper shakers in the shape of the Rotunda building, Ford perfume bottles, stamps, printer blocks commemorative plates, and countless other items.
His rarest automobile is a 1946 Ford Sportsman, a wood-sided convertible. The car has power windows, a button on the floor to switch the radio, and a fire extinguisher which apparently makes it rarer. It cost about $1,600, which was twice the cost of a typical Ford at the time.
Also in the garage is a Ford neon light from 1932, which still works. Everywhere I turned there was some other Ford thing. I apologize for not knowing much about cars, as I'm sure a different intrepid Connecticut museum cataloger would be able to write 3,000 words about the cars alone.
Oh well, I'll leave you with this tidbit: Passardi drives a Ford Crown Victoria. That's all I've got.
Source: Journal Inquirer
CTMQ's Museum Visits
Filed Under: Museums, New Post Tagged With: Appointment Only, Cars and Trucks, Damian, Free Museums, private museum, Rarely Open, Stafford, Tolland County
256. Boothe Memorial Park & Museum


text:
Ram Navami violence: West Bengal governor visits riot-hit areas, appeals for peace
One person was killed and two police officers suffered serious injuries on Monday when clashes broke out between two groups over a Ram Navami procession in the Raniganj area of Bardhaman district.
Published: 31st March 2018 09:30 PM | Last Updated: 31st March 2018 09:30 PM | A+A A-
Local Womens agitating before West Bengal Governor Keshari Nath Tripathi during violence affected areas of Asansol at Burdwan District in West Bengal on Saturday. | PTI
CM Mamata Banerjee blames coal mafia for Bengal Ram Navami communal stir
Bengal Ram Navami violence: Clash-hit Raniganj limps back to normalcy
Ram Navami clash in Bihar's Aurangabad: Accused flees from custody
Post-Ram Navami violence, police gear up for Hanuman Jayanti in West Bengal
West Bengal Ram Navami violence: Babul Supriyo files counter-FIR
ASANSOL/RANIGANJ: West Bengal Governor K N Tripathi today met the victims of the riot-hit areas of Asansol and Raniganj and appealed for peace, saying people from all religions should respect each other's festivals.
One person was killed and two police officers suffered serious injuries on Monday when clashes broke out between two groups over a Ram Navami procession in the Raniganj area of West Bengal's Bardhaman district.
The violence spread to areas in Asansol, prompting the police to suspend Internet services and clamp prohibitory orders under Section 144 of the CrPC in the trouble-torn areas of the district.
The governor, who reached Asansol today morning, held a meeting with senior police and administration officials and took stock of the situation.
Later, he visited some of the affected areas of Raniganj and Asansol and spoke to the local people.
He also visited the shops that were gutted during the violence.
"Peace should be paramount. I have come here with the message of peace and brotherhood. Everybody should live in peace and respect each other. There should not be any recurrence of such incidents. Everybody should respect each other's religious festivals," Tripathi told reporters after visiting the areas.
He, however, expressed his inability to visit all the affected areas.
Senior Trinamool Congress leader and state Parliamentary Affairs Minister Partha Chatterjee, however, questioned the governor "visiting only selected areas".
"People will question the governor about his visit to selected areas. We all know that BJP leaders are meeting him," he said.
Chatterjee said the Mamata Banerjee government has efficiently tackled the situation.
He accused the BJP of fomenting communal riots in the state.
Tripathi met the district magistrate, the police commissioner of Asansol-Durgapur and the inspector general of police (western range) earlier in the day and inquired about the present situation.
Asked if he was happy with the steps taken by the police and the administration to tackle the situation, Tripathi said, "Whatever I have to say I will say it to the state government.I don't want to discuss it here."
Earlier this week, the state government had advised him against visiting Asansol and Raniganj, citing security reasons.
Meanwhile, West Bengal state Congress president Adhir Chowdhury was stopped when he was on his way to the Asansol-Raniganj area to meet the victims.
Chowdhury, along with other state Congress leaders, staged a sit-in, only to withdraw it later.
"I just wanted to meet the victims but the police didn't allow me. They are trying to hide something," he said.
Chowdhury accused the state government for not doing enough to control the communal flare-up.
A four-member delegation of BJP MPs is scheduled to visit the Asansol-Raniganj area tomorrow and submit a report to BJP president Amit Shah.
Union minister Babul Supriyo and state BJP Mahila Morcha president Locket Chatterjee were also stopped from entering the Asansol-Raniganj area by the police on Thursday.
The Imam of Noorani Masjid, Imdatullah Rashidi, had said that his son was also killed in the violence, but there was no confirmation from the police on the incident.
Rashidi had also appealed for peace in the area.
Supriyo, the Asansol MP, thanked Rashidi for his appeal.
"I salute u Imam saab & I hope one day I wil b able 2 visit u without being judged or being accused of playing #VoteBankPolitics. There is no way anyone of us can ever relate 2 the pain u r going thru but I can surely feel rejuvenated & inspired by the mind power u hv showered. Salam (sic)," Supriyo tweeted.
State BJP president Dilip Ghosh said the law and order situation in the state is unfortunate.
"The governor visited Asansol today. As a result, the common people will gain confidence. BJP leaders have been barred from visiting the area and BJP workers are being subjected to atrocities," Ghosh alleged.
"Prohibitory orders are still in force as the situation here is tense. No fresh incident of violence was reported from the area in the last three days," a senior police officer said, adding that large contingents of the police and the Rapid Action Force (RAF) are patrolling the area.
Ram Navami violence K N Tripathi West Bengal Governor Asansol Raniganj


text:
Q: How to re-commit an existing commit after git reset I have a number of commits in Git history:
A->B->C->D->E->F->G
I have done a git reset to remove a number of last commits and preserve history based on this answer: Revert to a commit by a SHA hash in Git?
git reset --hard C
git reset --soft HEAD@{1}
git commit -m "Reverting to the state of the project at f414f31"
So, at this point I have a history:
A->B->C->D->E->F->G->H where H commit reverses D->E->F->G
Now I would like E commit brought back. However if I create a new pull request based on E commit it tells that main branch is in sync with E commit and there is nothing to commit.
I would expect, since E was one of the commits which was reset, to be able re-commit it. What would be the best way to it?
(I do have more than 4 commits to revert and it would tedious to revert one by one)

A: You can try to cherry pick the E commit.
See https://git-scm.com/docs/git-cherry-pick
Another option is to create a branch based on C, then cherry pick E and create a PR.

redpajama_set_name: RedPajamaStackExchange


I have completed the state board exam with the state of Massachusetts and am officially licensed in Esthetics and Makeup Artistry! Thank you for your continued support through this journey. I will also be applying for reciprocity to the state of New Hampshire, so I will be available for booking in both states.


text:
Eastern Pennsylvania's preeminent court reporting agency since 1981
Schedule a Deposition
Gallagher Reporting and Video subscribes to and abides by the ethics and standards promulgated by the National Court Reporters Association in its Code of Professional Conduct.
Gallagher Reporting & Video, LLC is located in Allentown, PA and serves clients in and around Allentown, Bethlehem, Easton, Doylestown, Philadelphia, Norristown, Reading, Pottsville, Wilkes-Barre, Scranton, Stroudsburg, Lehigh County, Northampton County, Bucks County, Montgomery County, Philadelphia County, Delaware County, Berks County, Schuylkill County, Luzerne County, Lackawanna County, Wayne County and Monroe County.
1275 Glenlivet Drive
Internet Depositions
Videotaping Services
Daily and Expedited Transcripts
Electronic and Condensed Transcripts
Rough Draft Transcripts
© 2013 - 2021 Gallagher Reporting & Video, LLC. All rights reserved.
Custom WebExpress™ court reporter website design by NextClient.com.


text:
Události
 První punská válka (264–241 př. n. l.)

Úmrtí
 ? – Lu Čung-lien, čínský učenec a státník (* 305 př. n. l.)

Hlavy států
 Seleukovská říše – Seleukos II. Kallinikos (246–225 př. n. l.)
 Řecko-baktrijské království – Diodotus I. (250–240 př. n. l.)
 Parthská říše – Arsakés I. (247–211 př. n. l.)
 Egypt – Ptolemaios III. Euergetés (246–222 př. n. l.)
 Bosporská říše – Pairisades II. (284–245 př. n. l.) » Spartacus IV. (245–240 př. n. l.)
 Pontus – Mithridates II. (250–220 př. n. l.)
 Kappadokie – Ariamnes (280–230 př. n. l.) a Ariarathes III. (255–220 př. n. l.)
 Bithýnie – Ziaelas (254–228 př. n. l.)
 Pergamon – Eumenés I. (263–241 př. n. l.)
 Sparta – Leónidás II. (254–235 př. n. l.) a Eudamidas II. (275–245 př. n. l.) » Ágis IV. (245–241 př. n. l.)
 Athény – Diomedon (246–245 př. n. l.) » Theophemus (245–244 př. n. l.)
 Makedonie – Antigonos II. Gonatás (272–239 př. n. l.)
 Epirus – Pyrrhos II. (255–237 př. n. l.)
 Římská republika – konzulové Marcus Fabius Buteo a C. Atilius Bulbus (245 př. n. l.)
 Syrakusy – Hiero II. (275–215 př. n. l.)
 Numidie – Gala (275–207 př. n. l.)

3. století př. n. l.

redpajama_set_name: RedPajamaWikipedia


text:
Jonaki Ray
Fiction and Non-Fiction
Conversations and Readings
Workshops,Teaching, and Editorial Experience
Photograph by Tinu Mani
Jonaki Ray was educated in India (IIT Kanpur) and the USA (UIUC) and graduated with Master's degrees in Chemistry and Computer Science. After a brief stint as a software engineer, she returned to her first love, writing. She is now a poet, writer, and editor based in New Delhi, India.
Awards and nominations for her work include the 2019 Iceland Writers Retreat Alumni Award, the 2018 Pushcart Prize nomination, and the 2018 Forward Prize for Best Single Prize nomination. She was the winner of the 2017 Oxford Brookes International Poetry Contest, ESL category, and has been shortlisted in many other contests, including the 2021 Live Canon Pamphlet Competition, the 2020 Verve Poetry Press Open Submission Call, and the 2018 Gregory O'Donoghue International Poetry Prize.
Her poetry has appeared in numerous publications including POETRY, Poetry Wales,The Rumpus, the Best Indian Poetry 2018 anthology, Asian American Writers' Workshop, Hindustan Times, and Southword Journal. Her non-fiction and fiction writing have appeared in Cha, The Wire India, Indian Express, Times of India, Bengaluru Review, The HinduBusinessLine, Lunch Ticket, and elsewhere.
Her poetry collection, Firefly Memories, is forthcoming from Copper Coin (India) in 2022; while her chapbook, Lessons in Bending, will be published by Sundress Publications (USA) in 2023.