Hot News

Mission of HKTA

2012-02-05T14:32:00.000+08:00

Hong Kong Tennis Association

Missions

To promote tennis to all through the HKTA and collaborations with other tennis and government bodies

To set and maintain the standards of the game to an international level and to nurture talented local players to compete in regional and international tournaments

To raise the standards of tennis by organizing local, regional and international competitions

Objectives
Hong Kong Tennis Association has never deviated from its objective to promote tennis to all, to nurture talented players, and to raise the standard of the game in Hong Kong.

Programs

The HKTA organizes a number of local and international tennis events as well as junior and elite development programs, for example, star of the future, talent group, and youth athlete. Etc, a corporate training scheme, coaching certification courses, a Tennis-For-All open enrollment program, and a mini-tennis initiative for young children.

Organization Structure

The HKTA is a non-profit organization and recognized by both the Asian Tennis Federation (ATF) and the International Tennis Federation (ITF). The Association is guided by a Council whose members are elected for a two-year term. There are currently 39 member clubs affiliated with the HKTA and approximately 4000 individual members. Also, there are a nine specialized Committees that oversee particular aspects of the work of the Association, each Committee is chaired by a Councilor and supported by other council members or those knowledgeable tennis enthusiasts from the general public that are invited to participate by the respective Committees. The first is the Coaches Development Committee which includes a chairman, a vice Chairman, 8 members, 2 ex-officio members, and 5 HKTA staffs .The second is the Development Committee which includes a chairman, 4 members, 2 ex-officio Members, and 4 HKTA staffs .The third is the Education and Qualification Committee which includes a Chairlady, 7 members, 2 ex-officio Members, and 4 HKTA staffs .The forth is the Elite Committee which includes a chairman, 3 members, 2 ex-officio members, and 5 HKTA staffs . The fifth is the Executive Committee which includes a president, 3 vice presidents, Honorary Secretary, and Honorary TreasurerThe sixth is the League Management Committee which includes chairman, immediate past chairman, president, league secretary, 11 members and 3 HKTA Staffs .The seventh is the Membership Services Committee which includes chairman, 6 members, 2 ex-officio members and 3 HKTA staffs .The eighth is the Officiating Committee which includes chairman, 8 members, 2 ex-officio members, 3 HKTA staffs .The last is the Tournament Committee which includes Chairman, 7 members, 2 ex-officio members, 5 HKTA staffs .

In Hong Kong Tennis Association, it includes patrons and council. For patrons, there are three main patrons, the Life Patrons Dr. Stanley Ho, GBS, the Honorary Patrons the Hon. Ronald Arculli, GBS, JP Mr. L Cyril Kotewall, and the Patron Mr. Hu Fa-kuang, GBS, JP

In Hong Kong Tennis Association Council, there six officers of the association, the president, the Hon. Secretary, the Hon. Treasurer, and three vice president. Also, it includes nine councilors

Past paper for HKIT (GE150 - Information Systems / ISY10212 - Contemporary Issues in MM and IT / IT106 - Information Systems and Multimedia)

2012-02-04T08:56:00.001+08:00

EXAMINATION FOR TERM OCTOBER 2009

Course:

1. Associate Degree of Science in Computing and Information Technology

2. Associate Degree of Business Administration

Subject:

IT106 Information And Multimedia Systems

All the documents need to be submitted to CMS on or before 5pm, 22^nd Jan 2010 (Friday)

Instructions to Students:

This is a take home exam. Students are required to finish 4 forum discussions and one report.

For each forum, contributions need to display an understanding of multiple perspectives regarding the issue under discussion. Specific positions are encouraged, but need to be argued based upon critical thinking and utilize published materials from the media and academic literature. Each discussion should have a words length of 300 words to 600 words.
Write a report which identifies, discusses and assesses a current issue in the area of Multimedia and Information Technology. Particular attention should be given to any social, cultural, ethical, and legal implications of these new technologies. The report should have a words length of 2500 words to 3500 words.

Forum 1: Privacy and celebrity... in the modern world.

(5 marks)

What is privacy in the modern world?
What role does celebrity play?
How does Multimedia and Information Technology impact upon privacy and celebrity?

In recent days the death of Michael Jackson has received blanket coverage in conventional news media (newspapers, radio news and television news).

Other media have been dealing with high volumes of traffic too. Google thought that it may have been under cyber attack due to the very high rate of inquiries of "Michael Jackson" that happened with such an immediacy in time.
(See: http://www.smh.com.au/technology/technology-news/jackson-queries-cause-google-meltdown-20090627-d06w.html)

Some people are literally born as a celebrity - these are the princes and princesses of this world who inherit a role in public life from their parents, the kings and queens. There are very few such people left on the planet, and their level of celebrity may be localized to just a few countries.

All other celebrities are "produced" or "manufactured". Movie stars (especially when married to each other, as are Angelina Joli and Brad Pitt) are a marketers dream. Prominent sports and music stars (again, especially when married as are Victoria (Posh Spice) and David Beckham) can no longer live their private lives privately. Event such as births of children along with the disruptions or unhappiness that occur in family life such as separations and divorce, are played out in the public media whenever they occur.

Why is this so? And what are the rights and wrongs of this? After all, if the general public payed no attention to these "stories" then they would not appear in the news media because they would not be the material that sold papers, or gained viewers or was considered to "be news".

Forum 2: First Person Computer Games.

(5 marks)

What are the implications?
Can these games be seen as training young users to commit acts of violence?

Check out this site:

http://www.smh.com.au/digital-life/games/outrage-as-terrorist-game-lets-players-massacre-civilians-20091029-hmey.html?autostart=1
There was a documentary aired last night (4/10/09) on SBS about "The Samurai", a TV series produced in the 60's and 70's which achieved a cult status in the minds of Australian children at the time. It was the first TV series that produced a range of merchandise associated with a show in Australia.
http://www.tvseriesgalore.com/blog/?p=2217

Lots of school kids at the time were crazed about the show and although the merchandise consisted mainly of ninja costumes and plastic swords, many took to using tin-snips to fabricate their own star knives from discarded tin can lids.

Forum 3: Privacy and Security...in the modern world.

(5 marks)

What is privacy in the modern world?
What role does threats to security play?
How does Multimedia and Information Technology impact upon privacy and security?

Last week the headlines were again reporting hotel bombings in Indonesia (http://www.aol.com.au/news/story/Jihad-in-Jakarta/2348587/index.html), resulting in several deaths.

Such bombings are not isolated to Indonesia.

The flying of airplanes into the twin towers of The World Trade Center in the U.S.A on September 11th 2001 captured lots of media attention. In part because of the severity of the event, but perhaps also because of the extreme nature of the footage that had been captured (both the crashing of planes into the buildings, and the crashing of the buildings to the ground). Be warned, explicitly graphic but for example, see: http://www.youtube.com/watch?v=1lKZqqSI9-s. Several thousand people died as a direct result.

This event changed the political relationship between some countries of "the west" and groups considered to be aligned with Islamic fundamentalism, which was identified as being responsible.

The reality is that whatever the politics of the situation, bombings of public figures and public spaces (trains, buses, airplanes, hotels, restaurants, weddings) has become a relatively more common strategy employed by some groups and the location for such events has clearly become more globalised.

Information and Communication technologies such as mobile phones, email, and internet sites have been used to plan, coordinate and execute some of these attacks. Consequently, many governments have sought to modify their countries' laws regarding privacy and communications to enable greater surveillance (with varying degrees of success).

What are the rights and wrongs of such a trend towards increased surveillance? Are you happy with such a state of affairs? Does it make you feel safer? Does it make the world safer?

Forum 4: Public Information and Politics.

(5 marks)

What is public information in the modern world?
What role does politics play?
How does Multimedia and Information Technology impact upon free speech and politics?
------------------------------------------------------------

In democratic countries “freedom of thought” and “freedom of speech” are fundamental to the political process.

Freedom of thought maintains that all people have the right to think for themselves, including with respect to political issues. Freedom of speech is the right to voice publicly ones’ thoughts, without fear of reprisal from the government of the day (nor from one in the future).

The underlying ethic which drives a democracy is the principle that the people of a country, through a voting system, have the right to elect the government of that country. This enables the collective will and wisdom of the people of a nation to take responsibility for their countries future.

In democratic countries the power to determine what appears in newspapers, television and radio is generally held by the businesses that run these media. In non-democratic countries the power to determine what is presented in the newspapers, television and radio is generally held by the government.

In recent years the internet has provided a means by which any individual who holds knowledge on how to upload information and who has access to the hardware and software required, can present to the public domain any information he or she chooses to present. This can be something as benign as a recipe for fried rice, or something as destructive as a recipe for explosives. The information uploaded can also be (and often has been) of a political nature.

Governments, both democratic and non-democratic, have been moving towards increasing restrictions placed upon the nature of the content that can be presented and received on the internet. But the type of content chosen to prohibit will bring into contrast the views of governments in democratic countries compared to those in non-democratic countries.

Discuss.

Report on contemporary issue in multimedia and Information Technology

(40 marks)

Students are encouraged to select a specialised topic area focussing on a contemporary issue in multimedia and Information Technology. It will enable you to undertake detailed study in an area:

- in which you hold intrinsic interest

- that has specific relevance and application to an aspect of you personal and/or professional life either currently or in the future

- that you will find more motivating, and strive to achieve a higher quality product

- that you will embrace, and experience higher levels of self satisfaction, and

- that you will gain greater generic knowledge, skills and attitudes regarding research and the production of reports.

Individual assignment - Hong Kong Tennis Association

2012-02-03T14:30:00.001+08:00

Individual assignment-

Hong Kong Tennis Association is an association to promote tennis, raise the standards of tennis by organizing competitions. Yet, no any association is perfect. It must have some improvements for it to become much better. And Hong Kong Tennis Association should have improvements of public relations.

First and foremost, Hong Kong Tennis Association is deficient in media publics. Publics can only get in touch with it by access its website or visit its office. Lack of media reports the news about Hong Kong Tennis Association’s campaigns. Media is the biggest channel to make connections between publics and the association. Hence, it should be suggested when it holds some campaigns just like competitions in local or “Fun Day”, it is better to invite some famous people in order to attract media to come and report aims to make publics to know about Hong Kong Tennis Association.

What is more, Hong Kong Tennis Association does not have any seminars to public. It just has some seminars for people who want to be coaches. The recommendation of it should be hold some seminars in primary or secondary schools or shopping malls that can let publics to feel more connected to it. It is because it let children to get in touch of tennis if it holds seminars in schools and let parents to know and let their children to play tennis through seminars in shopping malls.

Apart from the inadequate of seminars, exhibitions are also important to Hong Kong Tennis Association because it has none of exhibitions to publics. It should be recommended to have exhibitions including to display information about Hong Kong Tennis Association by the broads, and to show the figures about tennis court, tennis ball, tennis racket or even some famous tennis player with details, of course including leaflets about the upcoming events and application forms of Hong Kong Tennis Association.

Another recommendation for improvement to Hong Kong Tennis Association is the community service. It held a fun day on March before. However, it is not enough and also people want to join the fun day should register before. It is so troublesome to join it that people need to register. Free of charge of fun day is attractive to publics but it is better for publics to join it without register due to the problem of public do not know Hong Kong Tennis Association so much.

All in all, Hong Kong Tennis Association should have more improvements of public relation because tennis is not really very common relatively for other sports in Hong Kong. If Hong Kong Tennis Association can improve public relations more, it effectively to let community can get in touch with it more. It will increase more people to play tennis and want to know more about tennis voluntarily. Therefore, Hong Kong Tennis Association is better to have improvements of public relations.

2012-01-31T19:19:00.000+08:00

罕見血病青年急求藥費續命

2011-11-19T09:50:00.000+08:00

27歲的冲仔患上罕有白血病，每 3個星期需要 13萬元購買自費藥吊命。梁御和攝

2011-11-10

生命無價，治病卻有價！ 27歲的冲仔初踏社會，對人生充滿盼望，卻被罕有白血病襲擊，數月間雙目幾近失明，現依靠每三星期逾 13萬元的自費藥吊命，並等候配對合適骨髓進行移值。最禍不單行是傾盡積蓄為他支付藥費的母親近日又發現乳房有腫瘤，令瀕臨斷藥的樂仔深受打擊。不甘生命就此消逝的他撐起軟弱的身軀求援，盼善心人助他重燃生命之火。
「我希望可以好番，照顧阿媽！」現在沙田威爾斯親王隔離病房的冲仔，癌細胞攻擊雙眼致視物模糊，目無焦點地說：「我已經幾個月未返過屋企，醫生幫我做過一、二線化療療程都冇效。之後醫生話我眼球內出現血塊，家只可以睇到模糊光影」。

自費療程每次需 13萬元
今年五月，原本身體健壯的冲仔發現頸部腫起，全身出現瘀痕，入院檢查後確診為急性淋巴細胞白血病。數年前大專畢業的冲仔在政府部門任職合約制電腦工程人員，他不斷進修，一直以成為正式公務員為目標，奈何患上惡疾，人生計劃被打破，生命更一度危在旦夕。醫生見冲仔年紀尚輕，建議他嘗試一種香港較少用的自費藥物 Nelarabine療程，每三星期一次，每次需費 13萬元。冲仔父母動用所有儲蓄，讓他注射了兩針，初步效果理想，癌細胞指數下降至 10%。到醫院日以繼夜照顧兒子的冲母焦急地說：「醫生 8月時已經幫佢搵骨髓，醫生話大概要等半年，呢段時間要好好控制病情，估計仲要等多三個月，要捱到做移植，估計藥費隨時過百萬」。

冲仔年輕時身體健康，料不到突然患上惡疾。

冲仔幼時樣子精靈可愛，圖為與父母及姊姊合照。

母親驗出胸部有腫瘤
冲仔患病後停工，生活全賴任職三行工人的父親支持。父母為救他騰出畢生積蓄，惟藥費高昂，根本無法繼續支持。看到父母為自己憂心，媽媽更可能因此憂出病來，冲仔深感歉疚，「阿媽之前驗身發現胸部有腫瘤，家等候進一步化驗係咪惡性，我好擔心」。他希望可繼續用藥保住性命，趕及找到合適骨髓移植，得以康復，報答父母劬勞。
在病旁侍候兒子的冲母聽見兒子孝心，雙眼發紅說：「佢可以好番，開開心心咁生活，已經係最大嘅報答」。母慈子孝，還望社會善長集結力量，以實際行動給予他們支持，讓冲仔好好地活下去。
「冲仔」捐款編號： C3122

網上捐款： http://hk.charity.nextmedia.com/site/index.php?fuseaction=site.donate

TAKE ASSESSMENT: TEST 7 TOPIC 7

2011-09-20T18:51:00.000+08:00

Take Assessment: Test 7 Topic 7
Name Test 7 Topic 7
Instructions Instructions:
   1. You have 30 minutes to complete this test
   2. You only have one attempt and must finish it once started
   3. Answer all 6 questions
Timed Assessment This Test has a 30 minute timer.The elapsed time appears at the top right of the window.
A 1 minute warning will be displayed.
Multiple Attempts Not allowed. This Test can only be taken once.
Force Completion This Test must be completed now.



   Question 1
Which below are elements of a security audit and alarms model? (15.2)
A. System logs, email logs and apache logs
B. Operating system updates / patches, application updates / patches and anti virus updates
C. Audit analyzer, security reports, archives and security audit trail
D. None of the above

From the text, Stallings & Brown (2008), page 477 and 478, the elements of a security audit and alarms model are described as follows;

• Event discriminator: The is logic embedded into the software of the system that
monitors system activity and detects security-related events that it has been
configured to detect.
• Audit recorder: For each detected event, the event discriminator transmits the
information to an audit recorder. The model depicts this transmission as being in
the form of a message. The audit could also be done by recording the event in a
shared memory area.
• Alarm processor: Some of the events detected by the event discriminator are
defined to be alarm events. For such events an alarm is issued to an alarm
processor. The alarm processor takes some action based on the alarm. This action
is itself an auditable event and so is transmitted to the audit recorder.
• Security audit trail: The audit recorder creates a formatted record of each event
and stores it in the security audit trail.
• Audit analyzer: The security audit trail is available to the audit analyzer, which,
based on a pattern of activity, may define a new auditable event that is sent to the
audit recorder and may generate an alarm.
• Audit archiver: This is a software module that periodically extracts records from
the audit trail to create a permanent archive of auditable events.
• Archives: The audit archives are a permanent store of security-related events on
this system.
• Audit provider: The audit provider is an application and/or user interface to the
audit trail.
• Audit trail examiner: The audit trail examiner is an application or user who
examines the audit trail and the audit archives for historical trends, for computer
forensic purposes, and for other analysis.
• Security reports: The audit trail examiner prepares human-readable security
reports.

   Question 2
Which of the following *are* supported by the Cisco Systems' "Monitoring, Analysis and Response System (MARS)"?
A. Network devices: Cisco software
B. Firewall / VPN devices
C. Intrusion detection software
D. Anti virus
E. Applications: Apache IIS web servers
F. All of the above G. None of the above

Refer to your text, page 503, Computer Security Principles and Practice, Stalling & Brown, 2008.

   Question 3
Which of the following statements best describes "system-level audit trail"? (15.5)
A. traces the activity of individual users over time
B. captures data such as login attempts, both successful and unsuccessful, devices used, and OS functions performed
C. generated by equipment that controls physical access and then transmitted to a central host for subsequent storage and analysis
D. may be used to detect security violations within an application or to detect flaws in the application's interaction with the system

Four different categories of audit trails are;

System-level audit trails: captures data such as login attempts, both successful and unsuccessful, devices used, and OS functions performed

Application-level audit trails: may be used to detect security violations within an application or to detect flaws in the application's interaction with the system.

User-level audit trails: traces the activity of individual users over time.

Physical access audit trails: generated by equipment that controls physical access and then transmitted to a central host for subsequent storage and analysis.

   Question 4
Which of the following areas (categories of data) should audit data be collecting? (15.4)
A. deletion of objects
B. identification and authentication functions
C. printout of data
D. use of access rights to bypass a policy check
E. All of the above F. Only A, B and D above

All actions that may effect access to data are to be collected by audit data.

The following are all categories of data that audit data should collect;

• Introduction of objects within the security-related portion of the software into a
subject’s address space
• Deletion of objects
• Distribution or revocation of access rights or capabilities
• Changes to subject or object security attributes
• Policy checks performed by the security software as a result of a request by a
subject
• The use of access rights to bypass a policy check
• Use of identification and authentication functions
• Security-related actions taken by an operator and/or authorized user (e.g.,
suppression of a protection mechanism)
• Import/export of data from/to removable media (e.g., printed output, tapes,
disks)

   Question 5
Which of the follow need to be understood to perform effective reviews and analysis of an organisation's systems audit logs?
A. characteristics of common attack techniques
B. organisations policies regarding acceptable use
C. the operating systems and major applications
D. security software used on hosts
E. brand computers purchased by each department of the organisation
F. All of the above
G. Only A, B, C and D above
The brand of computers purchased is not relevant, but all other points listed are needed to be understood to review and analyse an organisation's systems audit logs.

Refer to your text, page 498, Computer Security Principles and Practise, Stalling & Brown, 2008.

   Question 6
Audit logs that track user activity on an information system provide __________.
A. identification
B. authorization
C. accountability D. authentication

Mor-Christian General Soccer Ability Skill Test Battery

2011-08-11T14:39:00.001+08:00

Introduction

Soccer is one of the popular sports in the world, as there is a very large number of people that play football at different levels. According to a survey conducted by FIFA published in 2008, over 300 million people from more than 200 countries regularly play football. As a result, we can see that effective skill tests are vitally important for placement, grading, diagnosis in various levels, since sport skill test is an instrument that elicits an observable respone which provides information about motor skill used in a sport.

Mor-Christian General Soccer Ability Skill Test Battery(Mor & Christian, 1979) is one of the soccer tests that evauate passing, dribbling and shooting ability in soccer. Here, the content of the tests will be discussed and evaluated in the following part. On the contrary, there are the suggestions on improving the quality of the test that instructors not only administer the tests smoothly, but also test the subjects’ ability widely.

a) Mor-Christian Soccer Dribbling Test

( Validity-0.73 , Reability-0.80 )

There are many good criteria in this test, including short period of time for administering, equipments, human resource, availability of venue and objectives. In this test, there is a short period of time, around 2 minutes for each subjects. Besides, few human resources and equipment are required, so that the test is easy for setting and administer. But large area is oocupied by the circular path in this test, some testing area may not provide sufficient area to carry out various tests at the same time. Actually, it is good for students that three trials are allowed in this dribbling test, as the learning effect is a key factor to reduce the relibility, so trials can help the subjects to familiarize the testing procedures. Moreover, clockwise and conterclockwise direction are required to finish that the test is suitable for real situation, soccer need to dribble in all direction continually in the match, not only in their dominant direction. However, there are some suggestions in this test. The first one is the distance between cones. In the outline of setting, there is 5 yds among the cones within the path, but too long distance may cause the reduction of validity and reliability. Dribbling refers to the maneuvering of a ball around a defender through short skillful taps or kicks with either the legs, excess time is allowed for dribblers to co-ordinate their body and it is easy to dribble all the cones if there are too long distance among the cones. In fact, players in the competition often execute dribbling in the short distance from the defenders, so the distance is suggested to reduce from 5 yds to 3.5 or 4 yds, and it can let the subjects in dribbling test as well as real situation. The second suggestion is that subjects’ liner-dribbling ability can be tested, not only in circulat direction. Since players also face the challenges face to face in the match, so the liner-dribbling part is suggested to follow the circular dribbling, this combination can fit in real situation and increase the validity of the test.

b) Mor-Christian Soccer Shooting Test

( Validity-0.78 , Reability-0.96 )

This shooting test can verify the shooting ability exactly, especially for the soccer attackers, as it can test the object shooting accuracy. However, shooting power is not tested and scoring scheme has a contridiction. Shooting ability is mainly consist of accuracy, power and speed, and the speed is a key factor to determine the quality and the chance of scoring, but this test just test subject’s shooting accuracy only. Also, the scoring scheme has conflict that the score is counted even subjects shoot at the other corner which is not they claimed, since there is a large difference in shooting two opposite concer, so the instruction of scoring scheme is not clear and unintelligible.

Actually, there are many reasons that it is quite difficult to administer this shootiing test. First of all, time consuming is factor that every subject consume much time to finish all of the trials, around five to six minutes, so an inconvenience may be caused. Second is about the availability of venue, because not all of the testing area contain a standard goal or sufficient area for setting, so this test is limited by small venue. Thirdly, many equipments are required for setting this test when it compares with another two tests, so it increases the difficulty in setting.

c) Mor-Christian Soccer Passing Test

( Validity-0.91 , Reability-0.98 )

This passing test has the highest validity and reability in these three tests, it prove that it has good criteria for a sport skill test, however, it also has some drawbacks.

There are few equipments in this test like the dribbling test metioned before, so instructors can prepare the test easily. Nevertheless, subjects consume a lot of time to finish all of the passing tests in different positions when it compares with other two soccer tests , around 4 minutes for each subject. Furthermore, it requires many human resources to keep the fluency of the test. For the objectives, the test is good for subjects’ passing abiliy, since the proper distance and several passing direction in the test are essential for a soccer match and it can explain why there are the high validity and reability. On the other hand, the test result may not reflect actual ability. It is because players will not pass the ball on the fixed points like this passing test if they play in the match. Players need to run and then pass the ball continually, so this passing test is not fit to test subjects’ actual passing ability. Moreover, ability of long pass is not involved in the test, so long pass testing is suggested to administer, as long pass is an important part in soccer, it is used in defenders and side attackers normally.

Conclusion

are the basic skills in soccer, it is necessary to test players’ ability of these aspect. Mor-Christian General Soccer Ability Skill Test Battery is one the the good tests to evaluate although there are some suggestions for improvement. In fact, not only these three aspect, many skills are also required for a good soccer player. For instance, agility and header are two of the important skills in soccer, perhaps it is better that various parts are included beside dribbling, passing and shooting and test the subject comprehensively.

乳字的意思

2011-07-24T16:53:00.000+08:00

老師給小朋友解釋：“乳”就是“小”的意思。
比如“乳豬”就是“小豬”，“乳鴿”就是“小鴿”。
小明，請你用“乳”字造個句。

小明：我家經濟條件不太好，只能住 20坪的乳房。
老師：（我暈）這個不行。換一個。

小明：我每天上學都要跳過我家門口的一條乳溝。
老師：（暈死）不行，再換一個。

小明：老師，我想不出來了。把我的乳頭都想破了。

REVIEW ASSESSMENT: TEST 3 TOPIC 3

2011-07-17T16:41:00.011+08:00

Question 1
Which of the following best describes a relational database? (5.2)
Question 1 answers
A. A relational database uses a single file to store data sequentially.

B. A relational database is a collection of tables (also called relations).

C. A relational database organises its data in a tree-like structure.
D. None of the above.
E. A and B and C.

Question 2
How many primary keys and how many foreign keys are required in a relational database? (5.3)
Question 2 answers

A. One primary key and zero or more foreign keys.

B. Every table must have one primary key and one foreign key.
C. None, as primary keys and foreign keys are not always required.
D. None of the above.

Question 3
Which statement below best describes a Decentralized Administration Policy? (5.4)
Question 3 answers
A. A small number of Administration users may grant and revoke access rights.
B. The owner (creator) of any table reserves all rights to grant and revoke access rights to each table that he or she has created.

C. In addition to granting and revoking access rights to a table, the owner of a table may also grant and revoke authorisation to other users, allowing them to grant and revoke access rights to the table.

D. There needs to be at least one Administration person in each organisational unit of a company who can grant and revoke access rights to any specified table.
E. All of the above

Question 4
Which statement below best describes an inference threat to a RDBMS? (5.6)
Question 4 answers
A. An inference threat arises when an unathorised person has gained access to a database.

B. An inference threat arises when the database administrator allows remote connections to the database server.

C. An inference threat arises when the database table structure is known to be poorly designed.

D. An inference threat arises when the combination of a number of data items can be used to infer data of a higher sensitivity.

Question 5
Which statement below best describes perturbation? (5.8)
Question 5 answers
A. Provides answers to all queries, but only to authorised users.

B. Provides answers to all queries, but the answers may be approximate.

C. Provides answers to all queries, but the user identification of the querry is logged.
D. Only provides answers to queries that are not classified as secret.

Question 6
Which statement below best identifies the disadvantages of database encryption? (5.9)
Question 6 answers
A. Key management
B. Insecurity
C. Inflexibility
D. Vulnerabilities
E. Both A and B

F. Both A and C

G. Both B and C
H. Both C and D

Essay - Let's put a halt to capital punishment

2011-07-10T14:21:00.004+08:00

Capital punishment, also known as death penalty or execution, is the most extreme sentence which can be devised in about 59 countries including China,

Japan

and the

United States of America

nowadays, according to Amnesty International’s figures in 2008. While more and more people actually come to realize problems of practicing capital punishment, yet, supporters insist on claiming that it is the most effective way to deter people from committing crimes. They continue to think that capital punishment is the only proportionate compensation for the victims whereas life imprisonment will solely cause a high cost which is ultimately paid by our hard-working and observant taxpayers unfairly. At first glance, their claims may seem reasonable and unassailable. However, you will probably find the flaws when you examine closer.

First and foremost, capital punishment may actually be practiced to kill people who have not committed any crimes mistakenly or deliberately. For instance, with the help of advanced technology such as DNA investigation, 23 people executed in the

United States of America

in the 20^th century have actually been found guiltless. Doubtless, there is absolutely no way that can compensate these innocent people who were killed only because of wrong judgment. Yet, this kind of tragedies actually happens in most, if not all, of the other countries across the globe exercising capital punishment. In China, for example, a man called Tan Hang Sin was convicted to have killed his own wife and executed 16 years ago. Surprisingly, his wife was found to be still alive later. How ridiculous it is! Capital punishment is initially established to help uphold justice, protect people and penalize criminals. Ironically, it is now practiced to kill sinless people and just let criminals go free! How many harmless people should actually sacrifice before countries exercising capital punishment finally wake up? Worse still, capital punishment is sometimes utilized by dictators or dictatorial governments to extinguish their opponents deliberately. North Korean former president, Kam Tai Chung, was once accused of betraying North Korea and sentenced to capital punishment. However, the underlying reason why he was sentenced to capital punishment was that he was the leader of an opposition party at that time. It is undeniable that such kind of abuse of capital punishment still really exists in some countries around the world. Capital punishment actually becomes a form of witch hunt.

Aside from the tragedies which may be caused by capital punishment, legal sanctions should also in no way be regarded as a means for victims or their family members to take revenge on criminals. Honestly, when people get offended, it is common and normal for people to firstly think of taking revenge. “An eye for an eye and a tooth for a tooth” seems likely to be the first sentence springs up in our mind. Nevertheless, it is also true that we should all know and be reminded that taking revenge is useless and meaningless. Victims can never be brought back to life even when the criminals are killed. However, if the criminals are executed, they will surely lose a precious chance to turn a new leaf and more families will lose their family members forever and ever. There is a Chinese saying that “Do unto others as you would be done by”. When you have lost your beloved family members and you know the pain of this, you should never support capital punishment to cause others to suffer. After all, “an eye for an eye only ends up making the whole world blind”.

Apart from uselessness and meaninglessness of capital punishment, ethical problems should also be considered thoroughly. As a matter of fact, no-one in the world should be allowed to end any others’ lives for any reasons. Isn’t it nonsensical that we claim that we respect human life but we do not respect criminals’ lives at all? Isn’t it absurd that we claim that killing is wrong but we keep on killing criminals at the same time? I am sure that no-one will deny that life is precious. I find it especially preposterous to say that we should support capital punishment because many prisons are over-crowded and under-funded now and life sentence will cause a huge burden for our taxpayers. Not to say that prisoners can actually carry out some kinds of social services in jail to keep themselves productive, should a human life be anyway weighted like this? No way! How can we support to kill someone because he or she will become a burden of our society? It is really totally non-sense. Besides, Studies in the United States of America show that capital cases actually cost between $1 million and $7 million from arrest to execution. Nevertheless, life sentence cases only costs about $500,000, which is only half of the cost of capital cases. There is actually no more ridiculous excuse for us to support capital punishment.

In conclusion, capital punishment is actually a bane in disguise. Although it may seems that capital punishment can deter people from committing crimes, it is also capital punishment that causes more and more tragedies to make more and more people killed “legally”. Besides, acceptance of capital punishment definitely implies that taking revenge is a decent thing to do whereas it is definitely not. We should, thus, immediately stop this kind of wrong message from being passed on to the public and to our next generation. Another thing that we should immediately make clear is that life is doubtlessly invaluable and that criminals’ lives are also doubtlessly invaluable. No-one should be allowed to take away any others’ lives and high costs should not be a reason to support capital punishment. Therefore, it is my firm belief that capital punishment should be abolished at once under all circumstances and it is high time for all countries in the world to wake up to figure out what capital punishment really brings us. As the old saying goes, “to err is human”. We all have made some mistakes in our life and we all hope that others can forgive us and give us a second chance. So, why can’t we just also give all criminals a second chance?

Take Assessment: Test 4 Topic 4

2011-06-14T17:13:00.050+08:00

Question 1

Which of the following is NOT identified as a intruder "class"? (6.1)

	A.	Masquerader
	B.	Imposter
	C.	Misfeasor
	D.	Clandestine user

The following are identified by the text (page 177) as intruder classes;

1. Masquerader: An individual who is not authorized to use the computer and who
penetrates a system's access controls to exploit a legitimate user's account.

2. Misfeasor: A legitimate user who accesses data, programs, or resources for which
such access is not authorized, or who is authorized for such access but misuses his
or her privileges.

3. Clandestine user: An individual who seizes supervisory control
of the system and uses this control to evade auditing and access controls or to
suppress audit collection.

Question 2

Which of the following is NOT a desirable characteristics of an IDS? (6.5)

	A.	Be fault tolerant in the sense that it must be able to recover from system crashes and reinitializations.
	B.	Impose a minimal overhead on the system where it is running.
	C.	Be able to scale to monitor a large number of hosts.
	D.	Allow dynamic reconfiguration; that is, the ability to reconfigure the IDS without having to restart it.
	E.	Be able to be configured according to the security policies of the system that is being monitored.
	F.	Need substancial human supervision to run.

These are desirable characteristics (specified in textbook, p 183) of an IDS;

•Run continually with minimal human supervision.
•Be fault tolerant in the sense that it must be able to recover from system crashes
and reinitializations.
•Resist subversion. The IDS must be able to monitor itself and detect if it has been
modified by an attacker.
•Impose a minimal overhead on the system where it is running.
•Be able to be configured according to the security policies of the system that is
being monitored.
•Be able to adapt to changes in system and user behavior over time.
•Be able to scale to monitor a large number of hosts.
•Provide graceful degradation of service in the sense that if some components of
the IDS stop working for any reason, the rest of them should be affected as little as
possible.
•Allow dynamic reconfiguration; that is, the ability to reconfigure the IDS without
having to restart it.

Question 3

Which of the following ARE useful for profile-based intrusion detection? (6.7)

	A.	Counter: A nonnegative integer that may be incremented but not decremented until it is reset by management action. Typically, a count of certain event types is kept over a particular period of time.
	B.	Gauge: A nonnegative integer that may be incremented or decremented. Typically, a gauge is used to measure the current value of some entity.
	C.	Interval timer: The length of time between two related events.
	D.	Resource utilization: Quantity of resources consumed during a specified period.
	E.	All of the above.
	F.	Only A, B and C above.

All the following ARE useful for profile-based intrusion detection (see textbook page 186);

Counter: A nonnegative integer that may be incremented but not decremented until it is reset by management action. Typically, a count of certain event types is kept over a particular period of time.

Gauge: A nonnegative integer that may be incremented or decremented. Typically, a gauge is used to measure the current value of some entity.

Interval timer: The length of time between two related events.

Resource utilization: Quantity of resources consumed during a specified period.

Question 4

Which of the following best describes the "operation" of a virus or worm? (7.3)

	A.	Dormant phase.
	B.	Propagation phase.
	C.	Triggering phase.
	D.	Execution phase.
	E.	All of the above.
	F.	None of the above.

Typical phases (as described by the textbook on page 220) of operation are; a dormant phase, a propagation phase, a triggering phase, and an execution phase.

Question 5
Which of the following is NOT an effective worm countermeasure? (7.7)

	A.	Signature-based worm scan filtering.
	B.	Threshold random walk (TRW) scan detection.
	C.	Filter-based worm containment.
	D.	Rate halting.
	E.	DNS base scanning worm detector.
	F.	Payload-classification-based worm containment.
	G.	Rate limiting.

A "DNS base scanning worm detector" would likely fail to detect an IM worm outbreak, because an IM worm’s attack payload will most likely be forwarded through the IM server, using the target’s user ID instead of a target IP address (Yan, Xiao,& Eidenbenz, 2008 pg 2).

See page 236 of textbook for details on the following.

Signature-based worm scan filtering: This type of approach generates a worm
signature, which is then used to prevent worm scans from entering/leaving a
network/host. Typically, this approach involves identifying suspicious flows and
generating a worm signature. This approach is vulnerable to the use of
polymorphic worms: Either the detection software misses the worm or, if it is
sufficiently sophisticated to deal with polymorphic worms, the scheme may take a
long time to react. [NEWS05] is an example of this approach.

Filter-based worm containment: This approach is similar to class A but focuses on
worm content rather than a scan signature. The filter checks a message to
determine if it contains worm code. An example is Vigilante [COST05], which
relies on collaborative worm detection at end hosts. This approach can be quite
effective but requires efficient detection algorithms and rapid alert dissemination.

Payload-classification-based worm containment: These network-based
techniques examine packets to see if they contain a worm. Various anomaly
detection techniques can be used, but care is needed to avoid high levels of false
positives or negatives. An example of this approach is reported in [CHIN05],
which looks for exploit code in network flows. This approach does not generate
signatures based on byte patterns but rather looks for control and data flow
structures that suggest an exploit.

Threshold random walk (TRW) scan detection: TRW exploits randomness in
picking destinations to connect to as a way of detecting if a scanner is in operation
[JUNG04]. TRW is suitable for deployment in high-speed, low-cost network
devices. It is effective against the common behavior seen in worm scans.

Rate limiting: This class limits the rate of scanlike traffic from an infected host.
Various strategies can be used, including limiting the number of new machines a
host can connect to in a window of time, detecting a high connection failure rate,
and limiting the number of unique IP addresses a host can scan in a window of
time. [CHEN04] is an example. This class of countermeasures may introduce
longer delays for normal traffic. This class is also not suited for slow, stealthy
worms that spread slowly to avoid detection based on activity level.

Rate halting: This approach immediately blocks outgoing traffic when a threshold
is exceeded either in outgoing connection rate or diversity of connection attempts
[JHI07]. The approach must include measures to quickly unblock mistakenly
blocked hosts in a transparent way. Rate halting can integrate with a signature- or
filter-based approach so that once a signature or filter is generated, every blocked
host can be unblocked. Rate halting appears to offer a very effective
countermeasure. As with rate limiting, rate-halting techniques are not suitable for
slow, stealthy worms.

Yan, G., Xiao, Z. & Eidenbenz, S., 2008. Catching instant messaging worms with change-point detection techniques. In Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats. San Francisco, California: USENIX Association, pp. 1-10. Available at: http://portal.acm.org/citation.cfm?id=1387715 [Accessed March 14, 2010].

Question 6
Which of the following is NOT a typical USE of a BOT? (7.8)

	A.	Distributed Denial of Service (DDoS) attack.
	B.	Spamming, an attacker is able to send massive amounts of bulk e-mail (spam).
	C.	Keylogging, captures keystrokes on the infected machine.
	D.	Persistant, activates each time the systems boots.
	E.	Spreading new malware, Botnets are used to spread new bots.
	F.	Installing advertisement add-ons and browser helper objects (BHOs), Botnets are used to gain finanical advantages.
	G.	Attacking IRC chat networks, Botnets are also used for attacks against internet relay channel (IRC) networks.
	H.	Manipulating online pols / games, since every bot will have a unique ip address, every vote will have the same crediability as a vote by a realp person.

See page 240 of the textbook for details.The following are uses for bots; Distributed Denial of Service (DDoS) attack, Spamming, an attacker is able to send massive amounts of bulk e-mail (spam), Keylogging, captures keystrokes on the infected machine, Spreading new malware, Botnets are used to spread new bots, Installing advertisement add-ons and browser helper objects (BHOs), Botnets are used to gain finanical advantages, Attacking IRC chat networks, Botnets are also used for attacks against internet relay channel (IRC) networks, and Manipulating online pols / games, since every bot will have a unique ip address, every vote will have the same crediability as a vote by a realp person.

COMPUTER CONTROL AUDITING AND SECURITY > TAKE ASSESSMENT: TEST 6 TOPIC 6

2011-06-11T09:42:00.023+08:00

Question 1

Which below are indirect threats posed by fire? (13.2)

	A.	Heat
	B.	Release of toxic fumes
	C.	Water damage from fire suppression
	D.	Smoke damage
	E.	Fire itself
	F.	All of the above
	G.	Only A, B, C and D above

The direct threat is the damage caused by the fire itself. The indirect threats are from heat, release of toxic fumes, water damage from fire suppression, and smoke damage.

Question 2

TRUE OR FALSE - An overflowing of water into a data center can cause direct damage to all or part of the information system. (13.6)

	True
	False

Prevention and mitigation measures for water threats must encompass the range of such threats. For plumbing leaks, the cost of relocating threatening lines is generally difficult to justify. With knowledge of the exact layout of water supply lines, measures can be taken to locate equipment sensibly. The location of all shutoff valves should be clearly visible or at least clearly documented, and responsible personnel should know the procedures to follow in case of emergency. To deal with both plumbing leaks and other sources of water, sensors are vital. Water sensors should be located on the floor of computer rooms, as well as under raised floors, and should cut off power automatically in the event of a flood.

Question 3

A device that assures the delivery of electric power without interruption is a(n) __________. (13.7)

	A.	GFCI
	B.	HVAC
	C.	GPS
	D.	UPS

To deal with brief power interruptions, an uninterruptible power supply (UPS) should be employed for each piece of critical equipment. The UPS is a battery backup unit that can maintain power to processors, monitors, and other equipment for a period of minutes. UPS units can also function as surge protectors, power noise filters, and automatic shutdown devices when the battery runs low. For longer blackouts or brownouts, critical equipment should be connected to an emergency power source, such as a generator. For reliable service, a range of issues need to be addressed by management, including product selection, generator placement, personnel training, testing and maintenance schedules, and so forth.

Question 4

What are the benefits of security awareness, training and education programs for a organisation? (14.1)

	A.	Improving employee behavior
	B.	Increasing the ability to hold employees accountable for their actions
	C.	Mitigating liability of the organization for an employee's behavior
	D.	Complying with regulations and contractual obligations
	E.	All of the above

1. Improving employee behavior
2. Increasing the ability to hold employees accountable for their actions
3. Mitigating liability of the organization for an employee's behavior
4. Complying with regulations and contractual obligations

Question 5

At its core, a(n) __________ policy is a document that outlines the protections that should be enacted to ensure that the organization’s assets face minimal risks. (14.3)

	A.	Safety
	B.	Acceptable use
	C.	Change management
	D.	Security

An organizational security policy is a formal statement of the rules by which people that are given access to an organization's technology and information assets must abide.

Question 6

Which of the following are reasons why organisations would have a email and internet use policy? (14.7)

	A.	Stop work time being consumed through non-work-related activities
	B.	Stop staff members looking at work related websites
	C.	Stop staff members emailing organisation suppliers and or clients from outside the organisation
	D.	None of the above

1. Significant employee work time may be consumed in non-work-related activities, such as surfing the Web, playing games on the Web, shopping on the Web, chatting on the Web, and sending and reading personal e-mail.

2. Significant computer and communications resources may be consumed by such non-work-related activity, compromising the mission that the IS resources are designed to support.

3. Excessive and casual use of the Internet and e-mail unnecessarily increases the risk of introduction of malicious software into the organization's IS environment.

4. The non-work-related employee activity could result in harm to other organizations or individuals outside the organization, thus creating a liability for the organization.

5. E-mail and the Internet may be used as tools of harassment by one employee against another.

6. Inappropriate online conduct by an employee may damage the reputation of the organization.

Octopus card scandal

2011-06-01T19:52:00.020+08:00

In Hong Kong, almost everyone has at least one Octopus card (on average each person possess two cards!), which is a rechargeable contactless stored value smart card using the RFID technology. It is widely used in Hong Kong because it brings a lot of convenience to the people for shopping, eating in restaurants, taking class attendance in almost all the high schools of HK etc…and almost all public transportation (especially for the mass transit system (MTR)). Each card has a built-in microchip containing an electronic purse which can actually calculate and store all the information regarding the holders’ transaction details. It is also recognised internationally and wins many prestigious awards. Many companies from different regions and countries visited Octopus Company (which is mainly owned by MTR company of HK) to learn the advanced technology and management of Octopus system. While Octopus cards can be purchased anonymously for cash, over 2.4 million customers have registered for the widely adopted Octopus Rewards program with their personal information, according to the information posted in its website.

However, such a “giant” and “prestigious” company suddenly became a controversial target in this July (2010) when it was disclosed by a local media that the management of the Octopus company has been selling nearly 2 million customers’ private data to merchants since 2006. The Octopus company made a total revenue of HK$44 million by selling these customer’s personal data.

The Octopus controversy, the company's CEO first denies that clients' personal data has been sold to third parties for direct marketing. With further investigation by local legislators, she admitted that her earlier denial was erroneous because she did not have critical information when she issued her first denial. She later revealed that Octopus had made HK$44 million in revenue selling information on 1.97 million customers to six companies during the past 4.5 years.

As CEO of the company and the person who might well initiate such deals, she should have had full knowledge of the business. Through her public denial when confronted by the media and legislators who pressed serious concerns on behalf of the public, she has shown a lack of honesty, lack of business ethics, and lack of social responsibility.

Under the pressure of all the medium (newspaper, TV, radio etc.) and the direct intervention of the local government, the MTR board (which owns 57% of share of Octopus company) apologized to the public for “inconsistencies and errors in public communications made by Octopus management.” The octopus management team has decided to donate all the money earned by selling the privacy to merchants to charity.

However, the people responsible involved in this scandal will not face any lawsuit because there are not any existing privacy laws to regulate this kind of scandal (which might be a bit surprising). Octopus’ privacy policy explicitly states that customer data may be used by “any of [Octopus'] selected business partners” for marketing and Octopus asks for information irrelevant to the card’s operation). Therefore the public has urged to form the legislature to set up the laws/rules to forbid the sale of personal information immediately. The public is outraged at being lied to and outraged that the company has denied selling information for years.

So please discuss what you learned from such example. And what social responsibility, business ethics, and privacy responsibility should a large corporation have? How can regulation of companies such as Octopus, with strong government support, be achieved without these companies failing to comply with the rules themselves? Should local privacy law be revised and regulatory control over Octopus be strengthened concerning supervision and monitoring of business ethics of the business giants? How?

------------------------------

Example 1:

When i was child, I still use my coins and run to the LTR station. Then being hurry to buy ticket because i was going to miss a class. Since Octopus was established, i begin to take a contract with it and have a great convenience for my transportation. Of course, i still didn't know what privacy is.

Now, when i see the news talking that the company of Octopus will sell their customers including me and my parents, the personal information. I feel a bit horrible. Sometimes, personal information is not too important for me, but it does not mean that the company should sell our personal information and the important point is they denies that.

To be honest, the deal is already noted that the personal information maybe used by other partners of Octopus. That can be the residents problem that we never see the policy to purchase Octopus with private data. Moreover, it just making the advertisement always phone us, and still not make us a critical lost i think. Why we don't see the policy and information of every deal detail? If the information for us is really important, we should beware for this even more.

About the CEO, she should admitted that her denial earlier. In the business, the important thing is honest. Honest also is the major thing of social responsibility and business ethics. If a person lies just once, no one will trust him again, like he dig a hole in his honest. The hole can't be fixed forever. When he lies more, there will be more holes. However, the CEO of Octopus company can admitted her false earlier, instead of after it become a scandal and too late.

The customers has lack of knowledge for their privacy and Octopus’ privacy policy explicitly states that customer data may be used. It exactly is legal for their personal data being used, but the customers has not enough knowledge so they look like being lies. The problem is, the company use that to make the great amount revenue and the revenue is just for the company themselves. So i think it is not moral and unfair for the customers. Customers can't sense their important information should not be given to company.

The resident especially children doesn't know what privacy is yet. However, the government can promote the education about the privacy for the student, remind that i didn't know what privacy is when i still was a child. So there should be some education for child, teach them what information themselves should not be issued to strangers, make stronger about the privacy education. Let them always remember these rules until they become independent. So that they will have a better defence with their privacy, which maybe more important than their money. Although Octopus card's fee is low, customers may lose more money when their important information is given to others.

Octopus does a false event, but i still would like to use it. It is too convenience in our life and sometimes we will be given back our money because of many discount (e.g. MTR student 50% fee). Without this card, transportation and other things will be more costly and trouble.

---------------------------------------------

Example 2:

Hong Kong’s Octopus Holdings Limited sold customers’ personal information to other companies and has been paid HK$44 million since January 2006. It raised a lot of discussions among the society regarding the social responsibility of enterprises. In fact, it is not something new to identify what people need by analyzing the customers’ data and then determine how to market the products. It is widely accepted by customers. However, when enterprises do not take the customer value seriously for a short-term profit, the customers were not likely to continue paying for their products.

In the local corporate culture, most managers of practices have business backgrounds, especially in marketing and promotion. Maximizing profit is their only target and they pay less attention to the public interests. Like the Octopus Holdings Limited, it has a weak customers’ privacy scheme. Opt-out instead of opt-in mechanism is used for their services where customers’ data will be available to others. The company then claims that it is the user’s responsibility to dig for it. The Octopus Holdings Limited sold user's personal information and even not giving them sufficient opportunities to know how their personal data would be used. The company has not promoted human rights protection in the business policies. It obviously violated corporate social responsibility.

Selling customers’ data by the Octopus Holdings Limited is just one of examples showing that customers’ personal data is not well protected by corporates. The case also relates to the control of unsolicited commercial electronic messages, such as faxes, emails, short messages, pre-recorded telephone messages, etc. If the Hong Kong Government can do a deeper research for the cases, it may find that both the Unsolicited Electronic Messages Ordinance enforced by the Office of the Telecommunications Authority and Personal Data (Privacy) Ordinance enforced by the Office of the Privacy Commissioner for Personal Data, Hong Kong have been broken at the same time. Since the enforcement of the two ordinances is co-related, it is advised that the two offices can work together and exchange information.

Octopus is one of the world’s leading smart card payment systems. The public thus has a very high expectation to the Octopus Holdings Limited. After the case, both the customer relationship and trust to the company are damaged. An enterprise should seek for a balance between business and social values. If it takes care about the social responsibility, the image of company and the employers’ sense of belonging will be improved. It will benefit from the situation.

-----------------------------------

Example 3:

In Hong Kong, many people use Octopus card. We use octopus card everywhere, transportation, convenience shop, fast food shop, etc. Octopus card become an important part of us.

Few years before, Octopus company starting a reward promotion called　“Earn and Redeem Reward”. Customers can redeem points by using Octopus card. But while the customers apply for the “Earn and Redeem reward”, they should sign for an agreement, the terms and condition inside contain a few pages of terms, including some terms with 1-1.5mm font. How many of us will read the terms and condition Octopus company state? A public survey revealed that more than 90 per cent of the respondents said they hadn’t read the personal information statements when they provided data to apply for Octopus services, reports Bloomberg.

In July, while the Octopus “Earn and Redeem reward” happening occur. The Hong Kong citizens start to pay attention to the privacy problem. This happen tells us that we should pay more attention to protect our personal information and the Hong Kong companies should pay attention to their social responsibility, business ethics and privacy responsibility.

In this case, Octopus Company trying to conceal the information of the terms and conditions, Octopus company only concern to fulfill the privacy law of government but ignore customer’s reception to selling our personal information. This is an action lack of social responsibility and business ethics, makes the customers very disappointed.

In fact, the companies have responsibility to explain the terms and condition to us clearly, and let us know clearly how they will handle our personal information ,because many people will not read the terms themselves, some of them are not able or don’t have enough knowledge to read the terms. For example, they can make the fonts bigger, or explain the terms to us while we sign the contract, to let customers from every ages clearly watch the terms and condition.

As the biggest shareholder of Octopus, Government also to be one's unshirkable responsibility, they take not enough monitor to the company. I think it’s the time for them to revise the local privacy law. Maybe they can revise the law, ensure a readable font size in the terms and condition, or ensure all the companies should monitor by an individual organization, to protecting the privacy information.

In conclusion, Hong Kong companies should make more improvement to their social responsibility, business ethics and privacy responsibility. Many times, we have no choice to choose a service providers, it’s hard for us to decline the contract. So, responsible companies are very important. They should monitor themselves to protect the customer information. A good company will not always face to money, they will concern more about the social responsibility, these action cannot earn much money, but it can improve their business ethics, also can build their brand, the outcome is more great.

-----------------------------

Example 4:

In today’s modern society, corporate company should not only concern on the profit of their company but also on business ethics and social responsibility. Company shouldn’t just look at the minimum requirement of the law, the company’s decision will not face any lawsuit or harm to the public, but this might lose the public trust.

Octopus card help to save transaction time for transportations, settle payment of fast-food chain and gives our life more convinience. However such a a “giant” and “prestigious” company suddenly become a big seller by selling our personal information for 4.5 years without our consent.

Although Octopus had stated that the applicant information would be used by “any of [Octopus'] selected business partners”, how many people had awared of this statement or denied to apply such a convenience service due to this reason?

“More than 90 per cent of the respondents said they hadn’t read the personal information statements when they provided data to apply for Octopus services”2, reports Bloomberg.
I believe that they hadn’t read through the terms and condition when signing any contract including submit the data for apply service and was caused by the font size, wordings and voluminousness of the statement.

Recently we had received a lot of advertising phone calls, we cannot clarify if this is related to Octopus or not, but the trend is many companies gain revenue by selling customer’s information to their business partner. If the government still not revising the local privacy law, the problem will get worse.

The goverment has the responsibility to revise the local privacy law to constrain the companies, which have to provide options for applicants to choose if they are willing to accept their personal information will be disclosed to or used by the third party companies. The government should check whether those companies have failed to comply with the rules, and reveal the result to the public in order to enhance the transparency of the companies.

If the company was listed in failing to comply with rules or denies to the public like the CEO of Octopus, its company image will be discredited. It takes times to re-build the public image of Octopus company after the public knew they sold their information, “Octopus must do more than replace its chief executive officer to regain public trust”1, two lawmakers said.

Hong Kong residents lack knowledge for their privacy protection and it is legal for their personal information being used by companies, which the company business operate as opaque system, the residents could not know whether their privacy have been well protected. The government should provide education through programmes and advertisement to elevate how to protect personal information.

The Octopus issue is an alert for people in Hong Kong starting to protect their personal information by read through the statement when signing contract or apply any kind of services.

Octopus did a wrong action and Hong Kong resident had lost their confidence on using octopus, but it is too convinient to our daily life, we will keep using it for transportation but might not go for further extend on other usage.

Now there is a pressing need to revise the privacy law and regulatory control over and strengthened the concerning supervision and monitoring of business ethics, forbid the sale of personal information immediately after revealing Octopus had sold customers’ information. The public is outage and didn’t know whether there are other companies had followed the same track several years ago.

The Octopus data leak has sparked public outrage over privacy laws in Hong Kong, with many voicing concern that their private information is being exposed and there are few laws to protect them.”Currently the highest penalty for privacy infringement is a fine of a few thousand HK dollars, which is an insufficient deterrent for large multi-million enterprises.”3 Dr. Wilson Wong said (Assistant Professor of Politics and Public Administration at the Chinese University of Hong Kong, )
“the current laws fail to protect citizens and leave them exposed to information abuse.”4 Emily Lau said (Member of the Legislative Council)

From my point of view, hopefully the Government can revised the local privacy law before such kind of issue happen again and well protect all resident’s personal information.

_______________________________

1 Bloomberg Businessweek , August 05, 2010
www.businessweek.com/news/2010-08-05/octopus-must-do-more-to-regain-trust-lawmakers-say.html

2, 3, 4 Theepochtimes, by Liang Lsui & Sonya Bryskine, August 05, 2010 www.theepochtimes.com/n2/content/view/40410/

-------------------------------------

Example 5:

For the case of selling customers’ personal data, I believe that the fiasco is just the tip of the iceberg. Although Octopus’ privacy policy clearly states that customer data may be used by “any of [Octopus'] selected business partners” for marketing and Octopus asks for information irrelevant to the card’s operation, how many customers read the personal information statements?

Bloomberg.com found that more than 90 per cent of the respondents in a public survey said they hadn’t read the personal information statements when they provided data to apply for Octopus services. I believe that it is true as the font size of privacy policy in personal information statements is very small, and there are many words in privacy policy.

Certainly, many people will ignore the personal information statements, as font sizes are small and lots of words in there. Moreover, the aged people cannot read the statements well, should staff of octopus explain the details of Octopus’ privacy policy well when customer purchase the octopus card?

I am sure there are cardholders who don’t mind Octopus Company selling their personal data. In fact two companies exchange their customers personal data without make announcement already make customers antipathy.

So that in the future, when I buy any products and services, I will study privacy policy provided clearly to protect myself. In addition, I will also remind people I know to study any statement and policy related with them to avoid any unlucky things happen such as personal data was sold.

Society expects that organizations should provide products and services that are needed and desired by customers. However, people in Hong Kong really feel disappointed about it, as customers do not want to spread of their personal information. Customers provide their personal data because they believe that company needs their information to provide good services. However, Octopus Company did not protect personal data of its customers well, and after sold the personal data, customers will only receive more advertisement from other companies, but services provided by Octopus Company did not improved.

Government may check companies have failing to comply with the rules themselves or not in a fixed period, and show out the result. If a company is in the list of “failing to comply with the rules themselves”, its goodwill should be decrease and net profit will also decrease. Companies will not fail to fulfill with rules themselves, as they need customers’ trust. Moreover, business ethics of company people can understand which company is worth to trust or not.

In addition, government may provide some training course or information through social media to let people understand more how to protect their personal information. Also, government may also let managers of companies to understand how important of social responsibility, business ethics, and privacy responsibility.

Besides, local privacy law should be revised and regulatory control. One of reasons of Octopus Card admits making money selling personal data to third parties is there are not any existing privacy laws to regulate this kind of scandal. The people responsible involved in this scandal will not face any lawsuit. It is because people who purchased Octopus Card must be agreeing that customer data can be used by any of Octopus' selected business partners”. I think that customer should have their right to control the usage of their personal information between company bases on local privacy law.

Be honest, if personal information of managers in Octopus Company were sold or exchanged by another company, will they feel good? I wish local privacy law could be well to protect people in Hong Kong,

Microsoft(R) Office Word 2007 中文版應用測驗

2011-05-20T10:06:00.000+08:00

測驗內容為一般商業文書處理軟件應用技巧，包括(但不限於)下列範圍：

文字處理技巧：

插入日期及時間

插入索引標籤 è文字群組è日期及時間指令

插入註腳

參考資料索引標籤è註腳群組è插入註腳指令

插入圖文框

插入索引標籤 è文字群組è文字方塊指令

右鍵 è

Test 2, covers topic 2

2011-05-17T16:36:00.010+08:00

Test 2 Topic 2
Authentication & Access Control (Chapters 3 and 4 of the textbook).

Question 1

Which of the following statements best describes issues that need to be considered with respect to using popular words such as "happy" or "hello" as a password? (3.2)

Correct Answer:

C. Using a popular word as a password assists in remembering the password, but also means that it is easier for another person to hack that password.

Question 2

Which of the following statements best describes the dynamics of a Denial-Of-Service (DOS) attack.

Correct Answer:

B. A denial of service attack is the result of a flooding of system resources by an excessively high number of simultaneous requests.

Question 3

Which of the following statements best describes the issues of setting decision thresholds for biometric matching? (3.8)

Correct Answer:

C. In setting the thresholds for biometric matching it is more important to prevent false matches than to prevent false mismatches.

Question 4

Which of the following statements best describes a general model of access control? (4.4)

Correct Answer:

D. Subject are granted access to Objects determined by a set of defined rules specifying Actions that can be taken.

Question 5

Which of the following statements best describes Role Based Access Control?

Correct Answer:

A. Role Based Access Control provides access and control over files based upon a "need-to-know" principal associated with each positions duties and tasks.

Question 6

Which of the following statements best describes Static Seperation of Duty Relations (SSD) and Dynamic Separation of Duty Relations (DSD)?

Correct Answer:

C. Static Separation of Duty Relations (SSD) focus upon preventing any individual user accessing excessive related actions across multiple user sessions, while Dynamic Separation of Duty Relations (DSD) focus upon preventing any individual user accessing excessive related actions within a single user session.

RCS 0114 Critical Reasoning Section 55

2011-05-11T14:34:00.001+08:00

RCS 0114

Critical Reasoning

Section 55

Content

A. Article One

1) Content of article

2) Definition of the informal fallacy

3) Analysis

B. Article Two

1) Content of article

2) Definition of the informal fallacy

3) Analysis

C. Article Three

1) Content of article

2) Definition of the informal fallacy

3) Analysis

Article one

1. Content of article:

為什麼會迷信？

(明報)2010年2月23日星期二 05:10
【明報專訊】55歲茅山師傅歐陽國富自稱可助有志入娛樂圈的19歲「口靚模」轉運，誘騙她九度發生性行為並令她懷孕，茅山師傅被裁定9項誘騙性交罪成，判入獄6年9個月。現年21歲的口靚模供稱，因她當時工作量不多，經理人提及認識一名茅山師傅，可做法事令事業運轉好，因她們屬演藝界，所以要做性交、口交等茅山儀式。口靚模希望增加工作量及賺多些錢，答應做法事。

法官：過分迷信會釀悲劇

口靚模認為茅山師傅有法力不會令她懷孕，被告更叫她不用避孕。後來口靚模有感星運未見起色，質疑作法成效，被告指要完成9次法事才有效。口靚模對被告的說法半信半疑，但「真心希望可改運」，故仍按被告要求，每隔一個月便往「作法」。

該案法官陳廣池認為社會上有宗教與相信神靈的自由，又指迷信不一定是壞事，惟一旦過態便會釀成悲劇。價值觀會影響個人對外界遭遇的感受，他強調樂天安命、追求快樂為人之所求，命運乃掌握於一己修為與個人奮進，希望事件警惕過分迷信的人。

傳統中國習俗講求吉利，例如8代表「發」，與「死」諧音的4、14等數字就是不吉祥，傳統家庭的家中更會有一本《通勝》，可以查閱日子的吉凶。對相信科學的人來說，查《通勝》可能是迷信，香港城市大學中國文化中心主任鄭培凱教授則認為﹕「《通勝》內的曆法指出那天做什麼才配合天意，是按一年的年月日節氣安排生活的民間智慧，也是日常生活上的哲學。」他指出，以往的農民紅、白二事都會查《通勝》，「在作出生命中重要決定前，會從這本日常生活重要的書中找個吉利日子」。他指《通勝》對較相信命運學的人有用，「這些人較心存依賴，在吉利的日子心理上覺得較舒服、安穩，是圖個心安吧」。

不止是中國人，外國人也有迷信的方式。例如皇家馬德里球星基斯坦奴朗拿度每逢大賽前，都要到同一家理髮店理髮，俄羅斯網球員舒拉寶娃則要求固定更衣室儲物櫃號碼等。

操作制約論解釋「迷信」現象

美國心理學家B. F. Skinner的操作制約（Operant conditioning）學說，或可解釋這個現象︰當你做一些行為，而這些行為帶來愉快結果，你就會開始把這個行為聯繫上結果，久而久之，行為會變成例行動作。就像多哥國腳、曼城前鋒艾迪巴約，他有次代表多哥出賽，一個朋友送他護脛，結果那場比賽他建功了。艾迪巴約從此對這塊「好運pad」情有獨鍾，無論訓練或比賽都戴著。

2. Fallacy: False Causes

False Cause is presuming mistakenly the reality of certain causal connections.

3. Analysis:

Rephrasing the original argument

Rephrase:

Since they are the art performers, to do sexual intercourse, oral sex and so on of the “Maoshan” rite can improve the career fortune.

Premises and Conclusions

Premise:

P They are the art performers

Conclusions:

C To do sexual intercourse, oral sex and so on of the “Maoshan” rite can improve the career fortune.

Explanation

There is no doubt that sex can just satisfy human desire. But there is no any evidence show that sex can improve one’s career fortune. Although they are the art performers, they use sex is cannot change their luck or improve their career fortune. Some people may want to achieve their desires or wants, and then choose to do things wrongly. That is a very dangerous thing that let many people would get hurt by that. As a result, there is an imagined causal connection between the premise and conclusion.

Hence, the argument contains an informal fallacy of having a false cause.

Article Two

1. Content of the article:

大公報 2010年3月1日

擔心再塌樓 不滿遭忽略 業主促重建春田街雙號

【本報訊】市建局宣布展開馬頭圍道、春田街及鶴園街重建工程後，昨日舉行首場公眾諮詢會議，商討重建項目的細節。不少春田街雙數號碼的業主，不滿市建局沒將該處納入重建範圍，要求市建局一視同仁；有鶴園街業主則要求「舖換舖」，否則會反對方案。市建局主席張震遠表示，已考慮多方面因素，若將春田街雙數號碼納入重建項目，會拖慢整個工程進度。

擬建兩幢30 層高樓

市建局上周宣布，啟動重建馬頭圍道43 至45J 號、春田街1 至23 號單號，以及鶴園街6 及8 號的項目，昨午舉行首場公眾諮詢會議，約有三百名受影響居民參加。市建局初步構思於項目範圍內，重建兩幢樓高三十層的樓宇，保留現有的街舖特色，並確保有足夠的公共空間及通風位置；至於重建後的樓宇，市建局計劃不會設有平台。

張震遠說，今次重建是特事特辦，諮詢期為期一個月，期望能盡快安置居民；居民可於本月二十四日前，就重建計劃提出意見，若沒有居民提出反對，市建局最快可於五月提出收購價。

納重建將拖慢工程

在諮詢會上，不少春田街雙數號碼業主，不滿市建局沒將該處同時列入重建範圍。春田街雙數號碼業主其中一名代表關先生說，雙號業主同樣受到塌樓事件影響，留下陰影，他認為市建局只重建春田街單號，是忽略他們的感受，對他們並不公平。他還擔心重建工作展開後，工程會對春田街雙號樓宇造成損害，要求市建局一併重建。

張震遠回應說，曾考慮同時重建春田街雙號，但當地樓宇狀況明顯較馬頭圍道、春田街單號良好，而且若將雙號列入重建範圍，會拖慢整體工程進度，有可能要待一年後才展開。

因此經多方面考慮後，市建局決定以大局為重。他表示明白春田街雙號居民的失望，強調工程不會影響該處。

他還說，未來不排除重建春田街雙號，但暫時未有計劃。

舖主要求「舖換舖」

鶴園街業主亦不滿重建計劃。位於鶴園街六號的合隆麵檔陳先生表示，麵檔已經歷兩代，不滿市建局重建過程倉卒。他要求市建局「舖換舖」，並稱當地不少住宅業主要求「樓換樓」，否則將反對方案。數十名居民在大會完結後，更一度包圍張震遠理論，張震遠表示，收到居民意見，市建局本周四、五會再舉行四場諮詢大會，聽取更多居民建議。

2. Fallacy: Division

Neglected the significance, misunderstand an property of the whole will be preserved after division.

3. Analysis

Rephrasing the original argument

Rephrase:

On the consultation forum, a lot of property owners of even street numbers of

Chun Tin Street

were dissatisfied with the Urban Renewal Authority (URA) that the buildings of even street numbers were not included in the redevelopment project. Mr. Kwan, one of the property owners, said the owners of even street numbers were also affected by the building collapse which casted a shadow over their lives. He thought that URA ignored their feelings as only the buildings of odd numbers of

Chun Tin Street

were going to be redeveloped. It was unfair to them. In addition, he was worried that the construction work of the redevelopment project would cause damages to the buildings of even numbers of Chun Tin. He requested URA to include those buildings in the project.

Premises and Conclusions

Premises:

P1.

Chun Tin Street

is included in the redevelopment project.
P2. Even street numbers of

Chun Tin Street

are a part of

Chun Tin Street

Conclusions:

C Even street numbers of Chun Tin Street must include in the redevelopment project of Ma Tau Wai Road.

Explanation

Because of the accident that occurred in

Ma Tau Wai Road

, the Urban Renewal Authority (URA) announced that the buildings of 43- 45J

Ma Tau Wai Road

1-23 Odd street

numbers of

Chun Tin Street

and

6-8 Hok Yuen Street

were going to be redeveloped. However the even street numbers of Chun Tin Street was not in the list of this redevelopment project, and the owners of this building argued that their building also are the part of Chun Tin Street, so they think their building should be redeveloped too. However the URA chairman argued that because the building’s structure (even street numbers of

Chun Tin Street

) was better than the odd street numbers buildings. In this case the owners of Even street numbers had misunderstand that Odd street numbers of Chun Tin Street were going to redeveloped, because these buildings were a part of Chun Tin Street, it causes the owners of Even street numbers think that they must be redeveloped too because these buildings also are a part of Chun Tin Street.

Hence, the argument contains an informal fallacy of having a Division.

Article Three

1. Content of the article:

香港經濟日報 2010年1月6日

o靚模藏K仔判感化鞠躬致歉

【本報訊】17歲o靚模Monique於去年9月在校內藏K仔，學校職員揭發報警，她早前承認1項藏毒罪，昨被判接受感化1年。

她昨先後7度鞠躬向公眾致歉，指將出任禁毒大使，希望其過錯能對青少年起警惕作用。

「翻版阿Sa」將任禁毒大使

有「翻版阿Sa」之稱的Monique周凱盈，案發時在瑪利亞書院就讀中五，她昨打扮樸素及薄施脂粉。

其代表律師原打算為她求情，但裁判官指已閱畢感化官報告，決定接納建議，頒令她接受感化令。

案發於去年9月8日，瑪利亞書院職員在校內發現被告形迹可疑，遂向她查問，她將涉案毒品交予他，校方報警將她拘捕，政府化驗師證實紙包內藏有0.06克氯胺酮粉末（俗稱K仔），其兩個尿液樣本呈陽性反應。

周表示會就讀中六，希望公眾給她機會改過，她將出任禁毒大使，呼籲青少年遠離毒品。

2. Fallacy: Argument against Persons

To attack an opponent’s view or position by appealing to his problematic characters, social status or special circumstances, instead of giving relevant reasons.

3. Analysis

Rephrasing the original argument

Rephrase:

A teen model called Monique who was found in possession of ketamine inside her school on last September. She has admitted her crime and has been put on probation for 12 months.

She later appeared at a conference and bowed seven times to the publics to show her remorse, and said that she will be an Anti-drug Ambassador to have an effect on public.

Premises and Conclusions

Premises:

P. Monique has taken drug before. .

Conclusions:

C. She is suitable to be an Anti-drug Ambassador to persuade the publics do not take drug.

Explanation

Monique was 17 years old and she is studying in secondary school. Also she was a young model and there have some people who like her very much. However she was found in possession of ketamine last year. After this occurred, she still going to be an Anti-drug Ambassador. However it is ineffective because she has taken drug before, and it is hard to persuade publics especially students, and they may reject the argument about the disadvantages of taken drug that provide by Monique.

Hence, the argument contains an informal fallacy of Argument against Persons.

End

CS 4288/5288 Assignment #3

2011-05-10T14:13:00.001+08:00

1. (RSA) Suppose Alice’s public key (e,N)=(7,pq) where p=103, q=313.
a. Alice’s private key is (p,q,d). Compute d. 13639
b. If you want to encrypt a message M=112 and send to Alice, what is the ciphertext? 14275
c. If Alice wants to sign a message M such that R(M)=353. Suppose R(x)=2R+3. What is the RSA signature? 24117
d. Suppose you receive an RSA signature s=11455 for message M’ from Alice. Recover M’. 198

2. (Rabin)
a. Suppose p=239, q=547, Plaintext=55. If we pad 4 bits, what is the ciphertext? 2371
b. Suppose ciphertext=23432. What is the plaintext (suppose we pad 5 bits)? 3621

3. (ElGamal) We use Z1307* with generator g=2. Suppose Alice’s private key=43
a. Bob wants to send an encrypted message to Alice. Suppose plaintext=913, and the random number for encryption is 41. What is the ciphertext?
(688, 927)
b. Alice receives ciphertext (A,B)=(62,164), what’s the plaintext?
1139
c. Alice wants to sign a message m with h(m)=235. Alice chooses random number k=37. What is the digital signature? (43, 980)
d. Suppose you receive a message m’ tagged with Alice’s signature (R’,S’)= (613,758). If we already calculated h(m’)=323, verify this signature.
v1 = 197, v2 = 466
they are not equal, so invalid

4. (DSA) Let p=2339, q=167. Select generator g=17 for Zp*. Alice’s private key a=37.
a. Suppose she wants to sign a message m with h(m)=789. She chooses the random integer k=49. What’s the signature?
α=17^14 = 1431 mod 2339.
y=1431^37 = 1132 mod 2339. r=(1431^49 mod p) mod q = 127.
Apply Euclid’s algorithm, we can find k^-1=75 mod q.
The signature is (r, s) = (127,112).
b. Verify the signature (75, 99).
r = 127, v = 116
they are not equal, so invalid

芒果芝士凍餅食譜

2011-05-09T14:17:00.001+08:00

餅底材料:

餅底料	60g
牛油溶液	30g

芒果芝士餡材料:

忌廉芝士	220g
糖	60g
芒果醬	40g
淡忌廉	200ml
魚膠粉	8
熱水	2湯匙

餅面材料:

芒果粒	適量
芒果醬	適量

餅底做法:

1) 牛油加熱溶解,加入餅底料拌勻

2) 將已拌勻牛油的餅底料倒入餅模內,以小匙鋪平,放入雪櫃下格待用

芒果芝士凍餅餡做法:

1) 忌廉芝士加入糖打至軟身,加入芒果醬拌勻

2) 將淡忌廉加入( 1 )再拌勻

3) 魚膠粉加入熱水攪拌溶解,再加入( 2 )內拌勻

4) 將已完成的餅餡倒入餅模內,放入雪櫃下格至凝固(約3小時左)

5) 脫模,放上芒果粒及芒果醬即可

注意:

1) 魚膠粉加入熱水攪拌要快,要完全變成溶液, 如果未完全變成溶液就可以用熱水座溶或放入微波爐叮一叮,之後立刻將已做完( 1 )( 2 )的芒果忌廉芝士漿(約2湯匙)拌入魚膠粉溶液中,一拌勻就快速地倒入大碗的芒果忌廉芝士漿中

2) 脫模時可用熱毛巾圍邊或用風筒輕輕吹熱模邊,會比較容易脫模

My mother

2011-05-08T14:27:00.000+08:00

There is no doubt that all of us that we are growing with full of love and care from our mothers. Nevertheless, we get used for the care from our mothers, haven’t we thought that she will leave us one day suddenly? Even we have done something wrong before, from now, as children of our mothers, we should to start a good communication with her. My mother is actually a targeted person for me.

When I was studying in secondary school, I became much more rebel at that time. I tended to wayward, egocentric, emotional that made my mother worry about me so much. Remember the day, I did not back home last night because I hung out with my friends and stayed at one of my friends eventually. When I backed home, I bet my mother would condemn my willful behavior. Yet, my mother seemed to realize that all teenagers would pass through this rebellion period. Hence, she did not blame me at that moment. Oppositely, she acted patiently and just asked me to sit down and expressed her feeling, how worry she felt at that night. I really felt sorry and apologized to her. Due to her complementary method instead of punishing and blaming to teach me, I seldom had conflicts during my rebellion period. It is undeniable that she did such things is for my own good.

Apart from my mother’s verbal communication, my mother’s non-verbal communication is so effective and efficient to me. When I did something wrong or could not satisfy her, she would habitually use her forefinger to point and stare at me and stare without saying anything. After I saw it, I would naturally stop what I was doing and giving her a smile. But if she is really very angry about something, she would clean all the things quickly and with making much noise. Honestly, she should in no ways be regarded as a good body language emitter. Her body language can reflect her emotion and feeling thoroughly.

Besides, my mother is a good listener for me ever. After I finished my HKCEE, I worked as a waitress in a restaurant during my summer holiday. Unfortunately, I did not work happily at that time, because my manager always blamed me, I would refute him sometimes. I told my mother this happening, she practiced as an active listener who validated my feelings and explore my thought, “I know that you work unhappily and have conflicts with your manager. But working as waitress is not an easy job for all of women. But, let me ask you a question,’ are you really doing well all the time?’ If your answer is ‘yes’, just try to talk to your manager in order to solve this problem. If your manager still does not listen to you and always blame you, you may try to quit and find another job. But it your answer is ‘no’, you should think deeply what’s wrong with you while your manager blame you, you may need to have improvements. Anyway, whatever you decide to do, mother always support you, just tell me your feelings and mother will share will you” I could actually feel the warmth and care from mother. My mother’s words are so helpful and she really gave a great feedback to me and I knew my mother cared of my feelings so much. She tried to help me to solve the problem. Doubtless, she is a best listener for me.

Test 10 Topic 11

2011-05-04T19:41:00.001+08:00

COMPUTER CONTROL AUDITING AND SECURITY

Question 1
The ____ is responsible for the fragmentation, compression, encryption, and attachment of an SSL header to the cleartext prior to transmission. (21.1)

A. Standard HTTP
B. SFTP
C. S-HTTP
D. SSL Record Protocol

Correct answer is D

Refer to your text, page 653, Computer Security Principles and Practice, Stalling & Brown, 2008.

Question 2
Which of the follow are supported by S/MIME?

A. Enveloped data
B. Signed data
C. Clear-signed data
D. Signed and enveloped data
E. All of the above
F. None of the above

Correct answer is E

Enveloped data: This function consists of encrypted content of any type and encrypted-content encryption keys for one or more recipients.

Signed data: A digital signature is formed by taking the message digest of the content to be signed and then encrypting that with the private key of the signer. The content plus signature are then encoded using base64 encoding. A signed data message can only be viewed by a recipient with S/MIME capability.

Clear-signed data: As with signed data, a digital signature of the content is formed. However, in this case, only the digital signature is encoded using base64. As a result, recipients without S/MIME capability can view the message content, although they cannot verify the signature.

Signed and enveloped data: Signed-only and encrypted-only entities may be nested, so that encrypted data may be signed and signed data or clear-signed data may be encrypted.
Question 3
Which of the following best describes the SSL Handshake Protocol?
A. The SSL Handshake Protocol is a four (4) phase process whereby messages are sent from the server to the client.
B. The SSL Handshake Protocol is a four (4) phase process whereby messages are sent to and from client and server.
C. The SSL Handshake Protocol is a four (4) phase process whereby messages are sent from the client to the server.
D. The SSL Handshake Protocol is a scalable transaction which enables as many (or as few) phases as required to enable transmissions of files of any size.

Correct answer is B

"The SSL Handshake protocol allows the server and client to authenticate each other and to negotiate an encryption and MAC algorithm and cryptogaphic keys to be used to protect data sent in an SSL record. The Handshake Protocol is used before any application data are transmitted. "(from page 654, Stallings & Brown, 2008).
Question 4
Kerberos’ _______________ is an interacting application that validates clients and servers. (22.1)

A. Ticket Granting Service
B. Authentication Server
C. Authentication Client
D. Key Distribution Center

Correct answer is B

Client: wishes to authenticate itself to a server. Server: requires authentication before granting service to client: Authentication server: authenticates users to servers and servers to users. Ticket-granting server: issues tickets to users who have been authenticated to the authentication server; the tickets are used to authenticate user to server. For further details see page 672 of the text, Stallings & Brown (2008).

Question 5
_________ digital certificates are issued by a CA or RA directly to individuals. (22.4)

A. Server
B. Software publisher
C. Anonymous
D. Personal

Correct answer is D

In essence, an X.509 certificate consists of a public key plus a User ID of the key owner, with the whole block signed by a trusted third party. Typically, the third party is a certificate authority (CA) that is trusted by the user community, such as a government agency or a financial institution. A user can present his or her public key to the authority in a secure manner and obtain a certificate. The user can then publish the certificate. Anyone needing this user's public key can obtain the certificate and verify that it is valid by way of the attached trusted signature.
Question 6
____ is an integrated system of software, encryption methodologies, and legal agreements that can be used to support the entire information infrastructure of an organization.

A. SSL
B. PKI
C. PKC
D. SIS

Correct answer is B

A public-key infrastructure (PKI) is the set of hardware, software, people, policies, and procedures needed to create, manage, store, distribute, and revoke digital certificates based on asymmetric cryptography. The principal objective for developing a PKI is to enable secure, convenient, and efficient acquisition of public keys.

Security Alert (A11-05-01): Multiple Vulnerabilities in Firefox, SeaMonkey and Thunderbird

2011-05-03T15:04:00.000+08:00

Affected Systems:

Firefox 4.0 prior to 4.0.1
Firefox 3.6.x prior to 3.6.17
Firefox 3.5.x prior to 3.5.19
Thunderbird 3.1.x prior to 3.1.10
SeaMonkey prior to 2.0.14

Summary:
Multiple vulnerabilities are found in Firefox, SeaMonkey and Thunderbird. These vulnerabilities are caused by memory safety bugs in the browser engine, dangling pointer in "mChannel", "mObserverList" and "nsTreeRange" objects, errors in Java Embedding Plugin (JEP) shipped with Mac OS X versions, or improper bounds checking by the WebGLES library. There are multiple attack vectors, a remote attacker may entice a user to open a webpage with malicious content to exploit the vulnerabilities.
Impact:
Depending on the vulnerability exploited, a successful attack could lead to a number of conditions ranging from elevation of privileges to arbitrary code execution.
Recommendation:
Mozilla has released new versions of the products to address the issues, they can be downloaded at the following URLs:

Firefox 4.0.1:
http://www.mozilla.com/en-US/firefox/all.html
Firefox 3.6.17:
http://www.mozilla.com/en-US/firefox/all-older.html
Firefox 3.5.19:
http://download.mozilla.org/?product=firefox-3.5.19&os=win&lang=en-US
Thunderbird 3.1.10:
http://www.mozillamessaging.com/en-US/thunderbird/all.html
SeaMonkey 2.0.14:
http://www.seamonkey-project.org/releases/

Firefox 3.5.19 is the last security and stability update for Firefox 3.5.x. Users should consider upgrading to Firefox 4.x.
Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
DITSOs (or your delegates) are also requested to inform the relevant system administrators and end users as appropriate about this issue.
More Information:
More information about the vulnerabilities is available at:

http://www.mozilla.org/security/announce/
http://www.mozilla.org/security/announce/2011/mfsa2011-12.html
http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
http://www.mozilla.org/security/announce/2011/mfsa2011-14.html
http://www.mozilla.org/security/announce/2011/mfsa2011-15.html
http://www.mozilla.org/security/announce/2011/mfsa2011-16.html
http://www.mozilla.org/security/announce/2011/mfsa2011-17.html
http://www.mozilla.org/security/announce/2011/mfsa2011-18.html
http://www.mozilla.com/en-US/firefox/4.0.1/releasenotes/
http://www.mozilla.com/en-US/firefox/3.6.17/releasenotes/
http://www.mozilla.com/en-US/firefox/3.5.19/releasenotes/
http://www.mozillamessaging.com/en-US/thunderbird/3.1.10/releasenotes/
http://www.seamonkey-project.org/releases/seamonkey2.0.14/
http://www.us-cert.gov/current/index.html#mozilla_releases_firefox_updates1
https://www.hkcert.org/my_url/en/alert/11050301
http://www.vupen.com/english/advisories/2011/1127
http://secunia.com/advisories/44407/
http://secunia.com/advisories/44357/
http://secunia.com/advisories/44406/
http://xforce.iss.net/xforce/xfdb/67176
http://xforce.iss.net/xforce/xfdb/67177
http://xforce.iss.net/xforce/xfdb/67179
http://xforce.iss.net/xforce/xfdb/67180
http://xforce.iss.net/xforce/xfdb/67181
http://xforce.iss.net/xforce/xfdb/67182
http://xforce.iss.net/xforce/xfdb/67183
http://xforce.iss.net/xforce/xfdb/67184
http://xforce.iss.net/xforce/xfdb/67185
http://xforce.iss.net/xforce/xfdb/67186
http://xforce.iss.net/xforce/xfdb/67187
http://xforce.iss.net/xforce/xfdb/67188
http://xforce.iss.net/xforce/xfdb/67189
http://xforce.iss.net/xforce/xfdb/67190
http://xforce.iss.net/xforce/xfdb/67191
http://xforce.iss.net/xforce/xfdb/67192
http://xforce.iss.net/xforce/xfdb/67193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0065
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0066
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0067
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0068
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0069
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0070
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0071
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0072
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0073
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0074
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0076
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0077
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0078
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0079
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0080
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0081
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1202

Confidential email - Failed to connect smart card or key file

2011-05-02T15:37:00.000+08:00

Q: A user found that she cannot open CM in her Lotus Notes, the following message was displayed.

What should we do to prevent the user to met the token error when accessing confidential email?

Ans:
If the key file is exist then
    If e-token can locate the key file then
        restart Lotus Notes to try again
    else try to unplug the token and plug it before excute the LN
else try to replace the token.

win 7 如何才能搜尋文件內容

2011-05-01T17:23:00.001+08:00

Q: 我的 Windows 7索引搜尋功能只能搜尋文件的檔案名稱，而在文件內的文字 (如：word 及 excel 裡的字串) 卻搜尋不到，請問可以如何調整呢？

A:

方法一：
在檔案總管裡，選左上的「組合管理」>「資料夾和搜尋選項」

在「搜尋」頁裡，將「搜尋目標」由「在已編製索引位置搜尋檔案名稱及內容。在未編製索引的位置，則只搜尋檔案名稱(I)」改為「一律搜尋檔案名稱及內容 (這可能需要幾分鐘)(C)」。

方法二：
新增索引位置。

Further Update (A11-04-01b): Vulnerability in Adobe Flash Player and Adobe Reader/Acrobat

2011-04-26T10:32:00.005+08:00

Further to the security alert A11-04-01 and further update A11-04-01a issued on 12.04.2011 and 18.04.2011 respectively, we would like to draw your attention that Adobe has released updated versions of Adobe Reader/Acrobat to address the issue. It will also fix another memory corruption vulnerability in the "CoolType" library found in Adobe Reader/Acrobat products. The respective versions can be updated by "Check for Updates" mechanism in Adobe Reader/Acrobat or can be downloaded at the following URLs:

- Adobe Reader version 9.4.4

    * http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows (for Windows)
    * http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh (for Macintosh)

- Adobe Reader version 10.0.3 for Macintosh

    * http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh

- Adobe Acrobat Professional/Standard versions 9.4.4 and 10.0.3

    * http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows (for Windows)
    * http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh (for Macintosh)

- Adobe Acrobat Professional Extended version 9.4.4 for Windows

    * http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows

Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

DITSOs (or your delegates) are also requested to inform the relevant system administrators and end users as appropriate about this issue.

More Information:

More information about this update is available at:

    * http://www.adobe.com/support/security/bulletins/apsb11-07.html
    * http://www.adobe.com/support/security/bulletins/apsb11-08.html
    * http://www.adobe.com/support/security/advisories/apsa11-02.html
    * http://www.us-cert.gov/current/index.html#adobe_releases_security_updates_for8
    * http://www.kb.cert.org/vuls/id/230057
    * http://secunia.com/advisories/44149/
    * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0610
    * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0611

Review Assessment: Test 8 Topic 9

2011-04-25T19:31:00.000+08:00

COMPUTER CONTROL AUDITING AND SECURITY

Question 1
Which of the following has a security classification? (10.1)

A. a subject

B. an object

C. All of the above

D. None of the above

Correct answer is B.

In most security models, each subject and each object is assigned a security class. In the simplest formulation, security classes form a strict hierarchy and are referred to as security levels. A subject is said to have a security clearance of a given level; an object is said to have a security classification of a given level.

Question 2
What are the three rules specified by the BLP model? (10.2)

A. no read down, no write up and no property

B. ds-property, no read up and no write down

C. *-propety, no write up and security authorisation to a higher level object

D. none of the above

Correct answer is B.

no read up: A subject can only read an object of less or equal security level. This is referred to in the literature as the simple security property (ss-property).
no write down: A subject can only write into an object of greater or equal security level. This is referred to in the literature as the *-property.
ds-property: An individual (or role) may grant to another individual (or role) access to a document based on the owner's discretion, constrained by the MAC rules. Thus, a subject can exercise only accesses for which it has the necessary authorization and which satisfy the MAC rules.

Question 3
What does the Biba model deal with? (10.4)

A. unauthorised disclosure of information

B. integrity

C. confidentiality

D. unauthorised modification of information

E. Both B and D

F. Both A and C

G. None of the above

Correct answer is E.

The BLP model deals with confidentiality and is concerned with unauthorized disclosure of information. The Biba model deals with integrity and is concerned with the unauthorized modification of data.

Question 4
1 points Save
Which of the following are degrees of granularity that are possible with am MLS database? (10.11)

A. Entire database

B. Individual columns

C. Individual elements

D. Individual tables

E. Only B, C and D above

F. All of the above

Correct answer is F.
Refering to page 327 of the text, Stallings & Brown (2008), note the following:

Entire database: This simple approach is easily accomplished on an MLS platform. An entire database, such as a financial or personnel database, could be classified as confidential or restricted and maintained on a server with other files.

Individual tables (relations): For some applications, it is appropriate to assign classification at the table level. In the example of Figure 10.10a, two levels of classification are defined: unrestricted (U) and restricted (R). The Employee table contains sensitive salary information and is classified restricted, while the Department table is unrestricted. This level of granularity is relatively easy to implement and enforce.

Individual columns (attributes): A security administrator may choose to determine classification on the basis of attributes, so that selected columns are classified. In the example of Figure 10.10b, the administrator determines that salary information and the identity of department managers is restricted information.

Individual rows (tuples): In other circumstances, it may make sense to assign classification levels on the basis of individual rows that match certain properties. In the example of Figure 10.10c, all rows in the Department table that contain information relating to the Accounts Department (Dept. ID = 4), and all rows in the Employee Table for which the Salary is greater than 50K are restricted.

Individual elements: The most difficult scheme to implement and manage is one in which individual elements may be selectively classified. In the example of Figure 10.10d, salary information and the identity of the manager of the Accounts Department are restricted.

Question 5
What are the three basic services of the TPM? (10.13)

A. Microsoft firewall, anti virus software and encryption service

B. anti virus software, Microsoft Windows Malicious Software Removal Tool and SSL certification

C. authenticated boot service, certification service and encryption service

D. none of the above

Correct answer is C.

Authenticated boot service: The authenticated boot service is responsible for booting the entire operating system in stages and assuring that each portion of the OS, as it is loaded, is a version that is approved for use.

Certification service: Once a configuration is achieved and logged by the TPM, the TPM can certify the configuration to other parties. The TPM can produce a digital certificate by signing a formatted description of the configuration information using the TPM's private key. Thus, another user, either a local user or a remote system, can have confidence that an unaltered configuration is in use.

Encryption service: The encryption service enables the encryption of data in such a way that the data can be decrypted only by a certain machine and only if that machine is in a certain configuration.
Further details are provided on page 330 of the text, Stallings & Brown (2008).

Question 6
Under the Common Criteria Evaluation Assurance Levels, what is the highest level of assessment a product can be rated? (10.17)

A. EAL7

B. E1

C. EAL1

D. A1

Correct answer is A.
The highest Evaluation Assurance Level is EAL7.
Refer to your text, page 342 and 243, Computer Security Principles and Practice, Stalling & Brown, 2008.

開機時顯示 "please wait for IDE scan"

2011-04-24T16:52:00.001+08:00

問：
電腦啟動時顯示「please wait for IDE scan」，如何取消？

答：
可以在BIOS頁面將RAID關掉，但可能會有部份硬盤不能使用。
例如 GIGABYTE 中 Socket 775 - 945P 的 GA-8I945P-G，有一個紅色的IDE port及兩個綠色的IDE port。關掉RAID後兩個綠色的IDE 接口便不能使用了。

有關excel if 問題

2011-04-21T20:32:00.001+08:00

Q: 我想整一條if

F4=44

我想整 F4 細過或等於40時就出現個差字 F4係40-50個數值內就出現一般字 F4係 50或者以上既數值就出現好字

想問點整?

我想問如果"差" 果個字要紅色

同埋要計差同一般加埋係有幾多個,用邊個函數去計??有冇得比式/_\'..thankyou

A:

G4 =IF(F4<=40,"差",IF(F4>=50,"好","一般"))
G11 =COUNTIF(G4:G8, "差")

2011-04-21T19:58:00.001+08:00

44.The sum of 3 consecutive EVEN number is 90. Find the smallest one.

Let x be the smallest consecutive EVEN number.
x + (x + 2) + (x + 4) = 90
=> 3x + 6 = 90
=> x + 2 = 30
=> x = 28

45.The sum of two numbers is 84 . If the large number exceed 3 times the smaller by 4 ,what is the larger number?

Let x be the smaller number and y be the larger number.
x + y = 84 --- (1)
3x + 4 = y --- (2)

Put (2) into (1):
x + (3x + 4) = 84
4x + 4 = 84
x = 20 --- (3)

Put (3) back into (2):
3(20) + 4 = y
y = 64

i.e. The larger number is 64.

46. Betty is 5kg lighter than twice the weight of Jane. Their total weight is 94kg. Find the weight of Betty.

Let x be the weight of Betty and y be the weight of Jane.
x + y = 94 --(1)
x + 5 = 2y --(2)

(1)-(2):
x + y - x - 5 = 94 - 2y
y - 5 = 94 - 2y
3y = 99
y = 33 --(3)

Put (3) back into (1):
x + 33 = 94
x = 61

i.e. the weight of Betty is 61 kg

47. There are some $2 coins and some $5 coins. The total value is $78 and the total number of coins is 21 . Find the number of $5 coins.

Let b be number of $2 coins and e be number of $5 coins.
2b + 5e = 78 --(1)
b + e = 21 --(2)

(1) - 2 x (2):
2b + 5e - 2b - 2e = 78 - 2 x 21
3e = 36
e = 12

i.e. the number of $5 coins is 12.

48. There are some $2 coins and some $5 coins. The total value is $169 and the total number of coins is 50 . Find the number of $2 coins

Let b be number of $2 coins and e be number of $5 coins.
2b + 5e = 169 --(1)
b + e = 50 --(2)

(1)- 5 x (2):
2b + 5e - 5b - 5e = 169 - 250
81 = 3b
b = 27

i.e. the number of $2 coins is 27

背字倉頡點打??倉頡點打速成都得

2011-04-21T13:27:00.000+08:00

Q: 背字倉頡點打字倉頡點打

A:

速成:L(中)B(月).
第四個就係

倉頡: LPB (中心月)

Security Alert (A11-04-04): Multiple Vulnerabilities in Oracle Products (April 2011)

2011-04-20T10:40:00.004+08:00

Affected Systems:

Database

Oracle Database 11g Release 2, versions 11.2.0.1, 11.2.0.2
Oracle Database 11g Release 1, version 11.1.0.7
Oracle Database 10g Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5
Oracle Database 10g Release 1, version 10.1.0.5

Fusion Middleware

Oracle Fusion Middleware 11g Release 1, versions 11.1.1.2.0, 11.1.1.3.0, 11.1.1.4.0
Oracle Application Server 10g Release 2, version 10.1.2.3.0
Oracle Application Server 10g Release 3, version 10.1.3.5.0
Oracle Identity Management 10g, versions 10.1.4.0.1, 10.1.4.3
Oracle JRockit, versions R27.6.8 and earlier (JDK/JRE 1.4.2, 5, 6), R28.1.1 and earlier (JDK/JRE 5, 6)
Oracle Outside In Technology, versions 8.3.2.0, 8.3.5.0
Oracle WebLogic Server, versions 8.1.6, 9.2.3, 9.2.4, 10.0.2, 11gR1(10.3.2, 10.3.3, 10.3.4)

E-Business Suite

Oracle E-Business Suite Release 12, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3
Oracle E-Business Suite Release 11i, version 11.5.10.2

Oracle Supply Chain

Oracle Agile Technology Platform, versions 9.3.0.2, 9.3.1

PeopleSoft

Oracle PeopleSoft Enterprise CRM, version 8.9
Oracle PeopleSoft Enterprise ELS, versions 9.0, 9.1
Oracle PeopleSoft Enterprise HRMS, versions 9.0, 9.1
Oracle PeopleSoft Enterprise Portal, versions 8.8, 8.9, 9.0, 9.1
Oracle PeopleSoft Enterprise People Tools, versions 8.49, 8.50, 8.51

JD Edwards

Oracle JD Edwards OneWorld Tools, version 24.1.x
Oracle JD Edwards EnterpriseOne Tools, version 8.98.x

Siebel

Oracle Siebel CRM Core, versions 7.8.2, 8.0.0, 8.1.1

Health Sciences Applications

Oracle InForm, versions 4.5, 4.6, 5.0

Oracle Sun Product Suite

Oracle Sun Product Suite
Oracle Open Office, version 3 and StarOffice/StarSuite, versions 7, 8

Summary:
Oracle has released Critical Patch Updates with collections of patches for 73 security vulnerabilities found in various Oracle products and Oracle Sun products.
Patches for Oracle Database, Oracle Fusion Middleware, Oracle Enterprise Manager Grid Control, Oracle E-Business Suite Applications, JD Edwards EnterpriseOne, JD Edwards OneWorld Tools, PeopleSoft Enterprise Portal Applications, PeopleSoft Enterprise PeopleTools, Siebel Enterprise, Oracle Industry Applications and Oracle VM are cumulative.
Impact:
Depending on the vulnerability exploited, a successful attack could lead to denial of service, access to sensitive information, or taking complete control of an affected system.
Recommendation:
Patches for affected systems are available. Users of the affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk. For detailed information of the patches, please refer to the section "Patch Availability Table and Risk Matrices" of corresponding security advisory at the vendor's website:

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

Users may contact their product support vendors for the fixes and assistance.
DITSOs (or your delegates) are also requested to inform the relevant system administrators and end users as appropriate about this issue.
More Information:
More information about the vulnerabilities is available at:

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
http://www.us-cert.gov/current/index.html#oracle_critical_patch_update_pre1
http://www.kb.cert.org/vuls/id/520721
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3450
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3451
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3452
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3453
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3454
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3689
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4253
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4452
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4643
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0411
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0412
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0785
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0787
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0789
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0790
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0791
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0792
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0793
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0794
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0795
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0796
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0797
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0798
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0799
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0800
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0801
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0803
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0804
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0805
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0806
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0807
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0808
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0809
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0810
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0812
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0813
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0818
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0819
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0820
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0821
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0823
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0824
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0825
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0826
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0827
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0828
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0829
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0833
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0834
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0836
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0837
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0839
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0840
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0841
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0843
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0844
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0846
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0847
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0849
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0850
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0851
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0853
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0854
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0855
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0856
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0857
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0858
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0859
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0860
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0861

MC_topic10.pdf

2011-04-19T19:20:00.018+08:00

MULTIPLE CHOICE. Choose the one alternative that best completes the statement or answers the question.

1) Which statement below regarding the development of an AIS is false?
A) A newly designed AIS always meets user needs for a time period.
B) Changes to the AIS are often difficult to make after requirements have been frozen into specifications.
C) Users are unable to specify their needs adequately.
D) The development process can take so long that the system no longer meets company needs.

2) In which approach to systems acquisition is "inexpensive updates" considered an advantage?
A) turnkey software and systems
B) custom software
C) canned software
D) modified software

3) When canned software is used for systems acquisition, the conceptual design phase of the SDLC
A) is the same.
B) involves a make-or-buy decision.
C) is combined with the physical design phase.
D) is eliminated.

4) When canned software is used for systems acquisition, the physical design phase of the SDLC
A) is the same.
B) is eliminated.
C) is combined with the conceptual design phase.
D) does not involve designing and coding although modifications may be made.

5) When canned software is used for systems acquisition, the implementation and conversion phase of the SDLC
A) does not involve the documentation step.
B) does not require the develop and test software step.
C) does not require the company to have trained IS personnel.
D) both A and C above

6) When canned software is used for systems acquisition, the maintenance aspect of the operations and maintenance phase of the SDLC
A) is not necessary and is eliminated.
B) is usually the responsibility of the vendor.
C) is more costly.
D) requires trained personnel.

7) Software development companies write commercial software that can be used by a variety of organizations. Sometimes these companies combine both software and hardware together to sell as one package. Such a package is commonly referred to as
A) an application service package.
B) canned software.
C) a value-added system.
D) a turnkey system.

8) What is a major problem with "canned software"?
A) Canned software is sold on the open market to a broad range of users with similar requirements.
B) Canned software may not meet all of a company's information or data processing needs.
C) Canned software may offer easy availability and lower costs.
D) A commercial software development company has developed it.

9) Which statement is true regarding canned software and the SDLC?
A) Canned software cannot be modified to meet unique user needs.
B) The SDLC process does not apply to canned software.
C) Most canned software meets all of a company's information or data processing needs.
D) Companies that buy rather than develop AIS software can still follow the SDLC process.

10) The reasons for ________ are to simplify the decision-making process, reduce errors, provide timesavings, and avoid potential disagreements.
A) leasing
B) outsourcing
C) sending out a request for a proposal
D) prototyping

11) Total costs are usually lower and less time is required for vendor preparation and company evaluation when requests for proposal are solicited based on
A) generalized software needs.
B) specific hardware and software specifications.
C) exact equipment needs.
D) None of the above are correct.

12) Information given to vendors should include
A) timeframe required for completion of the project.
B) detailed specifications for the AIS.
C) a budget for software and hardware.
D) None of the above are correct.

13) The approach that evaluates vendors' systems based on the weighted score of criteria and points totaled is called
A) requirements costing.
B) prototyping.
C) benchmark problem.
D) point scoring.

14) The approaches to evaluating proposals that do not incorporate dollar estimates of costs and benefits is known as
A) requirement costing and point scoring.
B) benchmark problem and point scoring.
C) All methods mentioned above include dollar estimates.
D) point scoring and requirement costing.

15) It is important for a company to be selective in choosing a software vendor. When a company buys a large or complex system, it may request that a software vendor submit a specific proposal for a system by a specified date. What acronym is used to identify such a request?
A) EIS
B) ISP
C) ASP
D) RFP

16) A request for proposal sent to software vendors is an important tool since it can reduce errors.
Which statement below supports this reason?
A) All responses are in the same format and based on the same information.
B) The same information is provided to all vendors.
C) The chances of overlooking important factors are reduced.
D) Both parties possess the same expectations and pertinent information is captured in writing.

17) A company should carefully evaluate proposals submitted by software vendors. What is the first step a company should take in the proposal evaluation process?
A) Carefully compare proposals against the proposed AIS requirements.
B) Invite vendors to demonstrate their systems.
C) Eliminate proposals that are missing important information or fail to meet minimum requirements.
D) Determine how much of a given proposal meets the desired AIS requirements.

18) Among the methods a company can use to help it evaluate software and hardware systems from vendors, one way is to calculate and compare the processing times of different AIS to compare system performance. This is the ________ method.
A) mandatory requirements
B) requirements costing
C) benchmark problem
D) point scoring

19) What is a drawback to using the requirements costing method of software and hardware evaluation?
A) The weights and points used are assigned subjectively.
B) Intangible factors such as reliability and vendor support are overlooked.
C) There is no drawback to using the requirements costing method.
D) Dollar estimates of costs and benefits are not included.

20) The costly and labor-intensive approach to systems acquisition is
A) modified software.
B) custom software.
C) canned software.
D) turnkey software.

Answer Key
1) A
2) C
3) B
4) D
5) D
6) B
7) D
8) B
9) D
10) C
11) B
12) B
13) D
14) D
15) D
16) C
17) C
18) C
19) B
20) B

Further Update (A11-04-01a): Vulnerability in Adobe Flash Player and Adobe Reader/Acrobat

2011-04-18T10:42:00.002+08:00

Further to the security alert A11-04-01 issued on 12.04.2011, we would like to draw your attention that Adobe has released updated versions of Adobe Flash Player for the platforms below to address the issue. However, related patches for Adobe Reader and Adobe Acrobat are still pending. The respective updates are available at:
- Flash Player 10.2.159.1 for Windows, Macintosh, Linux and Solaris

http://www.adobe.com/go/getflash

- Flash Player 10.2.159.1 - network distribution

http://www.adobe.com/licensing/distribution

- Flash Player 10.2.154.27 for Chrome

http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html

If you have multiple browsers, you are required to perform the upgrade for each browser.
To verify the Flash player version installed, you may visit the following URL:

http://www.adobe.com/products/flash/about/

Currently, the patch for Flash Player for Android and the patches for Adobe Reader and Acrobat are not yet available for download. Affected users should keep abreast of the vendor's web site for the availability of new versions of the affected software.
Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
DITSOs (or your delegates) are also requested to inform the relevant system administrators and end users as appropriate about this issue.
More Information:
More information about this update is available at:

http://www.adobe.com/support/security/advisories/apsa11-02.html
http://www.adobe.com/support/security/bulletins/apsb11-07.html
http://www.us-cert.gov/current/index.html#adobe_releases_security_advisory_for7
http://www.kb.cert.org/vuls/id/230057
http://secunia.com/advisories/44119/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0611

Microsoft Windows XP 變數

2011-04-14T11:36:00.001+08:00

有時編寫執行檔時，可能會因為使用者名稱不同而不能執行成功。

假若遇到這個情況，系統變數便可以簡化問題了。

以下是 Ms Windows XP 及 Windows 7 的例子：

變數	Win XP 例子	Win 7例子
%LOGONSERVER%	\\127.0.0.1	\\127.0.0.1
%HOMEDRIVE%	C:\	C:\
%SystemDrive%	C:\	C:\
%AllUsersProfile%	C:\Documents and Settings\All Users	C:\ProgramData
%HOMEPATH%	C:\Documents and Settings\wfh	C:\Users\wfh
%USERPROFILE%	C:\Documents and Settings\wfh	C:\Users\wfh
%APPDATA%	C:\Documents and Settings\wfh\Application Data	C:\Users\wfh\AppData\Roaming
%Temp%	C:\Documents and Settings\wfh\Local Settings\Temp	C:\Users\Ben\AppData\Local\Temp
%Tmp%	C:\Documents and Settings\wfh\Local Settings\Temp	C:\Users\Ben\AppData\Local\Temp
%USERPROFILE%\My Documents\	C:\Documents and Settings\wfh\My Documents\
%ProgramFiles%	C:\Program Files	C:\Program Files
%commonprogramfiles%	C:\Program Files\Common Files	C:\Program Files\Common Files
%SystemRoot%	C:\WINDOWS	C:\Windows
%windir%	C:\WINDOWS	C:\Windows
%ComSpec%	C:\WINDOWS\system32\cmd.exe	C:\WINDOWS\system32\cmd.exe
%PSModulePath%	C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules	C:\Windows\system32\WindowsPowerShell\v1.0\Modules

===========================

batch file 應用例子：

@echo off

:: 設定變數 drive 為 G:\Backup

set drive=G:\Backup

:: 設定變數 backupcmd 為 xcopy /s /c /d /e /h /i /r /y

set backupcmd=xcopy /s /c /d /e /h /i /r /y

echo 備份我的文件至 G:\Backup\My Documents ...

%backupcmd% "%USERPROFILE%\My Documents" "%drive%\My Documents"

echo 備份我的最愛至 G:\Backup\Favorites...

%backupcmd% "%USERPROFILE%\Favorites" "%drive%\Favorites"

echo 備份 Outlook Express...

%backupcmd% "%USERPROFILE%\Application Data\Microsoft\Address Book" "%drive%\Address Book"

%backupcmd% "%USERPROFILE%\Local Settings\Application Data\Identities" "%drive%\Outlook Express"

echo 備份 Ms Outlook...

%backupcmd% "%USERPROFILE%\Local Settings\Application Data\Microsoft\Outlook" "%drive%\Outlook"

echo 備份登錄檔...

if not exist "%drive%\Registry" mkdir "%drive%\Registry"

if exist "%drive%\Registry\regbackup.reg" del "%drive%\Registry\regbackup.reg"

regedit /e "%drive%\Registry\regbackup.reg"

:: use below syntax to backup other directories...

:: %backupcmd% "...source directory..." "%drive%\...destination dir..."

echo 備份完成

pause

試想像，假若目標使用者的視窗安裝在 D:\ ，而且你不知道對方的使用者名稱，在不使用變數的情況下便十分麻煩了。

===========================

如果希望新增 / 修改 Win xp 的變數，你可以：

1. 在「我的電腦」的空白位置單擊右鍵，然後點選「內容」

2. 在「系統內容」的「進階」分頁，點選「環境變數」

3. 在下方的「系統變數」，你可以找到「TMP」等大部份變數了

===========================
如果希望新增 / 修改 Win 7 的變數，你可以：

1. 在「我的電腦」的空白位置單擊右鍵，然後點選「內容」

2. 點選「進階系統設定」

3. 在「系統內容」的「進階」分頁，點選「環境變數」

4. 在下方的「系統變數」，你可以找到「TMP」等大部份變數了

Hot News

Mission of HKTA

Past paper for HKIT (GE150 - Information Systems / ISY10212 - Contemporary Issues in MM and IT / IT106 - Information Systems and Multimedia)

Forum 1: Privacy and celebrity... in the modern world.

(5 marks)

Forum 2: First Person Computer Games.

(5 marks)

Forum 3: Privacy and Security...in the modern world.

(5 marks)

Forum 4: Public Information and Politics.

(5 marks)

Report on contemporary issue in multimedia and Information Technology

Individual assignment - Hong Kong Tennis Association

罕見血病青年急求藥費續命

TAKE ASSESSMENT: TEST 7 TOPIC 7

Mor-Christian General Soccer Ability Skill Test Battery

乳字的意思

REVIEW ASSESSMENT: TEST 3 TOPIC 3

Essay - Let's put a halt to capital punishment

Take Assessment: Test 4 Topic 4

COMPUTER CONTROL AUDITING AND SECURITY > TAKE ASSESSMENT: TEST 6 TOPIC 6

Octopus card scandal

Microsoft(R) Office Word 2007 中文版應用測驗

Test 2, covers topic 2

RCS 0114 Critical Reasoning Section 55

CS 4288/5288 Assignment #3

芒果芝士凍餅食譜

My mother

Test 10 Topic 11

Security Alert (A11-05-01): Multiple Vulnerabilities in Firefox, SeaMonkey and Thunderbird

Confidential email - Failed to connect smart card or key file

win 7 如何才能搜尋文件內容

Further Update (A11-04-01b): Vulnerability in Adobe Flash Player and Adobe Reader/Acrobat

Review Assessment: Test 8 Topic 9

開機時顯示 "please wait for IDE scan"

有關excel if 問題

背字倉頡點打??倉頡點打 速成都得

Security Alert (A11-04-04): Multiple Vulnerabilities in Oracle Products (April 2011)

MC_topic10.pdf

Further Update (A11-04-01a): Vulnerability in Adobe Flash Player and Adobe Reader/Acrobat

Microsoft Windows XP 變數

背字倉頡點打??倉頡點打速成都得