Daniel Mitchell's Blog

Is it a case of ‘goodbye blog, hello Twitter’?

Visitors to my blog tend now to be a few curious clients of my business and more frequently, people referred by Google searches to (hopefully) relevant articles. As I am no longer blogging regularly, there is little point in return visits generally and this is reflected in the traffic levels to the site.

 

Welcome to Twitter?

Whilst I don’t intend to drop my subscription to Typepad and I strongly suspect I will start writing again at some point, for now, my public comments and observations are happening on http://twitter.com/danmitch I have included a feed ‘widget’ for this on the right of this page.

 

Twitter allows me to make quick observations as things happen, without having to take the time to write entire articles, though looking back there are a few to elaborate on:

 

Interesting analysis of RAND Corporation's "Trusted Traveler" Working Paper by @Bruce_Schneier http://is.gd/bZXIln about 15 hours ago via web 

 

The ‘Trusted Traveler’ concept is an interesting one, built around the concept of focussing the scarce security resource at airports around those travellers deemed to be higher risk. In fact as this article and the comments that follow state, in reality this scheme at best allows a small minority to process through a bit more rapidly. It does raise interesting thoughts on profiling of travellers however and some of the concepts, while difficult to implement would surely improve airline security.

 

Dropbox Security Bug Made Passwords Optional For Four Hours http://t.co/kHrk7FO via @techcrunch 1 day ago via Tweet Button 

 

I use Dropbox to keep a small number of photos and documents that I am working on in sync between my Macs and occasionally for sharing documents with friends and colleagues. I never use it for anything remotely sensitive so the security scare didn’t impact me personally. Having said that, it was pretty serious and will dent confidence in cloud based document storage generally. Simple advice would be to encrypt any documents that are sensitive regardless of where they are stored.

 

Rory Story Cubes - new to the site - new, award winning game for imaginative storytellers http://fb.me/D8QWP1Mz 9:48 PM Jun 18th via Facebook Retweeted by you 

 

A retweet of an update posted by my wife Amanda who has set up a great new business selling pre-wrapped travel toys for kids - perfect for busy jetsetting families!

 

Would love @Gladwell to start tweeting again ... 7:42 PM Jun 18th via web 

Malcolm Gladwell is the author of Outliers and Blink, among other books - brilliant writer and thinker and threatened to be an interesting Tweeter too!  

 

Great lunch at http://www.therustygun.co.uk in Hitchin today - highly recommended! 7:26 PM Jun 18th via Seesmic for BlackBerry 

No further explanation required!

 

Shadow Chancellor calls for temporary VAT cut - not convinced and would be an admin nightmare for small business - http://bbc.in/mbn6mV 5:17 PM Jun 16th via BBC Website 

I will resist a long rant! In fact it was the change to VAT in November 2008 that got me blogging in the first place. At the time I pointed out the considerable administrative cost to small business of tampering with VAT, and subsequent changes have been no easier to implement. This is not the tax to be playing with in my opinion.

Other Tweets have included Curb, my work with Graduate Fashion Week, cycling and risk analysis of alien invasions in Nottinghamshire - I could never write a blog article on that!

 I’ll finish with a brilliant article from the superb ISN resource and invite you to follow me at http://twitter.com/danmitch if you have found these of interest:

 

Must read - Bin Laden and the Perils of Liberal Assassination - http://www.isn.ethz.ch/isn/Current-Affairs/ISN-Insights/Detail?id=129124 2:17 PM May 19th via web

 

 

 

Please can I buy a MacBook for Business

 Macs are just so attractive - even people buying shiny, high-end PCs probably really want to set foot in to the Apple store knowing they will walk out with an iMac or MacBook - so what is really stopping you? The huge media attention received over the iPad launch this week has only further served to glamourise the Apple brand - more than ever in the last six months, I am being asked by clients if they can buy an Apple rather than a PC. I see two key reasons for this change in demand with small business users that I work with, firstly the growth in mobile computing ties in with Apple pushing themselves as a mobile devices provider, Steve Jobs emphasised their position as such in his iPad keynote; the second and perhaps major reason is the release of the latest version of the Apple operating system, "Snow Leopard". Snow Leopard provides the opportunity for closer integration with an Apple Mac and a Microsoft Exchange server using the standard Apple mail, calendar and address book applications, these three areas plus a web browser, typically being the most used on any desktop or laptop. 

As a regular PC and Mac user, in my opinion the biggest benefits of using a Mac are speed, reliability and ease of use. The biggest barrier for a business user considering moving to a Mac is the inability to run some business applications without running Windows on a Mac, which I feel immediately negates these benefits as well as being very expensive. I am also not a big fan of Microsoft Office for the Mac, favouring Apple's own iWork suite which offers great compatibility with "native" office documents, though you will have to re-learn processes. The deciding factor is likely to be the requirement to run finance, ERP or other installed applications on your desktop. With more internet based applications running in a browser, the list is probably likely to shrink, not grow and I foresee Apple stealing a growing share of the small-business computer market. Approach with caution if you are running a number of desktop applications, otherwise my advice is go ahead and walk into an Apple store.

Improving Data Security in the Cloud

Since my last article on cloud computing, interest with our clients has continued to grow, as have the offerings to small business with accounting solutions from New Zealand based Xero and project management from PBWorks as key examples. These join the longstanding solutions from longer established players such as Salesforce and companies hosting MS Exchange and MS CRM.

The improved resilience is now well understood, but the greatest concern from SMEs looking at cloud computing continues to be the perceived lack of security, or more accurately, privacy of their data. The British Computer Society continues to raise concerns but what most worried small businesses are forgetting, is that leading SAAS applications actually provide vastly better security than they could ever afford themselves internally. SAAS applications such as Salesforce and PBWorks have independently audited servers, ensuring proper separation of data between their clients as well as security appliances and reviews superior to those commonly in pace with SMEs.

Providing you choose your SAAS or Cloud Application provider carefully and ask the questions about security and audit processes in place, you should be able to IMPROVE the security of your data by moving it to the cloud.

Social Engineering - People are the biggest vulnerability with data security

There is a very real risk to business security from Social Engineering attacks. By manipulating employees or others with  legitimate access to business information, an attacker does not need to breach corporate firewalls or "brute force" passwords, they could potentially gain entry to, or control of business data or systems by persuasion and deception. According to Gartner analyst Rich Mogull, "Social engineering is the single greatest threat to enterprise security".

Attacks often take the form of the (now well publicised) "phishing" emails which appear to be from a well known organisation, typically a financial institution, and seek to obtain personal information. More sophisticated attacks involving targeting of an organisation, can comprise a complex operation building on publicly available information about a business, its employees, clients or suppliers and seeking an end goal which could be simply obtaining confidential information, compromising user login credentials to provide unauthorised network access, or in some cases convincing the victim to trust a 'spoofed' email combined with software in order that this malicious software is unknowingly installed creating vulnerabilities on an entire network.

In the case of larger companies using overseas outsourced call centres, there is a real concern that there is a risk to data security through bribery or corruption of low paid workers with poor morale - would you attack the data centre or pay off an individual?

According to research by Azeem Aleem of the Institute of Criminal Justice Studies at the University of Portsmouth, SMEs are most vulnerable to "trust-based" or "authority based" manipulation, where an attacker attempts to gain information by building a relationship with an individual or by convincing them that the attacker is of importance. He goes on to say  “Social engineering is a growing threat to security in the corporate environment, with skillful and criminally-minded ‘engineers’ gaining employees’ trust in order to exploit loopholes”.

If an unknown person turned up at your office with appropriate information about your company or your IT provider, offering to assist with an IT problem or replace a "faulty" item of hardware, would they get through the front door?

How much information would a confident, manipulative attacker be able to get from a professional adviser / accountant / lawyer / IT Support company about a client's business? What could a low level employee at one of these firms be persuaded or manipulated to do in order to assist an 'important' person in your company?

As always with IT security, the key first step is raising awareness – recognising you may be vulnerable and identifying what information of a business, or its clients, is at risk. Discussion and incorporation into policy can then follow.

Wiki for Small Business - Collaboration in the Cloud

A Wiki is a managed set of web pages that can be collaborated on by a group of people. People still think of Wikis as public on-line encyclopaedias, Wikipedia being the most famous, but in fact a wiki can rapidly be implemented with no technical expertise as the next practical stage in document collaboration for a small business. There are a number of providers, such as PBWiki, that sell the product as true SaaS (Software as a Service) packages requiring no software or configuration to your own servers or PCs.

Businesses and individuals are already comfortable using Google Documents as an easy way to manage collaboration on documents, to centralise storage of these documents, and to provide some backup and security. A private Wiki for a company can be an even better alternative.

For little cost, a team can store large quantities of documents, which can be easily searched, rapidly amended from anywhere with an internet connection and automatically backed up, often with significantly more resilience than is normally within the scope of small businesses. A wiki will automatically track changes to these pages and allow you to compare or revert to an earlier version. At Lifeline IT, we use a PBWiki for our technical documentation and internal policies, but wikis are well suited to any situation where a business has several people contributing to sets of changing documents including project planning, building "how to" articles and for public or private knowledge bases.

Advertise, or not?

Advertising has always been a scary thing for small business. Costs can be high and resources are rarely as extensive as those of bigger organisations. My business has rarely advertised – even for staff. We do see it as an inferior alternative to word of mouth. As a small business ourselves, a big part is of course concerns of poor returns on valuable investment, perhaps it is also because we always feared that our larger competitors could advertise bigger.

Current technology and our financial climate puts an interesting twist on advertising.

• With companies cutting advertising and promotions budgets as a "non-essential" expense in times of financial difficulty, rates are good and competition may well be less visible.
• With the move away from traditional paper based media, things are different and changing rapidly for small business - now is the time to take advantage. Anyone advertising through Google, big or small, has the same ad appearance - there really is very level playing field.

• There is a great volume of free advice on marketing available to small business - on line communities are emerging around some of the world's greatest marketers who are encouraging and guiding their followers - with the agility of small businesses, they are uniquely positioned to benefit.

Gone are the days when adverts needed to have anything to do with the product they are selling. Iggy Pop is now advertising insurance for a company that won't even cover musicians! Entertaining and engaging is as important as showing the product - online discussions about the company and brand will eminate from an interesting advert.

Brand does remains important. We look at ways to get our brand reputation known, as on the surface our product is not unique (the delivery is). In line with our sponsorship of Graduate Fashion Week we placed a full page advert in Drapers and of course we promote our corporate website. Although I see that as more passive, it is still a resource for potential clients that we are about to see or have just seen. It's also important for us to work on getting referrals, which means advertising to existing clients for new business.

Cloud Apps and SaaS: Business Continuity vs Cheap Connectivity

I often look into getting databases or applications hosted for clients. Resilience and reliability are generally the key drivers for this and for sure, a secure data centre is safer than a standard server in a typical office. I have looked at some further pros and cons in an earlier article.

As a result of its popularity, there is a trend for more use by small business of SaaS (Software as a Service) and hosted, or web based applications generally, including hosted Exchange and hosted CRM - the IoD is pushing both of these for its small business members.

But ... internet connections are not getting better, due to cost there is a major resistance to leased lines and in many cases ADSL is just not good enough - response times to fix problems at exchanges and questionable technical support services should often rule out ADSL as a connection that a business depends upon.

As soon as you move your critical data off site, the internet connection probably becomes mission critical, however, an ADSL line is probably far more vulnerable and may well take longer to get repaired than a server in your office.

Therefore, if you are a small business moving towards hosted applications but don't want to spend thousands every year on leased lines, you need to consider alternatives:

• 3G data via a mobile network - as well as 3G cards for PCs and laptops, there are some business firewalls that will take a 3G data card and provide a cost effective 'fall-back'.
• WiMax - a wireless based internet service provision for business. These are becoming available in major cities, provide really good SLAs and excellent resilience at about the same cost as SDSL.
• It's normally regarded as waste of time having two ADSL lines as they are likely to come from the same exchange, however, if you can get a second cable based DSL, this can make a good backup.
• A more dispersed workforce - encourage home working or at least provide the facility for staff to do so as part of a DR plan.

Other articles and information:
An article on Business Continuity and SaaS by John Gannon
Salesforce.com
Urban WiMax

10 Great Domain Names

Time Magazine this week reports that VeriSign have recorded 17% fewer .com domain registrations in quarter four of 2008 compared to 2007. Does this reflect the downturn in the economy, particularly branding and new business - has a new economic indicator been discovered?

Despite this, new organisations are still struggling to name their businesses - it is now a prerequisite to get an appropriate domain name.

Now the fun bit - click here for my Squidoo Lens (just a web page, don't worry) on which I am listing ten great domain names that have not yet been registered - they are yours for the taking!

There is good stuff still out there - maybe these domains will inspire something!

First steps to IT Security (for non-IT professionals too)

I will cut right to the point: above all, have an IT Security Policy in place. Data loss and damage to reputation from ignorance rather than deliberate sabotage is easier to prevent and far more likely - let your staff or co-workers know what is and is not acceptable. Your biggest and most likely risks are loss or theft of data, including damage through viruses and worms - not hackers.

Assuming all the basics are in place (backup, anti-virus, etc.), having a policy in place which contains some basic procedures is pretty much the most important thing you can do. This will allow you to control the flow of data into and out of your organisation and better protect it.

Policies will have to be different for each organisation, but I want to give a few ideas you could consider:

Security of backup media: You may well be in the habit of taking tapes off-site, despite widely publicized security lapses in government and large organisations, a significant proportion of backup tapes are being ported around without even basic security. Check if data on the tapes is encrypted - many backup systems do not do this by default. If your backup tapes cannot be encrypted, consider whether they should be in a pocket or handbag on trains, buses etc.

Database Security: Can people take your data easily. Examine the risks, it is commonplace for data to be transferred straight out of networks via FTP, Google Documents or even a Hotmail account. These holes can be closed.

USB Drives: In a survey last month, almost a third of those questioned admitted that they had lost a USB key. Of these, only a really small proportion had encrypted the contents. Is it worthwhile telling staff not to use portable drives?

External email: Encouraging personal use of business email may sound risky, but weigh it up against the risks of staff using less protected email systems that could bypass security and scanning you already have in place and be an easy way for viruses to inadvertently get into your network.

Mobile devices: If you allow staff to collect, send and store business email on mobile devices (Blackberries, iPhones, etc.) the risk of data loss or theft is significant - Last weekend the story broke of the Blackberry purchased on ebay containing contact details of dozens of A-List celebrities - according to press reports it was in fact lost over 18 months ago - it could in fact have been remotely wiped in minutes if it was set up as part of a business system.

Passwords - give people ideas on how to create a secure password, tell people they shouldn't give them out to co-workers.

I Love Meetings!

Meetings, and company staff meetings in particular, are often moaned about as bureaucratic, frequently parodied on TV and always ridiculed in cartoons.

But I love my company meetings. Every Friday morning we meet to discuss what has happened over the past week and talk about what is forthcoming.

It was Rudi Giuliani's book that helped me understand the value of regular staff meetings at a time that my business was beginning a period of rapid growth. It is probably the single most valuable thing that we do in continuing to develop the company. Cancelling a staff meeting is rare.

• Worthwhile: Lots of decisions get made, everyone knows they will get an answer from me - no hierarchy or structure to go through.
• Open and direct: we tell each other what we think, share problems and help one another.
• From time to time meetings needs agenda items, but typically the agenda is the people - just going round the room to get input, queries, thoughts and reports.
• Social: Interaction between our team sometimes only happens once a week - we have field engineers who are typically out at clients all week.
• I am accountable - to everyone. So is everyone else.
• Some companies lighten the atmosphere at meetings, when I tell people about our meetings and ask what works for theirs, I have heard of afternoon "pic n' mix" meetings (difficult now) and even paper plate awards.
• Look forward and share what most companies view as secret "directors' stuff": Restate goals for the year and ambitions - honest view of plans and forthcoming targets - e.g. an extra 10 clients in the next quarter, new team and team leader, training aspirations.
• Restate key points from training, getting everyone interested in what everyone is learning has really helped get everyone interested in continual development.

We struggle with time, things do sometimes get heated and we disagree, but we make real progress.

***** Edited 27/03/09*****

Take a look at Seth Godin's tips for solving meeting problems, practical things to try ...