Daniel Mitchell's Blog

Cloud Apps and SaaS: Business Continuity vs Cheap Connectivity

I often look into getting databases or applications hosted for clients. Resilience and reliability are generally the key drivers for this and for sure, a secure data centre is safer than a standard server in a typical office. I have looked at some further pros and cons in an earlier article.

As a result of its popularity, there is a trend for more use by small business of SaaS (Software as a Service) and hosted, or web based applications generally, including hosted Exchange and hosted CRM - the IoD is pushing both of these for its small business members.

But ... internet connections are not getting better, due to cost there is a major resistance to leased lines and in many cases ADSL is just not good enough - response times to fix problems at exchanges and questionable technical support services should often rule out ADSL as a connection that a business depends upon.

As soon as you move your critical data off site, the internet connection probably becomes mission critical, however, an ADSL line is probably far more vulnerable and may well take longer to get repaired than a server in your office.

Therefore, if you are a small business moving towards hosted applications but don't want to spend thousands every year on leased lines, you need to consider alternatives:

• 3G data via a mobile network - as well as 3G cards for PCs and laptops, there are some business firewalls that will take a 3G data card and provide a cost effective 'fall-back'.
• WiMax - a wireless based internet service provision for business. These are becoming available in major cities, provide really good SLAs and excellent resilience at about the same cost as SDSL.
• It's normally regarded as waste of time having two ADSL lines as they are likely to come from the same exchange, however, if you can get a second cable based DSL, this can make a good backup.
• A more dispersed workforce - encourage home working or at least provide the facility for staff to do so as part of a DR plan.

Other articles and information:
An article on Business Continuity and SaaS by John Gannon
Salesforce.com
Urban WiMax

10 Great Domain Names

Time Magazine this week reports that VeriSign have recorded 17% fewer .com domain registrations in quarter four of 2008 compared to 2007. Does this reflect the downturn in the economy, particularly branding and new business - has a new economic indicator been discovered?

Despite this, new organisations are still struggling to name their businesses - it is now a prerequisite to get an appropriate domain name.

Now the fun bit - click here for my Squidoo Lens (just a web page, don't worry) on which I am listing ten great domain names that have not yet been registered - they are yours for the taking!

There is good stuff still out there - maybe these domains will inspire something!

First steps to IT Security (for non-IT professionals too)

I will cut right to the point: above all, have an IT Security Policy in place. Data loss and damage to reputation from ignorance rather than deliberate sabotage is easier to prevent and far more likely - let your staff or co-workers know what is and is not acceptable. Your biggest and most likely risks are loss or theft of data, including damage through viruses and worms - not hackers.

Assuming all the basics are in place (backup, anti-virus, etc.), having a policy in place which contains some basic procedures is pretty much the most important thing you can do. This will allow you to control the flow of data into and out of your organisation and better protect it.

Policies will have to be different for each organisation, but I want to give a few ideas you could consider:

Security of backup media: You may well be in the habit of taking tapes off-site, despite widely publicized security lapses in government and large organisations, a significant proportion of backup tapes are being ported around without even basic security. Check if data on the tapes is encrypted - many backup systems do not do this by default. If your backup tapes cannot be encrypted, consider whether they should be in a pocket or handbag on trains, buses etc.

Database Security: Can people take your data easily. Examine the risks, it is commonplace for data to be transferred straight out of networks via FTP, Google Documents or even a Hotmail account. These holes can be closed.

USB Drives: In a survey last month, almost a third of those questioned admitted that they had lost a USB key. Of these, only a really small proportion had encrypted the contents. Is it worthwhile telling staff not to use portable drives?

External email: Encouraging personal use of business email may sound risky, but weigh it up against the risks of staff using less protected email systems that could bypass security and scanning you already have in place and be an easy way for viruses to inadvertently get into your network.

Mobile devices: If you allow staff to collect, send and store business email on mobile devices (Blackberries, iPhones, etc.) the risk of data loss or theft is significant - Last weekend the story broke of the Blackberry purchased on ebay containing contact details of dozens of A-List celebrities - according to press reports it was in fact lost over 18 months ago - it could in fact have been remotely wiped in minutes if it was set up as part of a business system.

Passwords - give people ideas on how to create a secure password, tell people they shouldn't give them out to co-workers.

I Love Meetings!

Meetings, and company staff meetings in particular, are often moaned about as bureaucratic, frequently parodied on TV and always ridiculed in cartoons.

But I love my company meetings. Every Friday morning we meet to discuss what has happened over the past week and talk about what is forthcoming.

It was Rudi Giuliani's book that helped me understand the value of regular staff meetings at a time that my business was beginning a period of rapid growth. It is probably the single most valuable thing that we do in continuing to develop the company. Cancelling a staff meeting is rare.

• Worthwhile: Lots of decisions get made, everyone knows they will get an answer from me - no hierarchy or structure to go through.
• Open and direct: we tell each other what we think, share problems and help one another.
• From time to time meetings needs agenda items, but typically the agenda is the people - just going round the room to get input, queries, thoughts and reports.
• Social: Interaction between our team sometimes only happens once a week - we have field engineers who are typically out at clients all week.
• I am accountable - to everyone. So is everyone else.
• Some companies lighten the atmosphere at meetings, when I tell people about our meetings and ask what works for theirs, I have heard of afternoon "pic n' mix" meetings (difficult now) and even paper plate awards.
• Look forward and share what most companies view as secret "directors' stuff": Restate goals for the year and ambitions - honest view of plans and forthcoming targets - e.g. an extra 10 clients in the next quarter, new team and team leader, training aspirations.
• Restate key points from training, getting everyone interested in what everyone is learning has really helped get everyone interested in continual development.

We struggle with time, things do sometimes get heated and we disagree, but we make real progress.

***** Edited 27/03/09*****

Take a look at Seth Godin's tips for solving meeting problems, practical things to try ...

Business Continuity Planning - now the horse has bolted, let's shut the stable door

Many small businesses are only just beginning to consider Business Continuity Planning, perhaps more imaginable risks like the recent severe weather will get SMEs moving faster on this. Larger companies now have sophisticated plans in place, the agility of small companies should allow a rapid catch up; agility is a major tactical advantage of small business as well as being a valuable asset in BCM.

I won't begin to outline a "one size fits all" disaster recovery plan, but instead here are five, quick to implement, top tips for small businesses to prepare for the smaller (but more likely) emergencies:

Know how to divert phones to somebody's home
If you have a VoIP phone system, chances are you can have an IP handset set up at home quite easily and cheaply or have a softphone installed on a PC or laptop, make sure you know how to add it to the "hunt group" so it rings with incoming calls on your main line when you need it to. Even with an analogue BT line you can order BT's divert service so diversions to a different number can be set up almost instantly.

Plan to run Accounts systems from a laptop
The accounts system is often the source of important contact information for customers and suppliers. The data files are typically held on a server but a separate online backup which can quickly be restored to a laptop with the accounts software on, provides quick easy business continuity for lots of possible scenarios. Even sophisticated SQL finance systems can often be run from a typical laptop.

Outlook on your laptop
If you run an Exchange Server, consider having Outlook data "cached" to your laptop so that your calendar (and mail, contacts, etc.) are available, even if a connection to your server isn't.

Keeping good communication with our clients helped to keep things going better than anything over the last few days - I found all our clients and partners were very upbeat and accommodating of changes to meetings and appointments.

Staff contact details
Having a Google Spreadsheet with staff contact details on means information can be accessed anywhere by anyone with proper permissions - staff could even keep this up to date themselves. Again this provides an accessible resource that doesn't rely on the standard infrastructure.

Free training
Consider participating in a Project Argus event, these are free simulations run by the National Counter Terrorism Security Office - while geared to disaster recovery from a terrorist attack, there are great lessons for BCM generally.

Other resources
Hertfordshire council produce an easy “10 minute assessment” that give some good pointers, you can download the pdf here.