Daniel Mitchell's Blog

Is it a case of ‘goodbye blog, hello Twitter’?

Visitors to my blog tend now to be a few curious clients of my business and more frequently, people referred by Google searches to (hopefully) relevant articles. As I am no longer blogging regularly, there is little point in return visits generally and this is reflected in the traffic levels to the site.

 

Welcome to Twitter?

Whilst I don’t intend to drop my subscription to Typepad and I strongly suspect I will start writing again at some point, for now, my public comments and observations are happening on http://twitter.com/danmitch I have included a feed ‘widget’ for this on the right of this page.

 

Twitter allows me to make quick observations as things happen, without having to take the time to write entire articles, though looking back there are a few to elaborate on:

 

Interesting analysis of RAND Corporation's "Trusted Traveler" Working Paper by @Bruce_Schneier http://is.gd/bZXIln about 15 hours ago via web 

 

The ‘Trusted Traveler’ concept is an interesting one, built around the concept of focussing the scarce security resource at airports around those travellers deemed to be higher risk. In fact as this article and the comments that follow state, in reality this scheme at best allows a small minority to process through a bit more rapidly. It does raise interesting thoughts on profiling of travellers however and some of the concepts, while difficult to implement would surely improve airline security.

 

Dropbox Security Bug Made Passwords Optional For Four Hours http://t.co/kHrk7FO via @techcrunch 1 day ago via Tweet Button 

 

I use Dropbox to keep a small number of photos and documents that I am working on in sync between my Macs and occasionally for sharing documents with friends and colleagues. I never use it for anything remotely sensitive so the security scare didn’t impact me personally. Having said that, it was pretty serious and will dent confidence in cloud based document storage generally. Simple advice would be to encrypt any documents that are sensitive regardless of where they are stored.

 

Rory Story Cubes - new to the site - new, award winning game for imaginative storytellers http://fb.me/D8QWP1Mz 9:48 PM Jun 18th via Facebook Retweeted by you 

 

A retweet of an update posted by my wife Amanda who has set up a great new business selling pre-wrapped travel toys for kids - perfect for busy jetsetting families!

 

Would love @Gladwell to start tweeting again ... 7:42 PM Jun 18th via web 

Malcolm Gladwell is the author of Outliers and Blink, among other books - brilliant writer and thinker and threatened to be an interesting Tweeter too!  

 

Great lunch at http://www.therustygun.co.uk in Hitchin today - highly recommended! 7:26 PM Jun 18th via Seesmic for BlackBerry 

No further explanation required!

 

Shadow Chancellor calls for temporary VAT cut - not convinced and would be an admin nightmare for small business - http://bbc.in/mbn6mV 5:17 PM Jun 16th via BBC Website 

I will resist a long rant! In fact it was the change to VAT in November 2008 that got me blogging in the first place. At the time I pointed out the considerable administrative cost to small business of tampering with VAT, and subsequent changes have been no easier to implement. This is not the tax to be playing with in my opinion.

Other Tweets have included Curb, my work with Graduate Fashion Week, cycling and risk analysis of alien invasions in Nottinghamshire - I could never write a blog article on that!

 I’ll finish with a brilliant article from the superb ISN resource and invite you to follow me at http://twitter.com/danmitch if you have found these of interest:

 

Must read - Bin Laden and the Perils of Liberal Assassination - http://www.isn.ethz.ch/isn/Current-Affairs/ISN-Insights/Detail?id=129124 2:17 PM May 19th via web

 

 

 

Please can I buy a MacBook for Business

 Macs are just so attractive - even people buying shiny, high-end PCs probably really want to set foot in to the Apple store knowing they will walk out with an iMac or MacBook - so what is really stopping you? The huge media attention received over the iPad launch this week has only further served to glamourise the Apple brand - more than ever in the last six months, I am being asked by clients if they can buy an Apple rather than a PC. I see two key reasons for this change in demand with small business users that I work with, firstly the growth in mobile computing ties in with Apple pushing themselves as a mobile devices provider, Steve Jobs emphasised their position as such in his iPad keynote; the second and perhaps major reason is the release of the latest version of the Apple operating system, "Snow Leopard". Snow Leopard provides the opportunity for closer integration with an Apple Mac and a Microsoft Exchange server using the standard Apple mail, calendar and address book applications, these three areas plus a web browser, typically being the most used on any desktop or laptop. 

As a regular PC and Mac user, in my opinion the biggest benefits of using a Mac are speed, reliability and ease of use. The biggest barrier for a business user considering moving to a Mac is the inability to run some business applications without running Windows on a Mac, which I feel immediately negates these benefits as well as being very expensive. I am also not a big fan of Microsoft Office for the Mac, favouring Apple's own iWork suite which offers great compatibility with "native" office documents, though you will have to re-learn processes. The deciding factor is likely to be the requirement to run finance, ERP or other installed applications on your desktop. With more internet based applications running in a browser, the list is probably likely to shrink, not grow and I foresee Apple stealing a growing share of the small-business computer market. Approach with caution if you are running a number of desktop applications, otherwise my advice is go ahead and walk into an Apple store.

Improving Data Security in the Cloud

Since my last article on cloud computing, interest with our clients has continued to grow, as have the offerings to small business with accounting solutions from New Zealand based Xero and project management from PBWorks as key examples. These join the longstanding solutions from longer established players such as Salesforce and companies hosting MS Exchange and MS CRM.

The improved resilience is now well understood, but the greatest concern from SMEs looking at cloud computing continues to be the perceived lack of security, or more accurately, privacy of their data. The British Computer Society continues to raise concerns but what most worried small businesses are forgetting, is that leading SAAS applications actually provide vastly better security than they could ever afford themselves internally. SAAS applications such as Salesforce and PBWorks have independently audited servers, ensuring proper separation of data between their clients as well as security appliances and reviews superior to those commonly in pace with SMEs.

Providing you choose your SAAS or Cloud Application provider carefully and ask the questions about security and audit processes in place, you should be able to IMPROVE the security of your data by moving it to the cloud.

Social Engineering - People are the biggest vulnerability with data security

There is a very real risk to business security from Social Engineering attacks. By manipulating employees or others with  legitimate access to business information, an attacker does not need to breach corporate firewalls or "brute force" passwords, they could potentially gain entry to, or control of business data or systems by persuasion and deception. According to Gartner analyst Rich Mogull, "Social engineering is the single greatest threat to enterprise security".

Attacks often take the form of the (now well publicised) "phishing" emails which appear to be from a well known organisation, typically a financial institution, and seek to obtain personal information. More sophisticated attacks involving targeting of an organisation, can comprise a complex operation building on publicly available information about a business, its employees, clients or suppliers and seeking an end goal which could be simply obtaining confidential information, compromising user login credentials to provide unauthorised network access, or in some cases convincing the victim to trust a 'spoofed' email combined with software in order that this malicious software is unknowingly installed creating vulnerabilities on an entire network.

In the case of larger companies using overseas outsourced call centres, there is a real concern that there is a risk to data security through bribery or corruption of low paid workers with poor morale - would you attack the data centre or pay off an individual?

According to research by Azeem Aleem of the Institute of Criminal Justice Studies at the University of Portsmouth, SMEs are most vulnerable to "trust-based" or "authority based" manipulation, where an attacker attempts to gain information by building a relationship with an individual or by convincing them that the attacker is of importance. He goes on to say  “Social engineering is a growing threat to security in the corporate environment, with skillful and criminally-minded ‘engineers’ gaining employees’ trust in order to exploit loopholes”.

If an unknown person turned up at your office with appropriate information about your company or your IT provider, offering to assist with an IT problem or replace a "faulty" item of hardware, would they get through the front door?

How much information would a confident, manipulative attacker be able to get from a professional adviser / accountant / lawyer / IT Support company about a client's business? What could a low level employee at one of these firms be persuaded or manipulated to do in order to assist an 'important' person in your company?

As always with IT security, the key first step is raising awareness – recognising you may be vulnerable and identifying what information of a business, or its clients, is at risk. Discussion and incorporation into policy can then follow.

First steps to IT Security (for non-IT professionals too)

I will cut right to the point: above all, have an IT Security Policy in place. Data loss and damage to reputation from ignorance rather than deliberate sabotage is easier to prevent and far more likely - let your staff or co-workers know what is and is not acceptable. Your biggest and most likely risks are loss or theft of data, including damage through viruses and worms - not hackers.

Assuming all the basics are in place (backup, anti-virus, etc.), having a policy in place which contains some basic procedures is pretty much the most important thing you can do. This will allow you to control the flow of data into and out of your organisation and better protect it.

Policies will have to be different for each organisation, but I want to give a few ideas you could consider:

Security of backup media: You may well be in the habit of taking tapes off-site, despite widely publicized security lapses in government and large organisations, a significant proportion of backup tapes are being ported around without even basic security. Check if data on the tapes is encrypted - many backup systems do not do this by default. If your backup tapes cannot be encrypted, consider whether they should be in a pocket or handbag on trains, buses etc.

Database Security: Can people take your data easily. Examine the risks, it is commonplace for data to be transferred straight out of networks via FTP, Google Documents or even a Hotmail account. These holes can be closed.

USB Drives: In a survey last month, almost a third of those questioned admitted that they had lost a USB key. Of these, only a really small proportion had encrypted the contents. Is it worthwhile telling staff not to use portable drives?

External email: Encouraging personal use of business email may sound risky, but weigh it up against the risks of staff using less protected email systems that could bypass security and scanning you already have in place and be an easy way for viruses to inadvertently get into your network.

Mobile devices: If you allow staff to collect, send and store business email on mobile devices (Blackberries, iPhones, etc.) the risk of data loss or theft is significant - Last weekend the story broke of the Blackberry purchased on ebay containing contact details of dozens of A-List celebrities - according to press reports it was in fact lost over 18 months ago - it could in fact have been remotely wiped in minutes if it was set up as part of a business system.

Passwords - give people ideas on how to create a secure password, tell people they shouldn't give them out to co-workers.

Business Continuity Planning - now the horse has bolted, let's shut the stable door

Many small businesses are only just beginning to consider Business Continuity Planning, perhaps more imaginable risks like the recent severe weather will get SMEs moving faster on this. Larger companies now have sophisticated plans in place, the agility of small companies should allow a rapid catch up; agility is a major tactical advantage of small business as well as being a valuable asset in BCM.

I won't begin to outline a "one size fits all" disaster recovery plan, but instead here are five, quick to implement, top tips for small businesses to prepare for the smaller (but more likely) emergencies:

Know how to divert phones to somebody's home
If you have a VoIP phone system, chances are you can have an IP handset set up at home quite easily and cheaply or have a softphone installed on a PC or laptop, make sure you know how to add it to the "hunt group" so it rings with incoming calls on your main line when you need it to. Even with an analogue BT line you can order BT's divert service so diversions to a different number can be set up almost instantly.

Plan to run Accounts systems from a laptop
The accounts system is often the source of important contact information for customers and suppliers. The data files are typically held on a server but a separate online backup which can quickly be restored to a laptop with the accounts software on, provides quick easy business continuity for lots of possible scenarios. Even sophisticated SQL finance systems can often be run from a typical laptop.

Outlook on your laptop
If you run an Exchange Server, consider having Outlook data "cached" to your laptop so that your calendar (and mail, contacts, etc.) are available, even if a connection to your server isn't.

Keeping good communication with our clients helped to keep things going better than anything over the last few days - I found all our clients and partners were very upbeat and accommodating of changes to meetings and appointments.

Staff contact details
Having a Google Spreadsheet with staff contact details on means information can be accessed anywhere by anyone with proper permissions - staff could even keep this up to date themselves. Again this provides an accessible resource that doesn't rely on the standard infrastructure.

Free training
Consider participating in a Project Argus event, these are free simulations run by the National Counter Terrorism Security Office - while geared to disaster recovery from a terrorist attack, there are great lessons for BCM generally.

Other resources
Hertfordshire council produce an easy “10 minute assessment” that give some good pointers, you can download the pdf here.

Browns Footwear, Agility and Engaging with Customers

This weekend our client Browns will open their new dedicated shoe store in Brook Street, London. It is good to work on exciting new projects and hear of growth from our clients in the current climate and it has got me thinking further about patterns for successful business in difficult times.

There is lots of talk of this recession "weeding out the rubbish", it sounds like Darwinian "Natural Selection" for business, but clearly this doesn't really apply, large companies with catastrophically poor performance (RBS, Northern Rock, various auto companies) will still survive, albeit owned (or bailed out) at least in part by government - perhaps the principle of survival of the fittest holds truer for small business, although of course some small companies, through no fault of their own, are struggling.

The truth is in fact survival of the most agile - in SMEs, including the hard hit fashion and retail sectors, success is down to product and service but also agility (perhaps the banks could be considered to have been agile in having achieved change in ownership rather than collapse). Many businesses are having to look at adapting resource to fit changing dynamics in terms of which areas of the company are doing well or struggling. Good reporting systems in companies can allow leaders to analyse and respond rapidly to changes in trends, the natural progression for success and growth now is to build on the areas of opportunity and quickly drop areas likely to be hit over the coming year.

Even in recent months there have been a surprising number of success stories in the fashion and retail sectors, all with important lessons:

New Look
Great sales figures, particularly online, with plans now to extend their transactional websites to France and Belgium. It is worthwhile considering broadening markets by making transactional sites multilingual.

All Saints
Superb product, a total understanding of their customer.

John Lewis
Again, product and service.

Liberty
Exceeded expectations and challenged sceptics with a successful web business launched only last year. A big lesson here is how they have built a web presence which really engages with their customers.

Successful businesses will be those that integrate their IT systems and use them to communicate with their customers not just sell to them - look at Anna Lou of London's "Challenge of the Month", regular photos and use of humour as another great demonstration of this.

Returning to the example of Browns, it is clear from Erin Mullaney's interview with Drapers that success follows from agility, in this case listening to customers, seeing the success of an area of the business and then planning rapid, adaptive growth - quickly adapting to benefit from providing products and services that are desired in a way that will engage existing and new clients.

Inauguration over the Internet - Obama's Science & Technology

Obama's commitment to science and particularly to technology has been widely reported and is evident not only in his internet based campaigning and fundraising, but also in the various social sites that have grown around the campaign. UK politicians have toyed with internet based campaigning and I have no doubt that the most obvious effect will be that the next general election in the UK will take leads from the US and particularly the Obama team’s use of technology. Perhaps this will even filter down to more acceptance by business and organisations of the advantages of social networking. Maybe a less direct result will be IT strategy being taken more seriously at senior levels within business as technology becomes a bigger part of the political agenda.

This afternoon I watched the inauguration via the internet on CNN.com via collaboration with Facebook, very fitting with the online campaign - this unique partnership allowed many hundreds of thousands of viewers not only to view live coverage but see comments and thoughts streaming side by side with the video feed. From a technical point of view I found it pretty amazing that streaming held really well over a standard ADSL connection, while still maintaining my VPN link to the office and a link to my mail server.  This must be one of the greatest bandwidth bursts globally in history and really has set the scene for the future.

On a more political note, I can't help feeling that some of the joy felt across the world at Obama’s election is due to a restoration of dignity among Americans who previously sanctioned a second term in office for a man who history may well judge as the worst president of all time and perhaps even more importantly had as their government a team that sanctioned the shameful history, not to mention legacy of Guantanamo Bay.

I will however miss the humour from eight years of "Bushisms" so will leave the final farewell to Whitehouse.org.

Big Words

 

www.wordle.net - the most frequently used words in the blog so far ... 

Unified Messaging - What, Who and Why ...

Unified Messaging brings together electronic communications. Wikipedia defines it as "the integration of different streams of communication (e-mail, SMS, Fax, voice, video, etc.) into a single unified message store, accessible from a variety of different devices".

With 62% of SME's having more than four suppliers for IT and telecoms, how can unified messaging ever really succeed? I am really not surprised that despite massive advantages, uptake has not been more rapid.

Telecoms and network support have historically been seen as separate areas for businesses, particularly for small businesses, however with vast development in phone systems and accessibility to advanced systems filtering down to small business with more accessible price points, this is not the best approach.

There are value and functionality advantages in bringing IT and telecoms together.

Aside from avoiding the obvious "blame game" between separate providers, modern telephone systems are so dependent on the network that in fact close integration with the core IT infrastructure is often unavoidable. Once the systems are truly working together it is a very small step to achieving the following key Unified Messaging advantages.

• Emails, fax, SMS, voicemail and even video messages can all be delivered to and managed in your Outlook mailbox

• Better network management can mean better call quality
• Shared physical networks - no need for separate cabling, switches or power
• Shared resilience - spare equipment suitable for telecoms and data (including PCs for call recording and voicemail, network switches, etc.)
• Security - single overall approach to security and user rights
• Networks designed to support VoIP extensions for remote and home offices
• Voicemail fully accessible to PDAs
• Service and support becomes one task for both IT and telephony, often saving significantly on costs