But keeping costs down is obviously a key consideration for any business in the current economic climate and if the power usage of your IT infrastructure is efficient – cloud computing offers a win-win solution i.e. you pay on a monthly basis for the use of apps supplied via the cloud and the power to run them is minimised.

However, have you ever stopped to think about the actual cost of powering the IT in your business. Many businesses view the cost of electricity as a given, but imagine if you could cut the cost of your power as well as the cost of your computing solutions.

I recently met with a business associate who offers a utilities price assessment and supply service targeted specifically at business. I know we (and you probably) get hassled by utilities companies regularly saying ‘we offer the cheapest tariff’, but this service involves a full assessment of your power usage and then a professional report detailing where improvements could be made based on fact. It is well worth a look when you consider the savings made on electricity could be used to put towards the monthly fee made on cloud computing e.g. hosting your Sage Accounting Sofware.

For information on this service and to be put in touch with a professional utilities consultancy, please contact Richard on 0845 077 8883.

Social Media has significant benefits

Here at Ancar B I have been tasked with developing our Social Media strategy. Following consultation with one of the experts in this field we have devised a way forward – all I need to do now is get on with!

In the meantime, I came across some research that summarised the business benefits of social networking that I thought would be of interest and that I’d like to share with our blog readers.

Marketing & PR – If Facebook were a country, it would have more inhabitants than the USA. As a result it is an attractive target for company marketing and PR. However, social networking goes beyond  traditional ‘push’ advertising by opening up a two-way channel between customers and companies. It is therefore a great source of ideas, feedback and a viable option for customer service. It can even provide a route to market for some businesses. Gartner (the independent IT research specialists) estimates that 50% of enterprises will be micro-blogging by 2012.

Employee motivation & morale – For many IT literate employees social networking tools have replaced email and the telephone as the primary means of communicating with friends. Those bright young graduates you want to recruit may not work for your company if you destroy their social lives by banning Facebook. They see access to these services as something close to a basic human right.

Recruitment – Their online relationships can have a business benefit too. For example, a vibrant social network around your company can make it attractive to new recruits and help them settle in more quickly. Similarly, it helps HR with recruitment. For many users and companies, LinkedIn is a kind of CV exchange.

Networking & support – Employees use their networks and online connections to get support for their work. It can act like an informal technical support or training system. For example, some IT people turn to online Q&A forums to solve tricky/unusual technical problems. It can also create a strong sense of community and cohesion within a company providing mutual support and exchange of ideas. I can certainly vouch for this when a client recently enquired about the possibility of wireless scanning using an Apple AirPort Extreme Base Station (you can’t by the way, only wireless print).

Brand enhancement – Companies like Microsoft encourage their staff to create blogs and interact with customers, informally mixing support, market research, PR and brand promotion.

If you would like an introduction to an expert in Social Media and help with devising a strategy, please call 0845 077 8883 and we can make an introduction.

Thanks

Richard

Technical terms like Maximum Tolerable Period of Disruption (MTPOD), Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are often used, but what do they really mean? In practical terms, Recovery Time Objective (RTO) is the duration until a business can return to normal after the failure of a server or key computer site, and Recovery Point Objective (RPO) is the place in the transaction flow where the business resumes.

For business owners we would urge decision makers to consider the following three questions seriously:

• Recovery Time Objective (RTO) – How long can your business afford to be down?
• Recovery Point Objective (RPO) – How often do you backup? How much data can you business afford to lose in the event of a disaster?
• Level of Service (LOS) – What are the business’ critical servers and essential units that cannot be disrupted?

Implementing a disaster recovery plan includes documenting the process to bring a server or group of servers back online in the event of failure. An overlooked step in the process often flows from the assumption that an IT expert is always readily available. Due to the typical unpredictability of a disaster, in-house IT staff (if you have any atl all) may take time to find and start action. Ancar B can help develop a disaster recovery plan and, through an IT Support contract, support the recovery process so that systems and processes are restored as efficiently as possible.

How long can you afford to be down?

Ancar B consultants can help you in reviewing your disaster recovery and business continuity plan and define a realistic picture of expectations. We can provide clarity on what may be costly backup alternatives to cover aspects of daily operations that may not be critical and help you focus on the level of protection necessary to cover the RTO, RPO and LSO. In summary, defining the aspects of your company’s business that must stay operational.

For advice on business continuity and disaster recovery, please do not hesitate to call Ancar B on 0845 077 8883.

The problem is caused by the way Windows 7 handles thumbs.db files, by accessing them whilst trying to perform a delete (or move) command.  It cannot delete or move the folders because the thumbs.db files are open!

You can fix this behaviour by Group Policy for multiple computers, but you can also just perform a quick addition to the registry on an individual PC.

Copy the following text into Notepad, save it on your desktop and change the extension to *.reg.

—————————————————–

Windows Registry Editor Version 5.00

; Enables group policy: “Turn off the caching of thumbnails in hidden thumbs.db files”

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
“DisableThumbsDBOnNetworkFolders”=dword:00000001

—————————————————–

Then just double-click the REG file to import this into the registry.

Reboot, and your Network copying problems have gone away!

However, a recent survey conducted by The Register revealed some interesting findings and conclusions on the current state of productivity in predominantly UK companies, which I thought would be worth sharing.

Productivity improvement is desirable but elusive

The survey showed that when it comes to supporting, never mind maximising individual and team productivity, the right tools and information are not available to the people who need them, and considerable amounts of time continue to be wasted as a result.

Information access is the biggest problem

Having access to the right information at the right time was singled out as the most important element of productivity. It was also a significant problem when it actually comes to providing it: the majority of companies aren’t doing it well, and there is much room for improvement when it comes to supporting individual workers with collaboration tools and access to business intelligence.

Changing work patterns are making the issue more acute

Most companies today have distributed workforces, and many office-based employees don’t exclusively work from home anymore. Mobile working is on the increase, as are nomadic and home working. Team structures are becoming more fluid, with temporary teams forming and disbanding, often in different locations, and across different time zones. Issues arising from lack of the right tools to support tasks as well as collaboration are magnified, and even more time is wasted.

There is little direct support for productivity improvement

Few companies take any structured (in the shape of training) or unstructured (in the guise of mentoring or coaching) measures to improve individual productivity. There is also a strong sense that many organisations aren’t aware of what can – and should – be done to improve productivity.

The role of technology to support productivity could be greater

Comparatively little use is made of many of the technologies that can help people work better as individuals and as teams, and uncertainty remains regarding the value of particular technologies. Whether or not they are planning to make improvements, most companies could benefit from taking a more structured approach to assessing the role of technology in the context of productivity.

The role of people and process could be greater

Several of the respondents recognised that technology on its own can’t improve productivity: people and process have equal parts to play – if people don’t know how to use the technology, feel demotivated, or work in an environment that’s not conducive to productive working, then the value of the technology is instantly reduced, potentially even to zero. Equally if processes aren’t right – and that can mean too few or too many processes, as well as simply inappropriate ones – no supporting technology can compensate for the resulting loss of productivity.

Sounds gloomy doesn’t it?

Well it does, but the conclusions of the survey provide some chinks of light and indicate ways forward.

First of all it’s necessary to take an all-encompassing view of productivity, that is ‘business productivity’ as a whole. Business productivity is made up of two key elements: the efficiency and effectiveness of individuals and teams; and the efficiency and effectiveness of the processes that are in place.

From an individual and team perspective, it’s essential that they have the right tools and information to hand, and that they know how to use them. From a business perspective, it’s not only important to ensure that the tools, information and generic training are made available, but also crucial that:

• The right tools are selected in the first place
• An assessment is made of how the tools and information should be used to best effect
• Training and guidelines are tailored accordingly

But this is the aspect that’s typically neglected, because to a large extent, the impact on productivity of tool and information deficiencies, as well as lack of expertise, is a hidden cost, borne in the first instance by the employee, but ultimately by the business itself.

What do we mean be hidden cost?  To give a few examples: Managers and colleagues may not be aware that it takes a particular employee ten mouse clicks for something that could be done in one, or ten minutes for a task that could be accomplished in two, because the person doesn’t know how best to use the tools they’re working with. The resulting waste of time is not apparent as a loss of productivity, simply because the individuals in question will most likely be working long hours to complete their work – but the impact on the business of a tired stressed worker will sooner or later be felt as will the consequences of errors.

Similarly, it’s expected that employees simply get used to new or upgraded software; and even in organisations that actively support the concept of a super user who is trained to support colleagues, it is often taken for granted that those super users complete their usual workload even at times when their support is needed almost one hundred per cent of their time.

So that’s an area that companies need to pay more attention to if they are serious about improving productivity: 1) gaining a true understanding of what a tool or application does, 2) developing best practice for it use, and 3) providing appropriate training and guidance to ensure employees can use it to best effect.  It also means understanding how long a particular task or process should be taking, and what information is required to complete it; only then can it be assessed how much that time could be reduced, and mistakes avoided, if employees are given better tools.

If you’d like some advice or improving productivity in your business using IT and processes and training, please give Ancar B a call.

Thanks
Richard

To be successful, an AUP needs to be enforceable and address all Web, social networking and Web 2.0 tools currently in use or in the future.  Following the below steps can make the process easier.

A. Create the Policy

Though communicating and enforcing your AUP is imperative, employees/users should be able to focus on their jobs without worrying about Web security. As part of a basic AUP, your business should address the following factors:-

Policy requirements for AUPs

• Outline what is and isn’t acceptable, while preserving company culture
• Involve human resources, executive management and an employee committee, if possible, when creating corporate and departmental AUPs
• Include policies for on-site and mobile users
• Select an Internet security solution that can differentiate between internal and external users and allows policies to be established based on location or time of day
• Inform staff on what is acceptable inside and outside business hours. If there is any difference, this needs to be stated clearly in the policy
• Enforce policies and set precedents consistently
• Identify specific acceptable uses for different individuals or groups because blanket policies do not work

Policy requirements for content

• Determine which employee, partner, customer and business data should be protected and include rules that address data distribution both within and outside your business.
• Include social media policies that protect brand identity and image

 B. Communicate the Policy

Once you’ve created an appropriate policy from your business, the next step is to educate your users about what constitutes acceptable Web use and explain how the policy will be enforced. Policy communication should:

• Customise the ‘block’ page and explain why action was taken to block or warn the user
• Include a link on the ‘block’ page for information about your company AUP to reinforce and re-educate users about the policy

C. Enforce the Policy

Though policy communication is clearly an important step, technical enforcement of the
policy removes the security burden from users and ensures adherence to your
business’s Internet AUP. When implementing policy enforcement methods, you
should:

• Select a centrally managed solution that provides a consistent security policy for on-site, remote and mobile users
• Select a solution that offers flexible ‘allowing’, ‘blocking’ and ‘coaching’ modes for different users/groups
• Choose solutions that enable flexible policy enforcement options for employees who rely on Web-based tools. This allows administrators to manage access to social media sites by user groups flexibly – allowing everything from full access to read-only access (ability to post status, comments and updates disabled) to no access.

Right that’s it for now. Should you require any assistance on Internet Secuirty or
advice on AUPs, please do not hesitate to drop me a line.

Thanks

Richard

Some of these clients have exclaimed, “but I haven’t been on any dodgy websites!”

Unfortunately the facts are that approximately 85% of Web-based malware infections occur on legitimate websites. Some of the websites recently affected include Walmart, The New York Times and The Wall Street Journal. It’s not just about Twitter, Facebook or You Tube – this is a universal Web problem.

So how has it come to this?

Before the advent of Web 2.0 (or to you and I the development of websites allowing viewer interaction), most websites consisted of static HTML (content) and companies simply pushed read-only content to users. In other words users didn’t really interact with the content.

However, then Web 2.0 entered the scene it provided a platform for dynamic Web pages, enabling third parties to submit content to a site for a collaborative online experience. In essence, Web 2.0 applications were created to provide a venue for publishing user-generated content from multiple sources. These technologies allow users to share and exchange information easily through company sponsored and social media sites.

Development technologies such as AJAX, AdodeFlash, and Java drive dynamic content from multiple sources and allow users to freely post  and share information in real time. A single web page may be built with multiple development languages and incorporate many different technologies.

In addition, features such as iFrames allow a single web page to present content from multiple sources, though it’s perceived by the viewer to be part of a single HTML document (web page). iFrames are used frequently for third party advertisements. The ability to track cookies and user preferences enables websites to present rich personalised content to users.  However, it also increases vulnerabilities by opening new opportunities for Cybercriminals to compromise websites.

To illustrate the problem please see the graphic below.

Lets assume that it’s lunchtime and a User is on the internet looking to book a holiday in Cyrpus. Having reviewed the Hotels they click on a link for Rent A Car which applies some adult material from a hacked third party hire car company’s database. They next decide to look at a map of Cyprus (courtesy of the local Tourist Board)  to see where they may take their hire car. Clicking on the map ‘delivers’ some unwanted software to their desktop. Next they decide to download a ‘Did you know’ guide to Cyprus (provided by the local Marketing Agency with an infected system)  and click on the link that deploys Acrobat Flash and a PDF loaded with Crimeware.  What started as an innocent enquiry about a holiday in  Cyprus  has turned into a ‘nightmare’ for the User and Network Administrator!

Don’t despair, in my next article I will attempt to focus on the services and internal policies that can be applied to a business to mitigate the risk of such things happening.

Speak soon

Richard

Earlier this year Gwent Police Force inadvertently emailed a journalist the personal details of 10,000 citizens who had undergone Criminal Records Bureau (CRB) checks. The unencrypted file was intended for internal circulation, but an employee fell foul of the email AUTO COMPLETE function and the force was found in breach of the DPA.

For large financial organisations, bound by the requirements of the FSA (Financial Services Authority) and Security and Exchange Commission, the management of internal email communications is a key requirement to prevent insider trading or information leakage whether intentional or accidental. In fact, companies going through a merger, acquisition or divestment must keep tight control over internal email exchanges until deals are finalised. If an internal breach is found it can have very serious implications.

But the fact is – whether you are a small company or large corporation – if you deal with sensitive third party data you must not only guard against external threats like hackers, BUT ALSO protect yourself from negligence by your own employees. Ancar B has a number of solutions that it can recommend to provide internal and external security and would be happy to advise.

The cost in terms of loss of productivity, revenue and reputational damage caused by breaches can be far greater than businesses realise and so it is important to be proactive.

Richard

In April this year, Microsoft released its largest ever update, patching 64 software vulnerabilities – affecting Windows and Office, among other products – nine of which were rated critical.

The process of rolling out the updates is controlled by a company called Trustworthy Computing (a body created by Microsoft in 2002) who employ a collaborative approach, so that while its staff continually search for threats and vulnerabilities, they also receive information from external parties including security software vendors and independent security researchers. The Microsoft Active Protections Programme (MAPP) involves 80 or so vendors worldwide including Symantec, Trend, McAfee and Cisco – basically any vendors that have some form of protection product to detect weakenesses and suggest fixes.

Once vulnerabilities have been identified by Trustworthy Computing and the members of MAPP, they are prioritised and fixes are developed. The fixes are tested rigorously on average for two months per fix in order to maintain customer faith in downloading the updates and applying them to their machines. The reason testing takes so long is that Microsoft need to ensure the patches work with all systems and numerous combinations of applications. This is not a small task.

Once the testing is complete and the patches are released, it’s up to users to download and install them. Often Ancar B are called on to help with their implementation, since there are often instances where a ‘fix’ may not perform as expected or clash with a non-standard program.

Some critics of the ‘patch system’ suggest that if the software was properly coded in the first place it wouldn’t be necessary to embark on an endless process of fixes. Others believe ‘patch Tuesday’ is an example of great customer service, continuing to support products and protect customers years after the initial release.

I believe both sides of the argument carry weight, but for me the latter is more valid since it is impossible to predict the future and legislate for ‘changes in the market’. Either way the patching of systems is going to continue for the foreseeable future.

Richard

However, I recently came across some research that revealed some interesting information about fonts. Apparently Comic Sans (check it out on your Word toolbar) isn’t just a font used for lighthearted invitations to village fetes and school noticeboards. It is an aid to learning.

University researchers at Princeton and Indiana University gave a sample of people the same information to learn in three different fonts, with the startling result that they remembered it best when it was in 12 Point Comic Sans. As neuroscience expert Jonah Lehrer put it ‘Maybe we should read every book as an e-reader in Comic Sans’.

This could certainly apply to those very ‘dry’ Microsoft and Cisco manuals that we plough through to keep upto date with the latest developments – the future is Comic Sans.

Thanks

Richard