More and more businesses are taking advantage of cloud applications such as Salesforce, Basecamp and ZenDesk to handle any number of business operations.

When your employees start using Basecamp, for example, to manage a complex project, they are essentially moving your company’s data out of the traditional enterprise system and into the public cloud. This move may leave business owners wondering: Is my data less secure?

Cloud applications that are favored by big enterprises exist in very carefully managed environments, and the companies that own these applications have a deeply vested interest in protecting them against attack.

Further, since these cloud applications are high-profile, they get attacked all the time, so their infrastructures are continually battle-tested. Take, for example, the customer service and support application ZenDesk, which was breached in February. Hackers stole email addresses and email subject lines from three of the company’s highest-profile clients: Twitter, Pinterest and Tumblr.

While the security of ZenDesk’s application was compromised, the company identified the attack, found a solution, patched its system and notified its clients extremely quickly.

Our company uses ZenDesk, and we heard about the breach from ZenDesk support before we even read anything about it in the news. We’re very pleased with ZenDesk’s response to this incident and its full disclosure to its clients and the public. It showed that the company was on the ball and proved its interest and attention to securing its applications.

Contrast this against many small and medium-size IT departments — and even enterprise IT departments — where the folks in charge of securing an organization’s Web application infrastructure are not security specialists, they’re generalists.

In most instances, these individuals are network administrators who have also been asked to support Web applications, and as a result, they are more likely to make mistakes within their environments that could compromise security in the case of a direct attack. When breached, they also will probably require more time to identify and fix the crisis.

Additionally, enterprise security breaches are much more likely to occur through seemingly innocuous ways: a disgruntled former employee leaves with a USB drive of data or a laptop is stolen out of an employee’s car.

In 2012, an Alert Logic report found that data, whether enterprise or cloud, has equal chances of being attacked when attacks are opportunistic in nature. So, the question stands: Is your data safer within your enterprise or in a public cloud?

Well, it depends on the type of data.

There are no-brainer cases, such as if you’re a software developer, you wouldn’t want to host the source code to your application on GitHub, a code-sharing cloud application. If you have data that falls under compliance standards such as HIPPA, where you have to demonstrate that you control access to that data, the cloud wouldn’t be the best place to store that information, either.

For most other types of information, even though the knee-jerk reaction in a lot of organizations is to believe that the data is less secure in the cloud because you’ve lost control over that data, the reality is a bit more complex.

There’s a difference between feeling insecure and actually being insecure.

If you’re working with the 800-pound gorillas of the cloud application market, you can have a lot of confidence in how seriously they take the security of their systems As long as you can deal with loss of control over your raw data, it’s a good bet that the security within these cloud applications is stronger than your traditional enterprise system.

For years, Microsoft’s Small Business Server has been a turnkey, streamlined way for organizations with 75 employees or less to manage their servers.

Last year, Microsoft announced that with its 2012 Windows Server offerings, it was discontinuing SBS and that SBS 2011 would be the last version of this traditional integrated server suite. In addition, Microsoft also did away with Windows Home Server, Enterprise and its High Performance Computing editions.

SBS 2011 has been replaced with Windows Server 2012 Essentials, and organizations currently using SBS need to be aware of some significant differences between the two versions.

While SBS supported 75 users/workstations, Essentials supports only 25 users and 50 workstations. If your company expands past the 25-user limit, you can upgrade to the Standard Edition and maintain Essentials functionality and features for up to 75 users/workstations.

Perhaps more importantly, unlike SBS, Essentials doesn’t support on-premise Exchange Server, Microsoft’s popular mail server and contact and calendar software. This means that your organization can no longer install and customize Exchange for your computers that exist within your own data center.

Instead, your business has to use the hosted Exchange environment — Microsoft’s way of telling small companies, “Pony up, it’s time to move to the cloud.”

By defaulting to hosted Exchange and other cloud offerings, Microsoft is trying to preempt the threat that the cloud represents to its traditional software business. Just this month, Microsoft also hard-launched a new cloud service that openly competes with Amazon’s Elastic Compute Cloud, the industry-leading Infrastructure as a Service cloud business.

This hosted Exchange option also increases Microsoft’s revenue, because the company can collect monthly recurring income from small businesses using hosted services, rather than waiting for those companies to upgrade to Microsoft’s new server operating system.

For existing businesses on SBS, migrating to Exchange’s hosted environment comes with its own challenges.

• Physically moving data into the hosted environment represents the largest logistical challenge. Exchange information stores are routinely over 50GB for small businesses, with some in the hundreds of gigabytes.
• This mass of data takes a long time to copy across the Internet.
• While your organization is migrating its data to hosted Exchange, that same data is changing, adding its own set of complications that you have to plan for.
• It’s important to note that while moving a large Exchange database to the cloud is a big project, going the other way and trying to move data from the cloud back in-house is just as daunting. You may need to plan for this if you foresee a need to ever pull out of the cloud.

Microsoft-hosted Exchange also has some reliability issues — it’s had some major outages recently. If doesn’t support older versions of Microsoft Outlook, and if you need archiving, that’s an additional cost.

Despite its shortcomings, it’s not all doom and gloom. Windows Server 2012 Essentials features a simplified licensing, management and interface. It makes a lot of sense for startups and companies with small networks that don’t really need the managerial burden and cost of the full-scale Standard Windows Server.

Deciding whether to move to hosted Exchange or maintaining your legacy on-premise Exchange should be made on a case-by-case basis. Usually the costs are about the same over a five-year period.

Final point to keep in mind: if you are an existing SBS customer that wants to stay with on-premise Exchange, and also needs to replace your server, you will need to purchase two new servers: one for running your Active Directory and one for Exchange. It’s not recommended to run both on one machine.

photo credit: torkildr via photopin cc

Earlier this month, the Tennessean reported that “in an effort to screen out those who can’t master the skills of a rapidly changing field” the State of Tennessee is requiring 1,600 IT workers across state government to re-apply for their jobs.

The article also suggests that Tennessee’s leadership fears that many of the state’s IT workers are not adequately qualified for the jobs they hold.

While I have no knowledge about the inner workings of the state IT department and can’t say if this is a warranted fear or not, if 1,600 state IT workers are under-qualified for their jobs, the problem likely started because the state doesn’t have a regimented hiring process.

When it comes to hiring technical employees, it takes someone of superior technical skill to assess the skills of others. This is why many human resources departments struggle with hiring qualified IT employees. If the state is trying to hire IT staffers without rigorous technical testing and interviews that include highly skilled technical staffers, it’s setting itself up for a lackluster workforce.

If you start off with under-qualified employees and then promote staffers based on seniority or annual reviews that don’t measure technical skills, you’re compounding an already difficult problem.

One aspect that state positions are known for is their job security, which is great unless you have an IT department filled with longtime team members who are not the best fit for their positions. In this case, job security is not the best thing to shore up.

On the flip side, if you do have a technically sound, robust workforce and you tell those workers that they all have to re-interview for their jobs, there’s a good chance they will go ahead and interview for some non-government jobs as well. In this situation, the state runs the risk of losing a lot of institutional knowledge from within its ranks.

It’s a sellers market for technology professionals right now. We work in IT and intimately understand the challenges facing organizations with mounting technology needs. If this is what the government feels it needs to do to compete with the private sector for technology talent, then this reassessment is probably long overdue.

Either way, it will certainly be interesting to see if the state IT department will be better off or not a year from now having done this.

photo credit: Graela via photopin cc

We all know that when we’re online, we’re being tracked. A Keynote Systems survey from last year found that 86 percent of the leading 269 websites in news, finance, travel and retail tracked users’ Web habits and gave that information to third parties.

Internet tracking is an issue that many of us don’t fully understand, and it’s an issue that more people should be concerned about.

For example, if you’re browsing your Facebook page and then close the page without logging out, most people don’t know that Facebook continues to track your Web-browsing history.

Facebook has publicly acknowledged that it keeps a 90-day running log of websites its more than 1 billion users have visited. It also tracks where nonmembers go who land on a Facebook page for any reason.

Facebook, and other businesses, advertisers and interested parties such as analytics companies use cookie-tracking technology to monitor your behavior as you move around the Web. Increasingly, companies are also using HTML5’s local storage feature, which stores cookies on your hard drive. These are harder to discover and block, and are not removed when you delete the cookies on your browser.

Even if you know that businesses such as Facebook follow your every virtual move, do you know what the company can do with the information that it gathers? Unless you read Facebook’s end-user license agreement (EULA), you likely don’t know what rights the company has with your information.

Individuals routinely accept EULAs without taking the time to read them. It’s such a widespread problem that the Comedy Central television show “South Park” devoted an entire episode in 2011 to what happens to the character Kyle when he accepts the latest iTunes EULA without reading it.

In 2005, the software company PC Pitstop added a clause into its EULA that offered $1,000 to anyone who contacted the company. It took five months and PC Pitstop added 3,000 customers before one of them called about the prize. The moral of this story: It pays to read EULAs.

The other side of the Internet-tracking issue involves the government, specifically the FBI and NSA, who routinely collect and monitor information about Internet activity in the name of national security. A seemingly benign, yet telling, statistic is that the Library of Congress is working to archive more than 170 billion tweets.

One could make the argument that “If I’m not doing anything wrong, I don’t have anything to worry about.” The problem is that once, as a society, we have conceded all privacy on the Internet, we will never get it back. And Internet privacy is still an issue that a majority of consumers would prefer to keep. In 2013, the software and IT firm Ovum’s Consumer Insights survey found that 66 percent of consumers would block tracking by a search engine if they could.

That’s one reason we need to fight laws such as Cyber Intelligence Sharing and Protection Act — previously proposed legislation designed to help government agencies and businesses share “cyber threat information” — and support organizations such as The Electronic Frontier Foundation, a San Francisco nonprofit working to protect fundamental rights regardless of technology.

As an Internet user, here are a few things you can do to protect your privacy online.

1. Read EULAs before accepting them.
2. Set your browser to privacy or incognito mode whenever possible.
3. Limit how your information is shared. Some Internet companies, including Facebook and Google, provide settings that allow this.
4. Stay educated on the Internet privacy issue. One way to learn more about this subject is to read the Wall Street Journal’s series “What They Know,” which has been covering technology and privacy since 2010. You can learn more by following them on Twitter @WhatTheyKnow.

Picking a new software solution can be tricky business.

Say, for example, your company needs enterprise resource planning software. You might start by looking into the companies that create them. This search will probably yield dozens and dozens of potential providers. Unfortunately, once you start knocking on providers’ doors to learn more, your phone won’t stop ringing with sales pitches from vendors who promise that their product is a perfect fit for your company — even before they know anything about your company.

Here are some tips to help you weed out the vendors just looking for the sale from the ones who offer a meaningful product for your business:

Do your research

Before approaching a possible software vendor, carefully check into its company history and makeup. Dig around. Find as many clues about the vendor’s reputation as you can.

Here are some questions to consider:

1. How long has the vendor been in business? (You don’t want to invest heavily in an application only to have the vendor declare bankruptcy a year later.)
2. What’s its client base like? Does it serve companies similar to yours? How large is the client base?
3. Who’s funding the vendor?
4. How transparent is the vendor? Does the vendor provide open forums where users can discuss technical and workflow issues? Call the company’s support phone number to see how long you wait before you can talk to a human being.
5. For cloud vendors, ask if their uptime figures are publicly available.
6. Does the vendor provide installation and use documentation openly?
7. Does the vendor provide service agreements that meet your organization’s needs?

Demo software aggressively

To test potential software solutions, first have your IT department set up a lab environment and testing dataset that’s a scaled-down representation of your production systems. Demo the prospective software aggressively. Take the extra time to integrate the software into your lab environment and carefully test critical workflows.

This may cost your organization time and energy on the front end, but it can save your company greatly on the back end, because taking these precautions makes it less likely that you will saddle your employees with solutions that are hard to deploy and don’t fully meet their needs.

When testing, ensure that all of your organization’s stakeholders who will work with the software participate in the demo. To avoid confusion, bring nontechnical staff into the loop during latter parts of the testing phase.

It’s also important to carefully review the new software’s backup and restore process. This is especially imperative when dealing with cloud-based solutions. To avoid many worst-case data-loss problems that may crop up, always ask potential software providers these two questions:

1. What happens when you need to get your data out?
2. Who owns the data, anyway? (If you don’t own the data, look for another vendor.)

If your organization plans to host the new software solution yourself, you need to make sure that the provider offers a clearly documented application programming interface (API) that allows your IT department to integrate it with your existing systems. When hosting new software, make sure you also create specifications for all hardware, software, licensing and network infrastructure before you commit to the solution.

Take a step back

While it’s certainly important to research how a new system works, and to test it before implementation, it’s more important to decide what exactly your company is trying to accomplish before beginning your search for a new software solution.

Too often we run across organizations that are waist-deep into implementing a new system that won’t offer full functionality because the company never took the time to stop and contemplate the scope of the business problem it was trying to automate, streamline, secure, etc.

Start your search for a new software solution with one simple, old-school tool: a legal pad and pen. Jot down precisely what it is your business wants to achieve.

Barely a day goes by without a story breaking in global business news about some new cyberattack that is targeting sensitive information, from intellectual property to credit card information.

Data is the heart of any business, and losing it can seriously damage an organization of any size.

A 2013 report commissioned by security analytics company Solera Networks found that breaches on a company’s data were on the rise, increasing in both severity (54 percent) and frequency (52 percent) since 2011. The average cost on a business from such an attack ranged from $470,000 to $840,000.

Is your data protected? Whether a loss of data comes from an outside attack or from more benign, and much more common, occurrences — such as hardware and software failure, accidental deletion and viruses — the consequences on your business can be sobering and far reaching. And it happens more often than you may think.

A 2011 survey by Carbonite found that 48 percent of U.S. small businesses with up to 20 employees have experienced data loss, with most of that loss stemming from hardware/software failure or accidental deletion.

Backing up your company’s data can mitigate these types of losses, yet we commonly find unprotected databases throughout regional businesses. To be fair, when trying to understand backup processes, there are a lot of moving parts, and it’s difficult for system administrators to get it right.

To further complicate the issue, even if you have a solid backup system for your primary databases, you need to make sure that your backups are secure as well. While the vast majority of businesses today invest in improving the security of their critical databases, they often leave the backups of that data unprotected.

For example, when handling sensitive information about customers, order history, inventory or accounting records, organizations generally follow best practices, install needed patches and get rid of unnecessary software, etc.

This is especially true when companies house information that’s regulated by federal regulations such as HIPAA or Sarbanes-Oxley. Unfortunately, though the same regulated data lives on backups, businesses often leave those backups exposed.

Luckily, securing backup databases isn’t difficult. To protect your backup databases, follow these steps.

1. Set file permissions on the backups: File permissions define which users or groups of users can access the data.
2. Audit those permissions: Regularly check to make sure the list of users who can get into your backups is current and excludes all non-necessary personnel.
3. Encrypt the files: A 2012 study conducted by the Independent Oracle Users Group found that less than a quarter of businesses encrypt all of their database backups. Your company’s data is your competitive advantage — make certain that even if sensitive information is stolen or compromised, it cannot be opened.

 
photo credit: Peter Forret via photopin cc

We own 289 million televisions in the United States. That’s more than two TVs per household, and with consumers spending just shy of 145 hours a month watching, it might be time to kick baseball to the curb and start calling television America’s national pastime.

While the overwhelming majority of viewers watch television through traditional sources — broadcast, cable and satellite — according to Nielsen, the number of households watching TV through such sources decreased by 1.3 million within the past year.

More and more families are moving away from traditional television subscription services to devices such as Apple TV and Roku, which are digital “boxes” that let us stream content from popular online video and music channels through our televisions.

These new technologies mean that gone are the days when couples had to huddle in front of a laptop screen to watch an instant Netflix flick on movie night, or rely on inferior computer speakers when listening to music on Pandora or Spotify.

More importantly, an Apple TV or a top-of-the-line Roku player only costs $100; that’s a one-time fee, which compares favorably with a monthly cable bill of $100 or more. Tack on a few $10 monthly subscriptions to services such as Amazon Prime and you’re still better off.

With the promise of more live channel offerings and increased competition from established names such as Google TV and Xbox, Internet-connected televisions make sense for many viewers.

If you’re someone who enjoys shows that are readily available from services such as HBO GO, Netflix, Amazon and Hulu, purchasing individual programming and applications is a vastly cheaper viewing option.

If you’re more likely to sit down to cheer on the Titans, it’s better to hang on to your cable package for now. Nielsen’s polls show that in 2012, 99 percent of adults watched sports TV programming live or within the same day of airing. With nearly 60,000 programming hours on national broadcast and cable television devoted to sports last year, traditional TV consumption of sporting events is still on the rise and offers the most viewing flexibility and coverage.

For companies looking for a way into Americans’ changing living room, there are plenty of opportunities to capitalize on second-screen technology — people using their computers, smartphones or tablets while watching TV.

Depending on what study you look at, somewhere between 75 and 85 percent of TV viewers are on a second device while watching. Businesses and brands can engage with these viewers on social media, with targeted online offers and even with mobile applications.

Whether “the ideal viewing experience” is the longed-for single device that lets consumers record and download any content at any time, or it takes the form of a completely new and disruptive technology, the way that we consume media is in flux.

This year, technology will continue to let companies personalize ads and TV programming based on individual viewer preferences, forever changing the entertainment nucleus of your family’s home and lives.

photo credit: x-ray delta one via photopin cc

When it comes to data protection, most organizations still rely on a traditional file-based backup model for their servers. It’s a model that has been around for decades and works well for many environments. More recently, though, we’ve seen some businesses evolving towards versioned replication — a better backup option, in my opinion.

In any server backup model, you start by creating an identical copy of your server. With versioned replication, as new layers of data get added to your server, identical copies of these layers are also added to your backup server so that at any given time, your primary server and backup server are in sync with each other. This backup “server” is actually just a bunch of files that can be booted as a “virtual” server when needed.

If something happens to your primary server and you decide that you need to revert back to what the server looked like three days ago, versioned replication makes it possible for you to easily access your backup, strip multiple layers away and continue working with little to no downtime.

If you need to completely restore your server after a disaster, with versioned replication you can boot up the backup server, which will stand up and run on its own.

This compares to a traditional file-based backup model — which still gives you a good backup — but if you ever need to restore your server you have to reinstall your operating system and your backup software, all before you can even start the restoration process.

One of the primary benefits of versioned replication is the time it saves if your company has to recover a server after a disaster. Versioned backups can bring a server back online in a matter of minutes (and usually under 30 minutes); a file-based system can take hours or days, depending on how much data your organization stores.

Here are two additional benefits to versioned replication:

1. Test restorations. It’s much easier to perform test restorations of your data when you use versioned replication. Test restorations are extremely important, and your system administrators should do them as part of their routine maintenance of your company’s servers.
2. With versioned replication, your system administrators can restore an entire server in a test environment to make sure that backups are actually working, giving you the peace of mind that if your server goes down tomorrow, the backup will be there.

Handling big data. While it’s technically possible to replicate a large amount of data offsite with file-based backups, it’s a whole lot easier to do with versioned replication. As your organization’s data needs increase, traditional backup and recovery vehicles become much more unmanageable.

Ask yourself, if your server goes down and you can’t access your emails and files, how long will it be before your business is affected? This is your tolerance for downtime. For some businesses having any sort of downtime on their systems is just not an option.

Does your company have an application that you rely on and use every single day? Maybe it’s a business management software, or an accounting application or email platform. Calculate what it costs your business to have this system offline and an unproductive workforce for 24 hours. You’ll often find that this is far more expensive than investing in a versioned offsite backup system.

If your company has a lot of time and money invested in an existing file-based backup system that works well, you still might want to consider switching to versioned replication. While this decision should be made on a case-by-case basis, there are many businesses, like an architectural firm, for example, where the prospect of losing a whole day’s worth of data after a server crash would be a big deal.

It may just be time to make the switch to versioned replication. You won’t be disappointed with the change.

photo credit: Leonardo Rizzi via photopin cc

In last month’s column, we identified some key technology trends that we expect to encounter in 2013. We also mentioned that most of the predictions carry some policy and security concerns that you will have to wade through as a consumer, employer and business.

One such trend that carts some hefty security questions is cloud migration.

This year, companies can expect to see more and more business applications move to the cloud. This means that you’ll likely be striking up at least one new partnership with a SaaS (software-as-a-service) provider in the coming months.

Before you cement a new relationship, here are some things you should look into from a security perspective regarding cloud computing.

Data

Who owns your data? When working with a SaaS provider, you need to be crystal-clear about who owns your data: you.

You also need to understand what mechanisms the cloud provider gives you to extract your organization’s data. For example, the application could have an open API that lets you query your data out.

By knowing who owns your data, if you ever need to terminate your relationship, you’ll have a predefined path to transfer all of your data back within your organization.

Terms of service

With some cloud providers, if you look at their terms of service very carefully you’ll find that it’s possible for them to mine the data that you have on their systems for their own purposes. This could mean targeted ads, generating statistical data or any of a number of things that the provider doesn’t have to tell you about in detail.

For businesses that have to maintain compliance with various privacy standards, this can be a big issue. Your organization’s information security officer needs to read the terms of service very carefully. If you have to deal with legal compliance standards, have your attorney read them, too.

The bottom line: Know what you’re getting into before you start moving data into the provider’s system.

Authentication

Most companies have some kind of centralized authentication system, and many cloud applications would like to integrate with your existing authentication scheme.

From a management prospective, this is great because it makes it easy for your employees, who don’t have to maintain multiple passwords. But there’s a security implication as well: If the cloud operation is compromised, then your internal network can also be compromised.

That’s why your company needs to be very careful before choosing to integrate cloud applications into your internal authentication systems. It’s often a better choice to not integrate them and to accept the convenience penalty.

The overarching issue when moving your business applications to the cloud is that your organization is at the mercy of how security-conscious the SaaS provider is. If the provider is not doing its job to secure the application, it can lead to a direct compromise of your data. You can’t control the provider’s diligence.

While many applications will, and rightly should, make the transition to the cloud this year, if your company has an application that must be protected at all costs, a SaaS solution is probably not the answer at this time.

Green Hill Productions, a division of Spring Hill, creates and distributes conceptual recordings to the specialty and traditional retail market. You may have seen the division’s listening centers in places like the Biltmore Estate and Dollywood and in various mom-and-pop stores across the United States.

The company’s ecommerce website is linked to iTunes and lets listeners digitally download music and listen to sound samples. The site also includes artwork from the group’s CDs and DVDs.

Spring Hill has been a Concept Technology client since 2009. With seven users and five servers, the company originally had its own IT employee on staff and would call on Concept Technology in emergency situations.

A couple years ago, the tight economy prompted Spring Hill—and pretty much every business owner—to rethink the way it approached its operations. After careful consideration of its strategic and economic options, Spring Hill decided to outsource its accounting, sales and full technology needs.

Partnering with Concept Technology on proactive maintenance and monitoring services has saved Spring Hill money, and given the company peace of mind that its servers and workstations are being maintained. That leaves Spring Hill more time to focus on the important things: Its music.

Takeaway

• No one person can do it all. Similarly, no one person can know everything about IT. If your company’s budget allows for one IT person on staff, you might want to consider partnering with a service provider. With a technology partner, for the same (or more often less) cost your organization can benefit from a team approach.

Spring Hill Music Group

101 Winners Circle Suite 123

615.383.5535

greenhillmusic.com