Migrating Business Data to the Cloud

Migrating Business Data to the Cloud

When businesses elect to have their desktop applications hosted in the cloud with a hosting service provider, they are also electing to have their data hosted with the provider.  This point is not always obvious to non-technical users and those unfamiliar with the hosted application concept.  Many business owners have adopted an online or hosted application solution and then realized after-the-fact that their data was no longer present on their computer.  At least, no current data was present, and it was quite a surprise the day they wanted some information but could not get it because they were not connected to the Internet at the time.  An important thing to remember, and the essential factor in measuring risk associated with use of cloud services and hosted solutions, is that adopting online applications in almost any form means that the data associated with (and possibly even data remotely associated with) the application will also migrate to the cloud.

mobile cloud data

Migrating on-premises servers – and the applications and data residing on them – to the cloud makes sense for many businesses.  Particularly as network and internet threats increase in number and as system vulnerabilities are more frequently introduced with remote and mobile access technologies, cloud solutions can significantly assist a business in mitigating the risks of being connected.  Yet business owners and IT managers must be diligent in terms of understanding the measures their service providers take to protect and preserve as confidential the customer’s business data.  And it becomes more than essential that any and all tools or services implemented be part of a strictly controlled information management and data protection plan.

Where applications are simply interfaces and logic; the value for a business is in the data used by the applications – data containing information about the company, how and with whom it does business, and how it makes money.  It is critical that the business consider how and where users need access to applications and data, so that any cloud deployment does not wind up hindering productivity rather than facilitating it to a greater level.  It is when the user becomes disenfranchised, unable to perform their work due to lack of access to information or tools, that “shadow IT” deployments appear, and data sharing solutions are introduced outside of the governance of management or IT.

The vast number of offerings for hosting applications and managing business data in the cloud makes finding and implementing the right business solutions a complicated and often frustrating process.  Even large providers that specialize in delivering from a menu of business cloud solutions often forget that their target customers may not be particularly tech-savvy, and will fail to recognize the nuances in service delivery or protection that could make big differences to the business down the line – like in the case of a system failure or outage.

Among the keys to a successful cloud solution deployment, particularly when critical and frequently used applications and data are to be migrated off-premises, is a thorough understanding of how users currently work with the tools provided, ensuring that processes and utilization can be fully adapted to the new IT model.

As long as users are able to retain their productivity and efficiency, and when improvements in workflows and information access become additional benefits, the security and protection of the business data is more likely, as users will feel less compelled to find alternative and less secure means for making the business data available from the cloud.  You may want to migrate your business data to the cloud, but you don’t want your data to migrate further than you can reach.

Joanie Mann Bunny FeetMake Sense?

J

Security and Users: Change is the Only Constant

Security and Users: Change is the Only Constant

Managing user accounts and access to business IT assets is challenging, particularly as cloud and social computing models introduce new wrinkles in security and identity management. Information has become “mobile” along with the users accessing it, yet management of user behavior is even more complicated that trying to manage a digital resource.

If you look at the history of security breaches, you’ll find that many of them started with a user making a mistake – like losing a laptop or clicking on a phishing email, downloading bad software, or forgetting to report an employee termination to the IT dept – something which inadvertently created a vulnerability that could be exploited.  It’s tough to stop breaches because there are so many possible ways for them to happen.

If most security breaches start with a user mistake, then IT departments have their hands full because users aren’t static, unchanging objects to monitor and manage.  Users change, sometimes a lot.  It is this constant change which undermines the ability for some IT departments to meet the demand to adequately secure company information systems and data. Now is the time to take control of user security and identity management, creating automation and controls to protect business assets in a constantly evolving environment.

It is not simply employee turnover that challenges security management.  Certainly, IT departments have been dealing with user account creation and termination for a long time.  And sure, users have sometimes been promoted and demoted, resulting in the requirement for IT to increase or perhaps decrease access to information and applications.  These are normal and expected activities for a business IT department.  Unfortunately, IT often doesn’t hear about the user’s change in status.  An account isn’t disabled, access isn’t restricted, and the system is left vulnerable.

Just to pile on, think about what happens when a user is more than just a single system user.  It may be manageable when where a single identity and set of credentials governs their access to applications and information.  But the proliferation of web-based services and SaaS solutions has made it commonplace for users to have multiple applications and services available to them, each with their own approaches to identity management.

For even a small business IT department, the security of all of these access points and applications must be managed and monitored – no small task when the department may not even be aware that the solution is in use.  It is not unusual for file sharing, data sync, or other applications to be implemented in businesses without the knowledge or participation of the IT department.  Actually, many services attract users due to their simplicity and ease of use, leveraging the fact that they can be deployed without the “assistance” of IT.

Users are becoming increasingly mobile, accessing information and applications from public and private locations while using any number of possible mobile devices.  Vulnerabilities which may exist in public networks and the increased potential for device loss or theft are high on the list of concerns of IT departments managing remote and mobile user access.  Mobility is driving many changes in how information technology and access to systems is provided to users, and it is changing user demands for what they should be able to easily accomplish while being mobile.

Businesses need to recognize that their continued existence may rely on keeping their information systems and assets safe and secure.  Disaster recovery and business continuity applies not only to loss of physical systems, but also to losses of various forms due to data breach. The disaster recovery and continuity plan (you have one, right?) should not only address situations after they happen; planning by definition is proactive.  It is not enough to have a plan to recover from loss or failure; the business must actively engage in activities which will prevent loss and reduce vulnerability. 

Part of this plan necessarily centers on managing users and user identities, ensuring that the company knows about all access or user accounts involved and employs strict processes and guidelines for making sure they are constantly up to date and have the authority to do what they’re trying to do.  In short, the plan must also be a plan for change, providing change management processes to guide the business as the evolution of information technology and the dynamics of user interaction continue to change.

jmbunnyfeetMake Sense?

J

read more about IT Security and Engaging users to reduce vulnerability

read more about Mobility and the Cloud, Managing BYOD and securing company resources

The Line in the Sand: Your RPO (Recovery Point Objective)

The Line in the Sand: Your RPO (Recovery Point Objective)

IMG_0108Businesses and individuals are increasingly more dependent upon the technology supporting their various activities, and the volume and velocity of information moving through these systems is increasing at astonishing rates.  With the growing reliance on information technology and electronic business data, you’d think that more businesses were paying close attention to protecting these assets. I recognize that there is a broad understanding of responsibilities as they pertain to system security, and businesses of all sizes and types are increasing their awareness of the variety of threats facing their systems and are taking steps to address them.  Yet there remains an aspect of business data protection that too few businesses are really zeroing in on, and that is the time and complexity of recovering or restoring business data in the event of an outage or loss – and the absolute line drawn in the sand which says that “here” is the tolerable loss we can experience: no more and no less.

This line in the sand is referred to as the RPO, or Recovery Point Objective. A recovery point objective is part of the business continuity plan (or should be!), and describes the maximum tolerable period of time for which data might be lost from a major IT service incident.  The necessity to establish this time frame – the RPO – exists whether the business is small or large.  In fact, small businesses have data protection needs quite similar to their enterprise counterparts.  In an article in SmallBusinessComputing.com, Kieran Maloney of Quantum Corporation is quoted as saying that “from a data protection standpoint, smaller businesses face challenges that are similar to those of larger enterprises; the amount, and the value, of their data is growing significantly while their budgets are not”.

What doesn’t seem to make sense is that businesses continue to view data backup as a necessary evil rather than a strategic element, and spending considerations for creating and meeting a realistic RPO remain low.  An article in TheStreet.com on the subject quotes Terry Cunningham, president and manager of EVault, saying “When largely preventable data loss conservatively costs businesses hundreds of millions of dollars annually, it is time to rethink your priorities”.  The author also writes that “while 95 percent of US IT decision makers said they have some type of disaster recovery plan in place, only 44 percent have remote, cloud-based recovery capabilities… More than twenty percent of IT organizations that manage between 2-7 TB of data suffered a data loss in the past year – in fact, more than half of this group suffered 2-3 data losses – each with an estimated average cost of 2-5 percent of total company revenues”.

Part of the continuity plan and a consideration in developing an approach which will meet the RPO timeframe should be the implementation of remote cloud based service, yet this has remained a low priority for many business owners.  Reliance upon more traditional data protection approaches, including tape backups and on-premises HDD solutions provides IT managers with a false sense of security and often cannot even reasonably address recovery from data loss due to hardware outages, much less for potentially catastrophic failures including loss of the location.

When considering the RPO – the minimum acceptable point for data recovery (or maximum tolerable point for loss) – businesses must look at their data management and backup strategies in order to address recovery approaches for various types of outages.  There are benefits and drawbacks associated with the different methods of backing up data, and the cost/benefit of employing any solution must factor in to the requirement to meet the stated RPO.  Daily backups may be the standard procedure, but is a potential loss of 24 hours of data acceptable to the business?  On the other hand, what is the potential cost of re-creating the data, if it can even be recreated?  Consider also that the timeframe for data recovery is not the point at which the last backup was completed; it is the point when the last backup was started.  This could result in a loss window greater than the established 24-hour boundary.

Many businesses would suggest that their tolerance for lost data – due to the cost of lost productivity and order activities – is far less than 24 hours, yet solutions employed to reduce the potential data losses often do not fully address the issue in any comprehensive manner.   IT personnel working with separate products to handle incremental data backups, machine recovery (bare metal) and snapshots of disk arrays often have a tough time trying to piece together the various pieces of the puzzle and often simply hope for the best in terms of outcome.

The prudent move is to thoroughly consider the business disaster recovery and continuity plan, and establish the boundaries for tolerable loss.  No business wants to expect to lose valuable data assets, but expecting technology to perform flawlessly is unrealistic, not to mention the unexpected impacts from acts of nature or other forces majeure.  Architecting systems to withstand service outages and having a comprehensive plan for recovering from system outages in a timeframe survivable by the business is the essential element to making a continuity plan worthwhile.  Draw the line in the sand, and then develop the system protection and recovery plan that will help make sure you never have to step over it.

Make Sense?

J

Here are a few data loss statistics for your reading pleasure… Enjoy  🙂

(stats drawn from summary on BostonComputing.net.  They may be a bit dated, but the numbers have only increased since then.) http://www.bostoncomputing.net/consultation/databackup/statistics/

The following statistics were gathered from various sources:

  • 6% of all PCs will suffer an episode of data loss in any given year. Given the number of PCs used in US businesses in 1998, that translates to approximately 4.6 million data loss episodes. At a conservative estimate, data loss cost US businesses $11.8 billion in 1998. (The Cost Of Lost Data, David M. Smith)
  • 30% of all businesses that have a major fire go out of business within a year. 70% fail within five years. (Home Office Computing Magazine)
  • 31% of PC users have lost all of their files due to events beyond their control.
  • 34% of companies fail to test their tape backups, and of those that do, 77% have found tape back-up failures.
  • 60% of companies that lose their data will shut down within 6 months of the disaster.
  • 93% of companies that lost their data center for 10 days or more due to a disaster filed for bankruptcy within one year of the disaster. 50% of businesses that found themselves without data management for this same time period filed for bankruptcy immediately. (National Archives & Records Administration in Washington)
  • American business lost more than $7.6 billion as a result of viruses during first six months of 1999. (Research by Computer Economics)
  • Companies that aren’t able to resume operations within ten days (of a disaster hit) are not likely to survive. (Strategic Research Institute)
  • Every week 140,000 hard drives crash in the United States. (Mozy Online Backup)
  • Simple drive recovery can cost upwards of $7,500 and success is not guaranteed

 

Focus on the Finance Department: QuickBooks in the Cloud

Focus on the Finance Department: QuickBooks in the Cloud

Vendors and IT solution providers are all buzzing about their cloud services and solutions available via the Web.  This buzz often includes statements about lower cost of IT acquisition and service management and how mobility and remote access benefits the business.  These statements are proving true for many businesses, yet there are still vast numbers of small business operating on local computers and unmanaged service.  The reasons which hold back these business from adopting cloud computing models are as many and varied as the businesses themselves, but there is a consistent thread to be found in these reasons, and it has to do with a lack of understanding of what certain applications really mean to the business.  In this case, the discussion is about the focus on strictly operational or administrative areas of the business and not on the finance department which, in so many small businesses, uses QuickBooks.

Cloud solution providers are in business to make money, and hosting companies in particular are looking for the right applications which will drive usage and revenues on their platforms.  When these providers look at the small business market, they’re trying to identify the applications and services that small business owners will adopt in volume.  Identification of these opportunities to serve a large customer base is essential to the provider’s economy of scale and profit model.  It makes sense that hosts would want to offer the applications which drive the highest degree of usage in their environments, so they tend to focus on the applications used by the greatest number of users within the customer organization.  In the small business market, these applications are email and productivity tools – solutions which are used broadly throughout the business and which serve a horizontal rather than vertical industry orientation.  Those are the two easy picks; finding the next most valuable solution represents a bigger challenge for the provider.

qbcloudWith Intuit QuickBooks desktop editions boasting the lion’s share of the small business accounting market, it seems that hosting QuickBooks products would be the next natural selection by hosting providers already serving their small business clients with email and productivity solutions.  However, because these service providers do not fully understand the essential functions QuickBooks serves in the small business, the assumption is that the usage of the solution is so nominal that it doesn’t make sense to develop the capability to offer it.  It is a misunderstanding that many providers have, and is the result of a lack of historic participation in the product.  QuickBooks, you see, is a direct to consumer product rather than a channel product, and most IT service providers and hosting companies recognize the product name but not really what it does or how it operates.  And these hosts are often large companies and therefore have no direct experience using the product, so there is no frame of reference for them to work from.  These service providers are simply overlooking the important role that QuickBooks solutions play in many small businesses, where it is used to handle various operational aspects of the business as well as being the product of choice for bookkeeping and accounting.  Particularly with the QuickBooks Premier and Enterprise editions offering additional functionality and industry-specific features, the products are used widely by small businesses and not just for accounting and finance.

The point of the discussion is that hosting companies and “cloud server” providers should look at the mixture of applications used by their small business customers, and they are likely to find that QuickBooks products are pretty high on the list.  Even if there are only a few people in the accounting department, and the usage by these individuals is not representative of the entire hosting opportunity, hosts should recognize that those few individuals and the software they use are not only essential, but are probably processing payroll for all those other users on the system and are paying the bills for products and services purchased.  After all, if you’re going to make anybody in the company happy, make sure to focus on the finance department and help them get their QuickBooks in the Cloud, as they’re the ones that will be paying the bill for the service.

Joanie Mann Bunny Feet

Make Sense?

J

 

 
Google+

Cloud Computing for Small Business: It’s All About 3 Apps

Every business uses technology at some level, and every business has certain fundamental needs which are most frequently met through the use of computing technology.  Regardless of business type or size and independent of industry orientation, there are 3 fundamental things which every business does which means that there are 3 fundamental application types or solutions which every business will buy at some point.  These 3 application types, which could be distilled down to just “applications”, have become so broadly used in business and so widely recognized as the standards that their names are often used instead of the term representing the functionality they provide.  When it comes to cloud computing for small business, it’s all about these 3 applications.

In what are now referred to as “legacy” or “traditional” models, these products would generally be purchased as software and associated hardware to run it, and would be installed and managed on the local premises.  With cloud computing models, the solutions may be purchased or subscribed as managed infrastructure and application licenses, or as a full service subscription (SaaS).  Regardless of the service model, the applications are the key to the customer win.  While cloud computing may be challenging how IT products and services are sold and delivered to customers, it is not fully impacting which solutions customers are actually looking for.  Over the past 16 years this has been the reality, and it may take another decade before these products are unseated from their top positions simply due to the inertia of the installed bases they’ve already developed.  Service providers have found (or will find) a way to deliver these applications in cloud computing style, or small businesses will simply not move everything to the cloud very quickly.  It is really just that simple, and I’ll explain why.

QuickBooks-Hosting-WordCloudThe three things that each and every business does, and which they generally purchase computers and software to facilitate, are communicating, producing information, and keeping score.

1. Communicating is an essential need for every business.  Whether it is communication via phone, fax, email or otherwise, businesses will communicate and they will purchase products which help them do it better.  The standard for business email communications has become Microsoft Exchange, which is now available as a highly affordable subscription service from Microsoft or from a wide variety of commercial MS Exchange hosting providers.  Certainly the popularity and growth of hosted Exchange supports the argument that not only is MS Exchange mail very widely used in businesses of all sizes, but that it is also highly acceptable as a hosted solution because users retain desired functionality and are able to benefit from a variety of add-ons and additional services from their hosted Exchange email provider.  The other thing about hosted Exchange is that the user can still use MS Outlook on their desktop to get their mail.  Now we’re back to the desktop application again.  Regardless of what mail server and service the user has, they are often more attached to using Outlook than they are to the mail service.  In fact, when you ask a fairly non-technical user what they use for email, they’ll often say they use Outlook (the desktop client, not Outlook.com).

2. Producing Information is another essential need for every business.  Whether the information is produced for internal or external use, there is a lot of information created to inform various people about the business.  Documents, spreadsheets and presentations are used in every business, and productivity applications help people create them.  The standard in this area is Microsoft’s Office suite of products which includes Word, Excel and Powerpoint.  It isn’t unusual to have someone suggest “making a powerpoint to get the message across”, rather than using the word “presentation”, and does anyone expect to get a document not in .doc format?  When users ask for productivity products, they usually ask for Office software and they usually mean Microsoft Office suite products.

The broad use and proven suitability of these products has well established them as the standards for use in business.  While these applications are now available as limited-functionality web-based applications, most businesses continue to rely on the desktop products which resulted in myriad file sharing and “collaboration” tools which work with the Office products.  Microsoft recognized the value of having the feature-rich productivity applications available in hosted and managed service models (as hosted applications rather than true web-based apps), and made the products available for licensing and distribution via their Service Provider License Agreement (SPLA). Microsoft (direct and via partners) also offers Office 365, which provides licensing for Office desktop applications and/or hosted Exchange email services.

Hosts with cloud servers and managed infrastructure and VDI solutions are all facing this truth: their services are useful when there are applications running on them, and among the most frequently requested applications are the Office apps.  This is why so many providers offer not only cloud servers and virtual desktop solutions, they add value to their service by also offering the Microsoft Office products.  At least in the case of MS Office, service providers have recognized that certain fundamental applications must be present in order for the server or desktop to have value for the SMB customer.  After all, “moving the server to the cloud” doesn’t solve the problem if all the apps remain on the local PCs.

And then we come to the final application – the last fundamental small business application for service providers to focus on.  It is with this application that hosting companies will make real impact in moving their small business customers from local to hosted applications, virtual desktops, and the world of cloud servers and managed hosting.

3. Keeping score, or accounting, is the final absolute and fundamental business function which exists in every business regardless of size, type or industry.  This is another area where service providers are focusing, realizing that within the realm of small business accounting there is a single standard product line which serves the exact profile of the target SMB/SME customer: Intuit QuickBooks desktop products.

When challenged to find a single application solution which addresses a fundamental business need, is not oriented towards a particular industry segment, and which is likely to drive increased usage simply due to existing market penetration and sales – there is only one name that answers, and it is QuickBooks, most specifically the Pro, Premier and Enterprise desktop editions.

Looking further into the problem reveals that there may be more options for small business accounting emerging in the SaaS market, but this doesn’t help the hosting companies looking to increase usage on their own platforms.  Additionally, while new and emerging solutions may be introducing options for very small business, the activity actually serves to increase awareness of and usage of computerized accounting solutions, resulting in increased share of the market looking for and purchasing these solutions – increasing the overall market for SMB accounting products and providing an opportunity to sell QuickBooks solutions to those new users. Further, Intuit QuickBooks remains the dominant choice once the business has needs beyond simple invoicing and bill payment, and continues to see growth in product sales and distribution for this reason.

It’s also true that, once a business has itself “invested” in an accounting product, change is not something considered easily.  In many (most?) cases, the business is more closely tied to their financial systems than they are to their service provider.  If the provider can’t work with the software, the business is likely to seek services from another provider.

Moving everything but finance to the cloud is not an option for most businesses, either. Particularly with small business/small enterprise, there are generally systems which serve a broad business need and not a single function.  QuickBooks is not just a back-office accounting product.  It also provides some front-office functionality, such as storing general customer information, handling invoicing, inventory management, job costing and other functions.  It is essential that service providers not minimize the importance of this solution in their target client operation.

The financial system is not an island and is often integrated with or connected to other applications and data.  Even though the QuickBooks desktop products are designed to suit businesses up to 250 employees, it is unlikely that a business will have all 250 people running QuickBooks.  Rather, the product may be used by 2 or 3 people in the accounting department, or possibly by up to 30+ users in an Enterprise deployment where the product serves more operationally oriented functions.  The rest of the company is likely using MS Office and email as suggested earlier, and perhaps some other operational or business specific product which may integrate with QuickBooks.  The point is that it’s unwise for service providers to minimize the importance of the financial software and systems, even if those solutions are used by only a very few of the total number of users within the organization. 

More evidence suggesting that the name QuickBooks has become almost synonymous with  small business bookkeeping is visible within the accounting and bookkeeping industry, where bookkeeper training programs focus as much on the QuickBooks product (if not more so) than on actual accounting fundamentals.  Businesses hiring bookkeepers don’t ask for bookkeeping experience, they ask for QuickBooks experience.  If a small business owner asks his accountant what product to use, it’s a good bet that the accountant will recommend, and possibly even set up, QuickBooks for the client.  There is momentum there which cannot be argued with, and it represents significant opportunity for those who have platforms to run the stuff.  Weirdly, QuickBooks desktop editions and other desktop-based financial products available in a cloud hosted model represent a last and final element which is driving broad adoption of cloud servers and hosted desktops within the SMB markets.

It is all about the apps, but not just any apps.  It’s about the apps small businesses need, want, know, and currently use.  Service providers who can offer their customers these applications as cloud service – as managed applications on a cloud server or VDI platform – are in a position to serve the broadest base of SMB/SME customers. Talk about addressable market… at that point, it becomes a simple function of exposure as the value proposition is undeniable (and barrier-free).

Joanie Mann Bunny FeetMake Sense?

J

IT Security and Engaging Users to Reduce Vulnerability

IT Security and Engaging Users to Reduce Vulnerability

There is a lot of discussion going on about security in the cloud.  With numerous advancements in technologies of various sorts intended to secure our information and identities on the Web, how is it that security continues to be a growing problem?  The answer is in the Big Data the Web collects (read about the Internet of Things – IoT), the large silos of data now handily available in the cloud, and users who continue to provide access for all sorts of bad guys and malicious attackers simply due to not understanding that they – the users – remain as the biggest vulnerability of all.  It is educating this user and finding a way to get them to recognize their potential as a critical element in enhancing system security and reducing vulnerability that has become the larger challenge.

People are nothing more than another operating system, says Lance Spitzner, training director for the Securing The Human Program at SANS Institute.  “Computers store, process and transfer information, and people store, process and transfer information,”  How Hackers Fool Your Employees

Social engineering and finding ways to earn user trust has become a widely recognized means for gaining access to systems and information.  Any experienced computer security consultant recognizes that Microsoft Outlook is among the best applications to place in front of users to test system security, as emails with malicious attachments (spearphishing) represent a majority of targeted attacks.  And hackers aren’t resting on their laurels while users figure out that opening email from unfamiliar sources isn’t a good idea.  Nope, not for a minute.  Today’s flavor is “conversational” phishing, where it is made to appear as though a real person is at the other end of the conversation.  Hackers are patient, and they are willing to take the time to find a way in.  Users, on the other hand, still tend to be somewhat complacent when it comes to security, and often operate under the belief that the IT security products and the IT department have it all under control.   And no matter how many times they’re told to not click on strange email attachments, to change passwords frequently, not to reuse passwords, and to make passwords hard to guess… getting users to comply continues to challenge system administrators.

most-valuable-security-practices

Communicating with users about the importance of adhering to password management and other security standards often falls on deaf ears for two reasons:  users believe that system security is the job of the IT department, and users are made to feel stupid by being chastised and punished by the IT department that’s supposed to be helping them.   Rather than helping to educate users and find innovative ways to get users to participate in helping to improve system security, IT administrators and security teams generally view users as part of the problem rather than part of the system of solving it.

It’s a heated debate that can upset people on opposing sides.  For instance, one RSA conference presenter conducted a class on “how to patch stupidity,” Spitzner says.  “He explained why people are stupid, how they’re stupid and how to fix stupid.  It was a very emotional talk for me, because how can you sit there and insult the very people who can end up helping us?…  How Hackers Fool Your Employees

In order to build strong security which is better-suited to protect businesses from today’s variety of threats, IT security professionals and system administrators should engage in positive internal marketing for better system security, deliver improved education to build awareness with users, and actually engage users in the process of threat identification and detection.  These users don’t have to be geeks or IT people; they can be average users who simply keep their eyes open to things that just don’t seem right.  “People can become a detection system to improve organizational resilience.”

jmbunnyfeetMake Sense?

J