Microsoft have really annoyed us, that’s no mean feat as we are loyal fans. You might not like them for lots of reasons but you have to admit that Microsoft rule the business roost, they have a wide range of products and when it goes wrong its usually predictable, common and easy to fix.

So why are we upset? – Microsoft greed, quite simple and that is driving them to fool the end user into shelling out more hard earned money than they have to. They are also pandering to the greed of ignorant IT advisers who are attracted to quick profit’s and easy sales without a care for their clients long term  benefits. Just like endowment mortgages, extended warranties, PPI and any “cheap” scheme! 

I am going to ignore the cost of hardware, that’s the bits you kick and forget to dust, at least for this part, I’ll get round to it later, in another blog.

Lets assume you are an ordinary business user, in this example you work on your own. You buy a computer and install Microsoft Office Home & Business which gives you Word, Excel, One-Note, Outlook and PowerPoint. That will cost you £200 -ish. Now if there are more of you then will need a server which we will discuss later.

Now the ignorant or unscrupulous IT person will tempt you with Office 365, everything in the cloud for £10 a month and it never goes out of date, so you either dump or don’t use your Home & Business version or maybe you chose not to buy it as Microsoft will always push you to 365.

Lets do two things, look at the cost of ownership, Internet availability and versions as 365 is always up to date isn’t it?

If you buy the version for your computer it will cost £200 and you will keep it for about five years. Office 365 will cost you £10 a month and over five years that’s £720 including VAT. So you have paid 3.6 times more than you needed but of course its always up to date, isn’t it?

Office comes out every few years; 2003, 2007, 2010, 2013. So you will only ever be one version behind, and when was the last time people queued overnight to get the latest features for Office? – Never, they aren’t Apple you know.

Just to annoy you there is a free version of Office online, its not a clone, its from Microsoft and its free to use on the Internet, funny that no-one told you that till now isn’t it? https://www.office.com/start/default.aspx

Now lets look at Servers and this gets complicated so I’ll make it simple. A year ago you could buy a Microsoft server for a small business that did most things for up to 25 users. Try and buy it today and it will cost you at least £8,000 more for exactly the same thing.

Its all down to licence changes, I can do the maths here but we will both fall asleep, so take my word for it, if you don’t want to, then e-mail me and I will send you the detailed licensing costs.

Reasons why they are taking more ?

Greed, pure and simple, Microsoft revenues are being attacked on all sides with probably the only exception being the Xbox. Microsoft don’t answer to their users like you and me, we are the cash-cows. No, they answer to their shareholders who want more revenue and more dividends.

The only options for Microsoft, like any business, are sell more, cut costs or increase margin.

WOW! they have done all three. Its easy, just make it hard or impossible for users to buy cheaper stuff, charge them more monthly so they don’t notice and sack a few staff.

How short sighted, but for us it’s great, we know what they are up to but the smaller IT company can’t see further than next weeks cash flow so they talk the same language to the cash strapped, cost conscious, small business, who, not knowing any better, signs up.

Remember my earlier comment? Sound like endowment mortgages, PPI, extended warranty sales? – that’s because its all based on the same ponzi scheme, the clever making the stupid sell to the under informed.

So what’s the solution.

If you need to use your software on the Internet using your phone, tablet, laptop etc. then use the free office. You get online storage with it too. Microsoft offered this to counter Google software but you cant be the slave of several masters so they kept quiet and hid it.

Install Microsoft Office Home and business Office on decent PC’s and laptops that will last five years – tip a cheap one wont last that long.

Install a server which isn’t Microsoft based, It doesn’t matter what its running as long as it holds data, works Microsoft Outlook, drives you mobile phones and backs up. There is only one answer here and that’s a system which ends in x. If you want to know more then that’s another article but it drives your TV, most of the Internet, every Apple device, all NAS’s, routers and every large computer system in the world and its been about since 1964. Good enough for you?

Don’t bother asking the guy who recommended Office 365 to you, he’s obviously too technically inept to know how to install a proper Linux server and besides, he will want to sell you cloud services which will improve his cash flow for this week and dent yours for the next five years but you wont notice will you, after all you will be getting the latest version for nearly four times the price?

Everyone thinks it’s only the big businesses that are attacked on the Internet. In fact earlier this year, the Department for Business, Innovation and Skills (BIS) reported that 93% of large businesses fell prey to a cyberattack in 2012.

The successful attacks hit the headlines but what about small businesses, thats those from 200 employees down to the self-employed?

Before we do that, re the last sentence again. The successful attacks are unseen until the details are posted on the Internet, Most breaches aren’t detected until its too late, so bear that in mind while you have the complacent smile. Have you checked you PayPal account and credit card statements because everything under £100 is not covered by card insurance, and most people don’t check the small amounts, Now you are thinking read on…………

Well, small and medium-size businesses (SMBs) also suffered, with 87% being targeted – up 10% from the previous year.

Now, the reasons why SMBs are at risk has been examined in detail in a recent Sophos-sponsored report by the Ponemon Institute.

The report – The Risk of an Uncertain Security Strategy – surveyed over 2,000 IT security managers within organisations employing up to 5,000 people.

Given the job roles of the respondents, some of the findings are quite staggering:

44% of said that a strong security policy is not a priority

58% claim management do not see cyber attacks as a significant threat.

Other barriers to implementing an effective IT security strategy were also identified with 42%, unsurprisingly perhaps, citing a lack of budget as a large factor. Another major issue identified by the survey was a lack of skilled personnel.

Other findings in the Ponemon report are even more concerning.

Considering the fact that respondents in the survey are all responsible for managing the security function, I find it quite alarming that 1 in 3 admitted that they did not know whether their organisation had been subjected to a cyber attack in the last twelve months. Such a lack of knowledge would seem to suggest a deficiency either in the monitoring and reporting of incidents or with the IT management itself.

Also, the Ponemon Institute discovered that those in more senior positions seemed to have the least knowledge of the threats posed to their business, which is again a concern as they are likely to be the decision makers who would deem whether a particular threat should be a priority or not.

Interestingly, 31% of the individuals surveyed said that there was no particular person within their company with responsibility for making security decisions. You wonder who has the job of issuing keys or turning the alarm on and off.

Another discovery was that SMBs struggle to assign a monetary value to information assets. If an organisation does not apply a cost to its assets then how can it determine their value and, hence, the appropriate level of security protection to apply to it?

The topic of mobile devices were of concern to the individuals surveyed, especially given the widespread adoption of BYOD which they reported. Many respondents said that their organisations are planning to invest in technologies to reduce BYOD risks as a result.

51% of respondents did not equate regulatory compliance with a strong security position, given that remaining compliant shouldn’t be the goal and rather should be a by-product of good security.

So what can SMBs do to improve their knowledge of cyber threats?

1. Proactive monitoring, detection and reporting on threats to enable quick and incisive decision making.
2. The establishment of mobile and BYOD policies
3. Where in-house security resources are limited, better planning  consultants and easily managed resources can help to free up the organisation’s information professionals.
4. Costing of information assets and downtime so that senior management can invest in cost effective solutions to protect them.
5. Working with the higher echelons of management within the business in such a way that they place a higher priority on cyber security.

 

 

 

 

When it comes to IT security, small businesses is in a tight spot.

They’re almost always heavily dependent on computers but they are not large enough to have dedicated IT staff; everyone is busy doing their day job (and probably a few other jobs as well) and the responsibility is simply handed to the least non-technical person.
In those circumstances, knowing what to do, what’s important and where to start with computer security can be very difficult and the first casualty is usually the company’s passwords.
Despite the rise of biometrics and two-factor authentication, almost everything we do on our computers is still secured using passwords, so getting them right is vitally important.

I’ve compiled a list of four common password mistakes that I see when working with small companies. If you can avoid them then you’ll have put your security on a stronger footing.

Anti-virus – you need it but it’s not enough
OK, I just said this article is about passwords but I think it’s important to start with a word about anti-virus.

Whatever the state of security awareness in a very small business the chances are that there’s one thing everybody will agree on; that they need to run anti-virus. That consensus can have a chilling effect on other aspects of computer security, because to a lot of people anti-virus is computer security and once it’s installed, security is complete..

Unfortunately installing anti-virus is the second step, not the last.

The first step is which anti-virus. There are many on the market but there are probably only three or four worth having, ESET, Kaspersky, Trend and Sophos, if you want to know why, then search our blog for “I know I am safe, because I haven’t been told I’m not”

You need to ensure that all of your devices; PCs, Macs, tablets, Microsoft Servers, Linux servers and phones are using anti-virus and that they are updating successfully.

And then you need to read on…
Fear of forgetting leads to awful passwords
One of the reasons people use weak passwords, and then weaken them further by sharing them and using them over and over, is because they’re afraid of forgetting them. (I once had a customer who wrote his Windows password on his computer monitor because he was afraid he’d forget it. His password consisted of two letters; his initials).

To overcome the fear of forgetting your passwords you’ll need a place you can keep them safe and always find them.  It doesn’t matter much where it is – it might be an application on your computer such as keypass, a website like LastPass, a leather bound book or even your own memory – what matters is:

1. You know where it is
2. You can control who has access to it
3. It is the only place your passwords are kept
4. It can store hundreds of unique, strong passwords

Once you have decided how you are going to store your passwords put the ones you can remember into your safe place. Gather up any notes, files and post-its where you’ve written your passwords down and copy them over too.

When all of your passwords have been transferred to your safe place remove all traces of them from anywhere other than your secure location. Clean your passwords off whiteboards (or computer monitors), delete them from computer files and shred or burn any pages or post-its where you wrote them down.

By creating a safe place to store your passwords you’ll free yourself to choose complex passwords that you couldn’t otherwise remember.
Which is what we’ll do next…

Passwords are easier to crack than you think
When we talk about strong passwords we mean passwords that a powerful computer will have difficulty guessing. This isn’t the movies and we’re not defending ourselves against elite hackers whose second guess is always supernaturally lucky. Your passwords are at risk from computer programs that can guess thousands of passwords a second and are able to understand some of the tricks you use to make passwords more obscure.

A short while ago we were given some old computers by a small business. As an experiment, and with the previous owner’s permission, we booted one of the computers using a password auditing tool. Running on the defunct company’s own old hardware, the software guessed the admin password for the first machine in under ten seconds.
The password was an eight letter word (the company name) with a zero in place of an ‘o’ to make it difficult to crack.
The computer, it turns out, was the machine holding the company accounts. Using dictionary words and paying lip service to security with a few numbers or odd characters where there should be letters simply isn’t enough.

Use 14 characters or more and switch as arbitrarily as you can between UPPER, lower, d1g1t5 and //@ckies.

If you’re wondering how you’d ever create a password like that I suggest you use a random password generator. Now you control access to your passwords and you’ve made sure they’re all good and strong it’s time to stop sharing them.

Your password isn’t secure if you give it away
When I work with a small business they have to give me access to one or more of their systems.
I am staggered at how often I’m simply handed a long list of admin passwords (often for systems I don’t even need access to) that are shared by everyone at the company.

Account sharing like this is a really bad idea, not least because:

1. If something bad happens you can’t tell who did it.
2. It makes your more vulnerable to social engineering.
3. It makes changing passwords too painful to bother with.
4. Everyone with a password can cause maximum damage.
5. You don’t know who else has your passwords.

One of the reasons that people in organisations share passwords amongst themselves and with outsiders is because it’s incredibly convenient.  Keeping usernames and passwords secret is a bit like taking daily backups – it’s a small inconvenience that will save you a big inconvenience some time in the future.

Unfortunately you’ll just have to bite the bullet, there is no real alternative. Yes, it’s a little bit more inconvenient to make sure everyone has their own username but it’s no different than limiting access to your front door keys. Every person who needs access to a particular system should have their own account with a unique password and the lowest workable access level.

Whats the risk?

How do you feel when you are told that the bank, credit card or online retailer has given away your details? Now these guys spend £millions making sure they are secure but people cleverer than them break their systems. Now you are smaller, probably have no real security. Now it may be that you will only have a few credit card details unknowingly held on your computers so the reward is much lower but breaking in is so much easier. JUST THINK ABOUT IT, AS THE BIG COMPANIES GET HARDER THEN YOU WILL BE THE NEXT EASY TARGET. It’s time to get smarter before you become poorer as the card companies are already refusing to pay when the password was easy.

What is the “cloud”?
Lets get some definitions out the way, using the cloud is different to cloud computing which is different to cloud computing. Confused? Yes! So is every body but here is a simple guide.

This all relates to doing things on the internet on a remote computer. When you fill in your tax return then that is cloud computing but so is using online word to edit a document which is stored on the cloud, or just making a backup. That didn’t help really did it? So here is a definitive guide. Anything on a remote computer which you don’t own or control is the “cloud”. You connect using the internet to a remote computer.

If You store data on this remote computer you are using cloud storage, if you use a cloud computer to so some work such as Word, then this is cloud computing. If you fill in a tax form then you are doing it on the cloud. A internet connect to a computer you don’t own or control is using the cloud.

So we have cloud storage, cloud programs and cloud forms, Cloud can be also replaced with the word remote or even better; “I have access to internet” as in I have access to internet storage, I have access to internet programs and I have access to internet forms.

Your bank is responsible but the cloud isn’t
That’s great, we all now understand each other on what the “cloud” is, but you don’t own it or control it, you give that away in much the same way as you put money in the bank but you don’t own or control the bank. However the bank take responsibility for your money, that’s not the same with the cloud.

The bank use your money and they are responsible for handling it, the cloud does not take any responsibility and in fact I would go as far as to say that they don’t even care about your data which may not be true of all of them but you are a small dot in their business plan and model.

And that’s why its so damn confusing.

I believe that I am personally responsible for my data 100%. If I loose it for any reason and can’t get it back because of a failure to backup then its my fault. This is also the view of the law when it comes to company directors too. You are responsible, whether you like it or not so unlike the banks who take responsibility when you give them your money it isn’t the same when you give someone your data.
Storing stuff.
The advantage of storing things on the cloud only applies in three cases. The home worker, the archive and sharing data. The rest of the time you cant beat having it under your control.

The home worker
The home worker like everyone needs to store a backup somewhere, yes they can give it to a relative but normally these people are busy and low priorities are forgotten. Backups are a low priority and making sure there is a copy elsewhere rarely comes into the equation. They may make a backup on a pend drive but that’s useless when the drive is in the burnt out shed with all the paperwork and the computer from which t was meant to be a backup.

The home worker can have files backed up regularly and there is a copy off site. The only downside is that it is usually just single copy but when the shed is a blackened ruin it’s a god send.

The archive
The cloud archive is useful, its a cheap storage that’s quick to retrieve. The alternative is storing all the information and backups. This slows backups down and also day to day running. Have a backup, archive the old data to the cloud and put away the backup. The advantage is the backup media is being renewed regularly, the data in house is fresh and compact but access is available for the occasional archive retrieval.

The downside is compliance, you need to make sure that the data stored is accessible for you and you alone, apart from the various data acts, the professional bodies have quite a lot to say how data is stored.

The data sharer
The reason for data sharing can be quite simple, no matter where you are and what you have you can access your data or the data can be shared with a team, no matter where they are or what they have. By what they have I mean smartphone, tablet, laptop or public computer. They don’t even have to have a wireless link, they can download the data to their device but watch security as a lost tablet with data is, well I don’t have to explain do I?

Using Stuff
I find it quite funny that anyone with a smartphone soon starts downloading apps but anyone with a computer or tablet is pushed into not downloading apps but using the cloud. That alone would make me suspicious.

This is becoming the most widely oversold area and this is why I come across as anti cloud. Let me explain. You pay to have Software as a Service or SaaS. then wherever you are you have access to the programs you want on anything you want. I think this is a rip off along the lines of PPI, Endowments and extended warranties and anyone selling this is either uninformed or short sighted and certainly not thinking clearly of their client over their commission.

Let imagine you want the usual mix of Outlook, Word, Excel and possibly PowerPoint. If you buy this for your computer you will pay about £200, you will probably stick with that for around five years. If you buy it on the cloud it will cost you £10.10 a month plus VAT. For the small non VATable business the choice is simple £220 or £727.20 for five years usage and the cloud software isn’t as good anyway.

The main argument for cloud Office is that you always use the modern versions. Firstly they are not the same as the full blown copies and Microsoft issue full version updates occasionally anyway. In the last 11 years there were only four versions, there were no Office versions 2004,2005,2006,2008,2009,2011,2012 and that didn’t bother anyone did it?

The real killer is that there is a free version of Office in the cloud anyway! – That’s a well kept secret too!

Now there are other cloud programs CRM, ERP and the downside of these is that they are expensive over a five year period and if you want to bring the data down to your own machines then you can’t.

Except…..
The big exception to all of this would be our friends at Junari. They offer an excellent CRM package which is affordable and when the alternative is in house special software then a cloud offering makes sense.

The other downside
In the last year we have seen data lost by banks, shops and IT companies. This was due to security breaches and its the same risk you take with putting your data on someone else’s computer. Its worse as if they are a big company like Microsoft, then it will be a target. If it’s a small company then what’s their security like?

Both Azure and Exchange in the cloud have been inaccessible and that’s with massive server farm’s, so how reliable is your access? Can you suffer an outage of a few hours to several days as there wont be anything you can do in the meantime.

If your online storage only has a single centre then the snip of a single fibre optic cable will cause an outage. Its better to have several locations and several portals. Last time Microsoft cloud storage went don the revealed that there was one access point and they hoped no one noticed the three day outage, yeah right!

The alternatives
There are always alternatives, even if the answer is to do nothing its an alternative! Here is the “cloud” checklist:

Q. Is my backup in the same location as my data?
A.  Use the cloud.

Q. Do I need to share data with my devices or colleagues?
A. The answer may or may not be the cloud

Q. I like paying monthly instead of in one go
A. The answer is a credit card and not the cloud, you will save money

Q. I want to be able to access  Microsoft Office whatever I have and wherever I am
A. Don’t pay for it, use the free Office

Q  We want special software to use in the company
A. The answer may or may not be the cloud.

Q. I want six email addresses and I cant afford an email server
A. You may not need to, you can run an Exchange type program with everything on a PC

Q. My broadband is slow
A. Forget the cloud, if its slow coming down it will be dreadful sending stuff to the Cloud

Q. OK I get it, the answer is “it depends” but who can I ask
A. Anyone who isn’t trying to sell you the cloud without looking at your needs and doing a five year plan first. That definitely means avoid cloud sales people. Remember PPI, Endowments, Extended warranty. They were not in most of the clients best interest either but some people needed them all the same, it just depends.

Conclusion
I once wrote an internal memo ” Anyone who trusts their data to someone else is a fool and they probably don’t or can’t count the true cost for any business decisions”  It’s harsh but its still true and I wrote that in 1995.

Its become nearly impossible to find anyone both unbiased and fully informed. Funnily enough it’s down to trust and suspicion. Always be suspicious when buying anything remember “Caveat emptor” is such an old principle that its in Latin and deal with people you trust.
 
I have to say we do sell cloud storage and we also sell cloud archive but only the right product to the right people under the right circumstances.  

As you can see its a case of “prove the need” a principle that I applied when I became technical director of the predecessor of cmx and Its something I still firmly believe in today.