Backward Thought

It’s a tough time to be in the Information Technology industry. Innovation from major players like Apple, Microsoft, and Google are causing major business disruption throughout the world, not to mention shattering old comfort zones of most IT staff. Yet, I’m stunned that the number one problem holding most teams back is still poor attitude and an utter disconnect from reality.

If you’re in IT and this is you, then you’re likely soon facing a RGE (Resume Generating Event) and possibly bounced to another industry:

  1. That passive aggressive, smile to your face and waste everyone’s time writing novel flame e-mails, while often telling your boss they have no technical knowledge is ridiculous and has no place in modern business.
  2. If you’re walking around bad-mouthing management, vendors, systems, and operations then STOP! You sound like an arrogant idiot and are simply telling everyone not to respect you.
  3. Counter punch mentality died nearly 2 decades ago. You can no longer sit and wait for that phone call or e-mail to come in or hope and pounce on someone else’s mistake. Your mission is to be proactive, anticipate, and get involved to provide value and prove your worth.
  4. Drop the line about “do you want me to document or do the work?”. The job is documenting processes and identifying improvements. You don’t get to “own” the knowledge and trying to do so identifies you as untrustworthy and apathetic.
  5. No one cares about tracking your every move, but management doesn’t understand what you do. That case management or ticket system is not about how many incidents or hours, but rather what categories do they fall under. Think about it. What positive regular feedback do you have for the powers above? No feedback or constant whining just cements the idea of little value and irritation to the organization.
  6. Finally, if your ego is tied to how many servers you have, built-in complexity or how many IT staff work under you, you’re no longer relevant. The average IT staff will be cut in half this year, along with half the servers eliminated. Better get with the new trends and applications, as that tired infrastructure knowledge is no longer necessary.

Maybe you are lacking some tools or training and there is limited budget. However, the most valuable people in IT are those that have great soft skills and are naturally inquisitive. The technical stuff is extremely easy to learn in comparison. Put a smile on your face, take that chip off your shoulder, and start helping the organization and growing your brain. You’ll be happier and more engaged with your value always improving.

 

Publicizing Your Blog

There are those that can write and those that simply shoot themselves in the foot by re-posting some content from other sources as the “I’ve got a blog too” crowd. Now that you’ve started and gotten a few posts published, it’s time to publicize your blog. The whole reason you started a blog was to educate, entertain, and motivate your audience. You picked some categories for topics that fit with your marketing strategy and knew blogging was an easy way to add content and links for your website.

Now you need to:

  1. Make sure you’ve added the widget for readers to follow your blog getting an e-mail with each submission.
  2. Add social media bookmarking icons so readers can publicize the posts they like Twitter, Facebook, etc.
  3. Claim your blog on Technorati (the leading blog search engine) by creating an account, select Claim Blog under Profile at upper right, enter the blog information, and add the generated claim number to your next post such as B655RVYJY4DF.
  4. Post links to your blog articles on social media sites you use.
  5. Submit your blog RSS Feed to free top ranked RSS Directories.

Finally, keep writing. Your audience wants more and the more content you add increases your credibility and the likelihood of organic user links to your site.

Email Templates Are Waste of Time

And no, this is not an April Fools’ joke. A few months ago, I received a newsletter from a prominent sales guru, Jeffrey Gitomer. The title was “Your E-mails Suck!”. It wasn’t offensive to me. In fact, my reaction was finally – someone else gets it and will relate how email is out-dated, intrusive, and unreliable noise.

Nope. The main article was in fact about e-mail templates. The argument was that the added pizzazz was infinitely better, even with the same message. Strike one for Gitomer - two more and he’ll be off my radar probably forever. My favorite thing lately is to examine motivations and in this case it’s not giving good sales and marketing ideas, but selling the template service. In all transparency, I utterly despise e-mail as one of the worst communication mediums of all time and a huge productivity loss of mental masturbation with no upside for business. Gitomer is one of the few e-mail newsletters I receive, but the template message is very out of touch.

Besides the fact that e-mail blasts using templates are just more noise, the reality is that all the graphics used to give extra style are blocked by default.  If you try to use your favorite color schemes for shading, the look is flat and resembles the web back in 1996. While the trend on the web today is wide, e-mail templates seem almost cartoonishly narrow at around 550 pixels to accommodate e-mail preview panes. Which leads to the issue that Outlook (predominant e-mail client) uses Word and not a browser to render templates, so you actually are back in the mid 90s using very simplistic tables and formatting. Worse yet, your great looking template for Outlook may not display correctly in other e-mail clients.

If the main portion of your marketing strategy is sending more, but better looking SPAM then your cause is likely a lost one. E-mail is the number one enemy of productivity worldwide. People don’t want your unsolicited e-mail, have SPAM filters that may block your message, and have neither the time or inclination to download your pictures or read more than 2 sentences. Gitomer’s advice about using templates for appointment follow-up and even for general correspondence has too many negative implications. I’m not compelled to click on your blog link or drift away to your Facebook page because you use an e-mail template. If I get an e-mail template being used for normal correspondence, it looks terrible without graphics and just tells me it’s another impersonal distraction. The paradigm has changed and you’re supposed to provide great content via the web that customers choose to read and hopefully compelled to take the next step in the sales/buying process.  With all the new marketing options, don’t waste your time on e-mail templates.

Control Your Destiny

Seriously? Again? So how long were sales people not able to use the system and e-mail was down and people thought you went out of business because the website wasn’t there either?

It’s a common story. You wouldn’t thoughtlessly give a relative stranger your power of attorney or access to your bank account. However, most business owners (large and small) regularly and naively give up full control to their reputation, communications, and business continuity. How?

They let random web guys control their external DNS (Domain Name System). Before your eyes glaze over and you move on – PAY ATTENTION. Just like the myriad other acronyms you’ve learned to manage a business, this one is a definite must know.

DNS is simply the service that converts an IP address on a network or the Internet to a computer name like SHERYL-PC or a domain name like www.matrixforce.com. If the local DNS service on a network is not working, you can’t browse the Internet or send or receive e-mail. If your external DNS is not working, no one can access your network, send/receive e-mail, or find your web site. Before you smugly think “I’ve got people who handle this for me”, think again.

Do a whois search by entering your domain name like matrixforce.com (without the www) and see what is displayed by clicking this link: Network Solutions Whois. For the majority of you, the address or phone number will be wrong and some unknown vendor or past employee will be listed as contacts. Also, the renewal date is likely a shock and no where on your calendar reminders. If this is you, then that vendor owns you or if it’s a past employee you have to now go through a lengthy process to prove ownership. Oh and if the DNS addresses listed at the bottom aren’t related to the Registrar then you have another problem of a third-party in the mix. Which leads to the next question of where are you registered and what is the user name and password to change the information?

For best practices you should:

  1. Have your domain at a Registrar that offers not only domain creation and renewal services, but a DNS Manager and web hosting. My preference is Network Solutions (no compensation based upon this recommendation), but there is Register, Godaddy and several others. These services are long-established, stable, and reasonably priced.
  2. Your registrar account should be something generic, like your business name. The Registrar URL for login, user name, and password should be kept where you can access it for maintenance and during disasters independent of a vendor, IT support, or other employee. Ideally, you should have separate contact information for the administrative and technical contacts. The e-mail address should be something generic like billing@abc.com that is associated with a distribution group or someone’s actual mailbox. That way contact isn’t lost when people change roles and multiple staff can receive notices of things like pending domain name renewal to prevent website and e-mail disruption. If you want to have a technical contact for IT or a vendor, the same rule should apply using something like support@xyz.com.
  3. DO NOT allow a random web guy or even an established web design company access to your Registrar account. There is a mandatory 60 day waiting period if your domain registration is moved, before you can move it back. Escaping from being captured from some no-name Registrar or web guy can be trying, because at any point they have the power to stop a transfer back. AND they don’t want you to move back to someone reputable because they lose control and annual domain registration commission. Guess what? You have no e-mail or website while the transfer takes place and likely for DAYS afterwards as most web designers know little about the process and don’t add any DNS settings for remote access, e-mail, or even the website.
  4. DO NOT allow a random web guy or established web company to change your external DNS. To update a website, all a web designer needs is a FTP user account and password (separate from your Registrar user name and password). They desperately want to move you to a hosting they resell, so they are motivated to not only change your web hosting but move DNS to them too. Now you’re at a questionable web host for long-term viability or high uptime and more importantly totally dependent upon contacting the web design company, hoping they make any necessary changes for you. Can you say OWNED? Try getting ahold of Johnny-Bag-Of-Donuts during normal times, much less during that e-mail migration on the weekend or blizzard natural disaster. And yes, unless they are expert about the process and got a copy of your DNS records ahead of time to emulate at the new host, you go without e-mail or a website again.

So now the staff is trying to get a $200M manufacturing company to have e-mail again, because the owner’s niece had a college buddy that does websites and moved the registration. They’ve gone 2 days without sales people able to access the system, no one has had e-mail, and the website is down. The customer was able to contact Rupert, but the DNS Manager at Wheely-Wacky-Wild Domains has been down and as a third-tier registrar does actually take 24 hours for updates to happen, rather than the average 15 minutes of the big boys. After all this bungling, the customer can’t be found in Google and the site is not even in HTML5 – but that’s another story.

Web 2012

Every organization needs a website. However, the days of a 10 page site are over. Your website should be useful for customers and enticing for prospects. Maybe it’s time for a makeover?

  1. Play the us and them game. Create a spreadsheet with a column for your website and columns for competitors.
  2. Then list look/feel, menu options, message/text, etc. If they all are roughly the same, then you’ve got a blueprint for what to change.
  3. Your website should be at a major web host and not tied to your facility – business continuity and escape hardware capital cost and time consuming web server maintenance.
  4. Better start using something with standards like Expression Web 4 – get the Pro version and you’re set for graphics and video editing too.
  5. The site should be HTML5 and utilize schema.org for better search results with Google, Bing, and Yahoo.
  6. Avoid fully unsupported features by all browsers like the canvas.
  7. Everything is a DIV – eliminate tables.
  8. Unless you haven’t gotten the memo, flash is dead, will leave a negative impression, and won’t be found on search.
  9. Plan on spending at least $200 with iStock or your favorite for photos or video.
  10. Have your keywords or categories ready and listed for how you want customers to find you with search.
  11. While researching, click related searches in Google or Bing for other keyword/content ideas.
  12. Create content to answer your audience needs, automate, or aggragate.
  13. Start with the bottom line and fill in to support.
  14. DON’T bore with tell the agenda, tell each agenda item, and tell again the summary of the agenda.
  15. If you can, tell a story.
  16. There’s got to be something fun and different for your audience and to separate from the competition – THINK.
  17. Video is currently a major content differentiator.
  18. Authority on the web is through quality content and quality links.
  19. Since the advent of NOFOLLOW links, your main source of links and ones you directly control are your own content.
  20. Successful sites must have more than 100 pages of quality content that is useful to the audience and not reprinted or minimially changed from other sites.
  21. 500+ pages will be the watermark for 2013.
  22. Everything is a little bit bigger. 1024 x 768 is the lowest resolution of your audience.
  23. Test for the top 3 browsers of Internet Explorer, Chrome, and Firefox.
  24. The look should be open and clean with headers and footers stretching the width of the page.
  25. Ditch the distracting background image.
  26. The most common font for major publishers on the web is Georgia.
  27. Font size is larger and usually the same for screen and print like 12 pt.
  28. General layout is header, nav, article, aside, and footer.
  29. Decide if you will incorporate the use of ads.
  30. Best ad locations are above the title of the page, middle of page content, or prominent placement on sidebar or aside.
  31. Use only one CSS file for faster page load speed.
  32. Don’t forget to add print formatting to CSS for all that good content.
  33. Generally header, nav, aside, and footer are not printed.
  34. .print and .noprint may be used for some elements such as a black logo instead of white on screen.
  35. List the full URL in parens in a smaller font for printed links on paper output.
  36. Simple HTML navigation with no java script.
  37. Highlights when hovering over menu options are fine, but remove visual borders around menu buttons.
  38. Drop down menu options offer 1 click for users, but many search bots still struggle with all those links on one page.
  39. Menu links should be anchor text for key words.
  40. Company or About menu option should always be last, with most useful audience menu options first from left to right.
  41. No one wants to hear you brag about your company – ever. If you presented a good impression and appealing story, then prospects may want to know more about the organization.
  42. Each page should have a link to About with either rel=author or rel=publisher  to denote the authentic source or author.
  43. About page should have a link to a Google Plus account with rel=me.
  44. Google Plus profile should link to the about page as a contributor such as www.kevinfream.com/about.htm.
  45. Signup for Google and Bing webmaster tools and analytics.
  46. Add the code for Google and Bing verification.
  47. Plan on tracking traffic weekly or monthly.
  48. It’s not the number of hits, but conversion that is important. Where is your audience going on your site and how do you respond?
  49. Use a generic e-mail address and password for all services that is not tied to an individual such as webmaster@yourdomain.com.
  50. Responsibilities change and companies are bought and sold – make transitions easy for you and your successor.
  51. Layout for home page can and should be different than sub pages.
  52. Nice visual layering effects can be done with divisions.
  53. Often the H1 tag is assigned to the logo on the home page – not typical for other pages.
  54. Home page link is www.yourdomain.com and not index.htm or default.htm.
  55. Meta title is limited to 69 characters.
  56. Meta description is limited to 156 characters.
  57. Current meta title trend is “brand: keyword, keyword, keyword”.
  58. The same is true of a descriptive meta sentence with brands toward or at the begining.
  59. Make sure to use the ALT tag for images to give search engines text to understand for images.
  60. Use itemscope and itemtype for major elements of a page from schema.org.
  61. Emphasize only 3-5 important elements on a page for microdata.
  62. Too much microdata may be considered SPAM or gibberish.
  63. Home page should have some elements that change daily, weekly, and monthly.
  64. If you choose to have a large ad or image rotator, change the pictures at least monthly.
  65. The concept is a funnel where you want to direct the audience to 3-5 major choices.
  66. Important choices or calls to action should be above the fold – before you scroll down to see the rest of the page.
  67. Every page should have buttons for like, follow, plus, etc. from AddtoAny or similar service.
  68. Other services like Addthis and Sharethis have better websites and offer analytics, but are difficult to implement or don’t work properly in HTML5.
  69. You’ll also need a bit.ly account to further track hits on links from retweets, likes, and pluses.
  70. Old school thought of fitting everything on one page for 800 x 600 resolution, without scroll shows lack of content and looks ridiculous on large monitors.
  71. You rarely sell anything on the web and shouldn’t think that way.
  72. Move the sale along until the user raises their hand to request contact, help, or next step in the process.
  73. Drop the testimonials as they are not third-party validation and the public perceives them as fake, purchased, or unrepresentative.
  74. Don’t use reprinted blog posts.
  75. Recent posts should only be original content useful for the audience.
  76. Spend some time on the footer - not the old duplicate navigation links.
  77. Modern footers have columns to help drive evaluation and conversion along with address and phone for localization and Social Media icons to view content at those services.
  78. Throw all images in an images folder.
  79. Then use Smushit to make them smaller and load faster without loss of visual quality.
  80. In HTML5 you write articles, the main section of the page.
  81. The article has an outline to use heading tags H1 – H4 for visual emphasis and keyword sections of the article.
  82. Try styling H1 with character spacing to achieve a unique look.
  83. Links are no longer underlined, but a different color from the text and the link is added when hovered. Don’t forget to change the color for visited links.
  84. Take extra time to plan folder structure for growth and to avoid moving pages and breaking links for search.
  85. Create a folder for each keyword or phrase and image having a hundred or more pages in each.
  86. Main category files should be in the root and associated pages in the category folder.
  87. All file names should be lower case and have keywords separated by dashes without unnecessary articles or prepositions.
  88. Simple tools like PowerPoint can be used to save pictures or slides with transitions as videos.
  89. Add quality content and value to fill the whole screen on each page concentrating on just one subject or keyword.
  90. Always have a clear call to action and links to other relevant pages or categories on each page.
  91. Generate and submit a sitemap.xml to Google and Bing – and of course regularly update when adding pages.
  92. Ditto for an RSS feed to syndicate the site and have other RSS services providing links and exposure.
  93. Use Google Alerts to monitor your key words, competitors, and customers.
  94. Social media is for broadcasting useful content to show authority on a subject and entice visitors to your web site.
  95. If you already don’t have a Gravatar, get one for a standard picture accross the web and verification it is really you.
  96. Facebook is for B2C and should be avoided unless you have stories, video, pictures, and ads to upload daily.
  97. Twitter is for listening to customers and competitors and daily links to valuable content preferrably from you. Twits are people who don’t understand this concept.
  98. Well done videos on YouTube not only separate you from the crowd, but provide invaluable search links from the description.
  99. LinkedIn is by far the best business social media site - effectively fill out your profile and your organization to show expertise and actually learn some things from others in groups.
  100. Remove the old stuff, add the new, monitor, and start generating content because your competition read this blog and has been posting new pages daily.

Eliminate Bottlenecks

Is this year going to be better than last year? I can already say yes, but can you?

The reason is the elimination of several bottlenecks in our business. It took most of last year, but two major issues holding us back were eliminated by process change. We estimated the changes would save us approximately 500 hours this year and about 10K in capital investments. More importantly, the changes help us focus more on clients. Already, the board and myself are seeing improvements in staff motivation and better understanding and service.

Too many businesses fly into the new year with great hope, but no direction. Management is clobbered with year-ending and beginning tasks, so it’s business as usual. What are 1 – 3 things that if you “fixed”, would help management, staff, and customers? Think strategically and if it is just one thing that has a significant positive impact, that is still huge.

We moved our Customer Relationship Management application that runs both our sales and support operations to cloud computing. We exported the data, customized a few forms and reports, and in full operations in less than 30 days. A bottleneck was removed for staff as all functions could now be done in one place. Our management team had one less thing to worry about off of our business continuity list. Finally, customers reap the biggest reward by some new features and more focus.

One of the major reasons you use a Virtual CIO is to eliminate those bottlenecks which become a win/win/win for all involved. Here are a few examples we’ve done for other clients:

  • Increased inventory turn double per month by integrating data collection for a large distributor
  • Increased product shipments 6,000 tires per day for a major manufacturer
  • Saved energy conglomerate $24 million annually in freight processing
  • Reduced IT costs $86,000 annually for local law firm
  • Lowered communication costs $225,000 for a municipality

Unfortunately, identifying the bottleneck and how to remove them are two different skill sets. If you’re tired of the status quo, inquire about our Virtual CIO service (918) 622-1167 Option 3.

10 Tips for LinkedIn Ranking

Most business lessons tend to smack you in the face. You get angry and your stomach is queasy. There is always some circumstance at home or other people to blame, but you eventually come to the realization that you should have seen it coming or a painful lesson just gave you experience that will never be forgotten.

So why is your Virtual CIO telling management and staff about LinkedIn? Because LinkedIn is not the business version of Facebook to post your resume, it’s a business search engine to be found. That means jobs, products, services, customers, and prospects. What kind of statement does your obscurity or apathy say versus your peers or competition – much less to customers and potential prospects? And if you’re thinking that all “I ever do is search for people or companies”, then type something like “payroll service” (or your line of business) and watch in amazement that people are displayed. Then be honest about how good you are about keeping up with your contacts. LinkedIn let’s you do that while your connections regularly update you too.

So now, your first reaction is to rip through the profile wizard in just a few minutes and go on to real work. Like most things in business, the most obvious approach is rarely the right one. While you congratulate yourself on a digital resume, your profile will be incredibly boring and minimally useful to anyone else. You’re supposed to add some personality and reasons for others to connect with you. Write dialog for people and use keywords of how you would like to be found. The following are a few tips from my own profile:

  1. Professional “Headline” is not your job title.  From CEO at Matrixforce to Managed Services and Cloud Computing Expert – which says more about me? More importantly, it’s the first place to add keywords of how I want to be found. Besides, your title is listed immediately below in Current and Past positions.
  2. You need a picture so people can actually see who you are. Use one of how you want to be perceived for business and not the Facebook casual Saturday or funny pet picture.
  3. Website links should not say Company Website or My Blog. You missed the boat too, if you were creative and changed the generic terms to your company name and a call to action like Read My Blog. Again, these links should be the anchor text of how you want these sites to be found in any search engine. In my case, Managed Services rather than the company name Matrixforce.
  4. Get a Twitter account. It’s another way to engage and if you’re lazy like me, I link Twitter to other services so one post hits LinkedIn and any other connected services without having to go to those sites. Post something when you have something useful or relevant to say – not a micro-blog of your mundane daily activities. Give three times before you ask or sell.
  5. Personalize your Profile link because it is more readable and shows that you get it:  http://www.linkedin.com/in/kevinfream
  6. Summary should be in first person rather than third. It should be brief and a call to action like e-mail or call is acceptable. Try not to brag about how big or how many, but rather what is in it for the reader who hopefully was looking for your keywords. Specialties should again have a handful of keyword phrases. My previous summary was some copy from a corporate website that in retrospect seemed either arrogant or historical.
  7. Move sections around to be different and put strengths or most useful content upfront. I moved my blog below the summary and will likely add an upcoming video above the summary.
  8. Uh oh. Now it’s time for Experience. Where is that old resume? Don’t even go there. Tell what the company does in a brief sentence. Then in first person, tell your role like a value proposition. Put a few bullets for accomplishments and (you guessed it) work in some of your keywords. Company name and title should link to those companies or people with similar titles. Don’t go crazy and add spam keywords to your company name or title. It looks absurd and is a general turn off for the reader.
  9. If you haven’t gotten the hint, the other part of social media is giving some information away. So why not add some applications to show a presentation or video, listings, portfolio of offerings, publications, or events. Give something valuable to the reader, but don’t give away the farm or arm competitors with anything that is not public information. For example, I automated cost comparisons and used them as landing pages for projects.
  10. You know those groups at the bottom? Well they should have your keywords and it’s great to understand your industry, but what if you participated in some customer groups?

It may take you a couple of hours to really fill out your profile completely. Note, that you should be able to raise your ranking significantly and possibly to the first page. However, unless you truly are the leader for an industry segment, you won’t be able to game the system. The best way to rank highest is to provide a large amount of high quality content for people who want to connect with you.

That leads to the next topic of connecting. Some of you will stop at a complete profile taking solace in the fact that you now make a positive impression and others will start connecting, posting, and discussing. Those that are marketing are doing more business. The next time you get another LinkedIn invitation and simply click accept, you better make sure your profile doesn’t make you look foolish and then start getting acquainted with this business tool.

Winter Ready

One day in late October, the day ended at 91 and then just like that the next morning it was freezing and the high was in the 50′s. Then the Northeast got dumped on and just like that it was flashback to ice storms of 2007 for Oklahoma – only this time the 5 inches of ice also had another two foot of snow. The state was gridlocked, but the world didn’t care. They were out of the polar blast zone and customers had needs and employees had to work to earn a living.

Fortunately, Edward had learned a lot since then and his company wouldn’t suffer through the following 2 weeks. In 2008, he hired a Virtual CIO that helped to reduce the amount of servers and IT cost with managed services. Accounting, CRM, e-mail, and standard documents had all been moved to cloud computing for better security and built-in business continuity at much less cost. The IT guy Bill was great, but we no longer needed him and fortunately the Virtual CIO was connected and landed him several other opportunities.

In 2009, Edward helped the economy and moved to another house where the power lines were buried. He’d also picked up some disaster recovery skills having an annual backup of SharePoint Online on an external drive, critical contact information, and extra battery backup at the house. Whether a disaster or sunny day, employees accessed the applications from anywhere there was Internet access. No costly failover to Houston or wherever or liability of having employees try to travel to a failover facility or underground bunker that was likely flooded and unreachable. Add a few cheap mifi’s and you’re good to go even if your cable or satellite goes out.

Most of Edward’s peers still wanted to “touch” their servers or had contracted with some local hosting company, that was either over-run with those fortunate to make it to those facilities or otherwise occupied with the misery of new prospects. All the while their employees were at risk for severe injury or death, the cost was overbearing, and even so business was at a standstill. Of course, Edward knew he was lucky as few technology companies understood the cloud or even the business processes of moving there. If the company hasn’t been around for more than 20 years with proven industry recognition, skip them and run not walk away from the “we’re gold, platinum, diamond” whatever pitch of the day.

The phones had been remotely forwarded. There was another order. Purchasing processed it and the sales people had even put a few opportunities into the pipeline. Accounting processed the invoices and payroll. Marketing had updated the website and was responding to followers via Twitter. All in all, employees had a couple of days working from home in pajamas by the fire and most importantly customers were impressed and knew the company was there for them when most of the rest of the industry was not.

Dead Zero

Here are two contrasting stories of network security for National Security Month. What follows, does not depict real events or persons.  In the business world, corporate data is protected by two separate, yet equally important groups:  the Information Technology staff, who maintain systems, and management that control budget and strategy. These are their stories:

Scenario 1

“Zeus, this is Striker”, the hacker said, like this was some cool military mission. “You were right about that IP address from the port scan and this should be easy”. The java injection for the just above consumer-grade Sonicwall got the hashed password. Let’s RDC to the mail server using the internal IP specified by the SMTP rule. Yep, same password for the domain administrator account. Score and owned!

Now add an account to the firewall with a special rule and port for backdoor access just in case – it’s takes four steps and as many places to find so it’s not likely to be discovered. Hide another admin account in AD and bury the hacking utilities some three folders down in Windows.

Time for the good stuff – make sure there is full access to all mailboxes and as usual administrator has full permission to all files. Find the HR, Accounting, and Management folders and copy anything that looks promising. Whoops, there’s that password spreadsheet. [Grin] Bingo, in the accounting system and that account number list will help quite nicely.

That should be some good commission. Charlie, I mean Whiplash,  has the employee list to get a decent return on stolen identities. Crackers can do the bank transactions and order spurious stuff from suppliers using the accounting data. And finally, Ohura can use Outlook Anywhere and copy or monitor anyone’s mailbox using the website or LinkedIn to target the big-wigs first.

Scenario 2

“Zeus, this is Striker”, the hacker said like this was some cool military mission. “Why are we looking at this one again?”

The firewall was enterprise server grade. Worse the MX record showed that e-mail was hosted at Microsoft. Further, there was a CNAME for SharePoint that likely housed all the critical data, that was also at Microsoft. Ohura was dating a salesman there who was brain-dead and had no scruples about giving away company secrets, but his account only had access to his mailbox and some public sales literature.  Even if it was the IT guy, his account wouldn’t have access to all the SharePoint data and mailboxes in the cloud.

I could spend a couple of nights hammering on this firewall, but what is there to go after? For sure, I don’t want to start going after Microsoft and have SWAT busting down the door the next day. “Zeus, let’s go after something with a pay day.”

Washing Machine Syndrome

At some point in your life, it happens. The washing machine stops spinning out or simply dies. What a major inconvenience to have wet and soapy clothes. You may have to go buy some underwear for the next couple of days or try to find a laundromat. It costs as much to repair as it does to buy a replacement. If you’re fortunate, you whip out the credit card on the weekend and try not to get sucked into your favorite color or cool front loader with the matching new dryer. Depending upon your stage in life, you may be forced to hit the garage sales and get a friend with a truck to pick one up.

Regardless, the old washing machine is removed and the new one plugged in and screwed to the hot and cold water. You’re back in business and wash away without another thought until it happens again in another 6-8 years. The problem is that many companies take the same approach with their servers and it’s not as simple as replacing the washing machine.

Anyone in business can tell you, there is significant risk and lots of small and massive failures. Owners have a lot of moving pieces to understand and must have the courage to make decisions like that old Kenny Rogers song – count your money, be ready for the cards you are dealt,  and know when to walk away or run. These same people wouldn’t dare try to not pay payroll tax for a couple of months (which can never be escaped), but regularly risk it all to run 12 – 36 months out of warranty on servers running the business.

You see I have a unique ability to tell the future about when a server will die. Well, actually it’s simple. Servers are generally warranted for  3 years with some limited options for upfront 4 or 5 years. That means there are no parts or extremely limited spare refurbished parts throughout the world at warranty end – thank you lean manufacturing. So that means if you have only one power supply that shorts out, it’s 5-10 business days to have a new server shipped plus emergency recovery because complex hardware and software just isn’t like plugging in a new washing machine. Bad RAM, that old type is probably not available. If you have RAID and one drive dies and the machine is still running, try 5 times the cost of a new one with 5 times the capacity wasted to replace.

I’ve heard it all: “That’s the best server we ever bought” or “We just got that server in 2005″. This is generally begun or ended with some explicative or irrational statement about so much was spent, it should last for 20 years. Then, wait for it, the new equipment won’t run any of the old software and the new software requires other new software.

Treating your infrastructure like a washing machine just costs the business half to a full month’s expenses and revenues, plus lost goodwill with employees, customers, and suppliers – along with bad press and loss of new potential sales. But its IT or that support firm’s fault right? We’ll just fire those bastards. After all, IT has no budget authority and those consultants were crazy and the recruiter of the day with PC Magazine says anybody can do this stuff.

Ding. Ding. School is in. While it may feel good to fire someone in this situation, how about trying to prevent it in the future? Fact: your equipment is only as good as the warranty. Often it’s only like $200 – $400 more to get that 4 hour 4 year warranty part replacement from Dell. Then a hardware problem is fixed quickly versus doing everything by hand, waiting 10 business days for a new server and weeks to workout restoration with the waterfall effect of upgraded software.

Back in the day like 10 years ago, the answer was to buy two of each server or a spare parts kit for each server. The cost was exorbitant and the software configuration overly complex and rarely worked. Today, you stop repeating the washing machine syndrome by:

1) Cloud Computing - Get rid of most of your servers. Escape the cost of hardware, software, maintenance, and upgrades. Along with less cost, a big chunk of your disaster recovery is also resolved.

2) Virtualization – What servers are left should be virtual with reduced equipment cost and the side benefit of running on older versions of software on the virtual servers longer.

3) Managed Services – You’ve outsourced everything from the coffee service to payroll because those services do it better and for less cost. Why not shrink or eliminate your IT staff for the same benefits? The good ones manage cloud computing and virtualization, as well as keeping you current for anything on-premise.

Follow

Get every new post delivered to your Inbox.