I’ve been working for a while on a policy and associated procedures for Trinity College Dublin to enable us to leverage various cloud technologies and services for the benefit of the college. What has struck me is the complexity of dealing with the topic in a large-scale environment.

As consumers, many of us use cloud services every day; examples are Gmail and Hotmail for email; Amazon Cloud Drive and Dropbox for file storage; Google Docs, Docs.com and Microsoft Skydrive for document processing; Twitter, Facebook, Google+ and LinkedIn for social networking, etc. Many of us tend to use these and other services with little thought being given to security, data protection, privacy, identity theft, ownership of data, etc. When considered from a corporate or business perspective, these issues are significantly more important and take on many complex legal aspects. Yet, in a corporate and, indeed, an educational environment, there is significant pressure to enable these services in the business context, since end users and familiar with them from personal use.

Pursuing another interest of mine this evening – Internet Radio – I came across C-SPAN Radio and just happened to stumble upon the live proceedings of the US Committee on Homeland Security Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, on 6 October 2011, discussing the issue of the security implications of cloud computing. The Committee was addressed by very influential people in the area of information technology, information security, education and regulation:

• The Honorable Richard Spires, 
Chief Information Officer
, U.S. Department of Homeland Security
• Dr. David McClure, Ph.D., 
Associate Administrator
, Office of Citizen Services and Innovative Technologies, 
U.S. General Services Administration
• Mr. Greg Wilshusen, 
Director of Information Security Issues
, Government Accountability Office
• Mr. James W. Sheaffer, 
President
, North American Public Sector
, Computer Sciences Corporation
• Mr. Timothy Brown
, Senior Vice President and Chief Architect for Security, 
CA Technologies
• Mr. James R. Bottum
, Vice Provost for Computing & Information Technology
 and Chief Information Officer
, Clemson University
• Mr. John Curran
, Chief Executive Officer
, American Registry of Internet Numbers

Each contributor submitted a paper to the Subcommittee and they are all available on the Subcommittee’s website. So if you are looking for what the current areas of concern are in relation to security and cloud computing, why not pick up the papers and listen back to the oral testimony.

Links to the papers (PDF)

• Richard Spires
• David McClure
• Greg Wilshusen
• James W. Sheaffer
• Timothy Brown
• James R. Bottum
• John Curran

What is your organisation doing about security and cloud computing? Do you have a cloud computing policy or are your end users simply using cloud services without regard to existing policy or legislation? Please leave a comment and let me know.

If you found this post interesting, you might also like:

• Data Loss by PA Consulting
• Laptop Theft and Data Loss By Irish Health Service Executive
• More Laptops Stolen – And This Time It’s Personal

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

In my industry talks on Social Media, I mention the challenges presented to organisations by consumer technologies, so-called “shadow IT”, social media and mobile technologies. A new generation of technology users are used to having leading edge, powerful technologies and are not satisfied with the constraints placed by their employers on their technology use, productivity and flexibility. Therefore, many employees (and particularly younger employees) are getting around corporate controls by using personal email accounts, personal hosting services, online storage, Facebook, blogs, etc. The availability of new, powerful consumer technologies and services is putting increasing pressure on corporate IT departments to keep up.

Recent research commissioned by Mimecast, a UK-based email management company, highlights the risks that organisations face from their employees using non-corporate IT to circumvent controls. Carried out by Loudhouse Research, based in London, England, the research found that knowledgeable employees, familiar with social media and frustrated with corporate controls, are compromising corporate data and intellectual property.

Employees have become dissatisfied with the constraints of corporate email rules and mailbox size limitations. To get around these problems, more and more employees are adopting “a slapdash attitude to company intellectual property (IP)” and use personal email accounts to store corporate information on public servers, outside the control of the organisation. The research found that 85% of under 25s admitted that they send work-related emails or documents to or from personal email accounts.

The “Generation Gmail” research also found that:

• 36% of incoming email to work inboxes is not work related;
• Over 300 work-related emails are sent per person via personal accounts each year;
• Typically around half of these emails contain attachments, meaning that the average employee under 25 will send approximately three emails a week containing corporate IP and potentially sensitive information outside of their corporate environment, and
• Generation Gmail is particularly predisposed to personal email; 52 per cent rated it as better than work email in terms of mailbox size, compared to just 29 per cent of over 55s.

Working in an academic environment, I am very familiar with these challenges and with many more as well. Younger and well-educated people have come to expect that corporate IT services should be as good as what they can get for free on the Internet and they are impatient when this is not the case. However, it is difficult for organisations to respond either quickly enough or with a similar range of technologies to satisfy the expectations of employees and – in academia – students, researchers and academics.

How can corporate IT respond to these challenges? Are policies and procedures enough? What controls should or can be put in place to ensure that corporate information and IP are safeguarded? Is this even possible in the age of the iPhone, 3G, netbooks, tablets, high-capacity storage and other wireless devices?

It seems to me that the response to these challenges must be  try to give users what they expect, no matter how difficult this might seem. Perhaps corporate IT can never be as fast as the giants of the Internet like Facebook, Microsoft and Google but it should look for ways, nevertheless, to provide what it can. This could mean developing a Social Media strategy that identifies how you will provide the communications, collaboration and information sharing technologies that people now expect. Where can you use third parties to deliver services? What partners might you work with? Can you use Facebook or Yammer to enable sharing and collaboration? What about Blogger, Tumblr, Posterous, WordPress or Typepad for blogging? Are your policies, procedures, controls and security constraints still appropriate for the current environment and expectations of users?

We grapple with these issues every day in Trinity College and, to be truthful, we are probably always going to lag behind our users, because that is the nature of the organisation and it reflects the modern experience of technology innovation. Nevertheless, we have tried to meet expectations where we can. We have adopted Google Mail and Google Docs for our students; we are trialling Yammer as a collaboration platform for the college; we recently completed the rollout of internally-hosted Microsoft Exchange for staff; we are implementing SharePoint 2010 as an enterprise collaboration platform; we offer podcasting services and publish material with iTunes and iTunesU; we are about to release WordPress as a blogging platform for all users; and we use Microsoft Enterprise Project Management for project collaboration. We are also working on defining our needs for XaaS and Cloud Computing.

It is a start, and we know we have a long way to go. But if we can meet the expectations of our users, perhaps we can discourage them from using other technologies that might put the enterprise at risk.

What do you think? Are you dealing with these problems as well? Are you giving your users the technologies they want? What solutions have you found and how have you implemented them? This is a challenge that no organisation can avoid, so how are you approaching it? Please leave a comment and let me know your views.

Finally, Mimecast’s Chief Scientist, Nathaniel Borenstein and Cloud Strategist, Justin Pirie; and CEO of First Base Technologies ISACA, Peter Wood will host a webinar at 10 a.m. GMT on 8 March 2011 with the title ‘Generation Gmail: Is business email at risk?’. You can take part in the seminar at http://mediazone.brighttalk.com/event/infosecurity/79cc30c735-4820-intro?TID=MC.

And very lastly, if you would like to talk to me about the use of Social Media in your organisation, please feel free to contact me.

If you liked this post, you might also like:

Would You Like to Get to Inbox Zero?

Social Media Revolution? What’s Your View?

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

Check out Merlin Mann’s 2007 video (courtesy of Google Tech Talks) on getting to “Inbox Zero” by using David Allen’s “Getting Things Done” (GTD) approach. So, can this method work for you? How do you manage your email inbox? Please leave a comment and let me know.

If you liked this post, you might also like:

Is “Generation Gmail” Really Putting Businesses at Risk?

Social Media Revolution? What’s Your View?

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

ActiveWords, is a computer desktop productivity tool that automates many common activities that users perform every day. As you type, ActiveWords logs each word, even if a text editor is not being used. Once the appropriate function key (F8) is pressed, the action associated with that key word is performed. Actions can be any of the following:

• Substitute text
• Launch a programme
• Open a document
• Navigate to an Internet site
• Send an email
• Open a folder
• Run a script.

This is a great time saver and I have become a fan already. It cuts out a lot of pointing and clicking and makes life on the desktop just that little bit easier.

I use the keyword “outlook”, followed by F8 to open Outlook. I email several people regularly and by associating a keyword with them, in seconds I can open up a new Outlook email already addressed to them. I also use a few documents regularly and a short keyword opens each of them for me. There are a number of add-ons available for the product that are quite useful. These provide pre-defined keywords and menus for use with popular Internet services such as Google, MSN and Yahoo.

At the moment, I understand that ActiveWords is only available for the Windows platform.

You can download a free 60-day trial from the ActiveWords website. I was very pleased, shortly after downloading the programme, to be contacted by Buzz Bruggeman, one of the owners of the business, offering to go through the programme with me on a Skype call. Now that’s what I call service!

So why not check it out and if you like it, leave a comment and let me know.

johnlawlor.tel

.tel is a new top level domain (TLD), launched between December 2008 and March 2009. Operated by Telnic, a UK-based company, the TLD enables users (organisations and individuals) to publish contact information about themselves in a fairly simple, structured manner. While it is possible to access a .tel domain over the web, the suggested power of the system is that it can be accessed quickly and easily using mobile devices like phones, Blackberries and iPhones; it does not require a web site.

The basic idea behind .tel is that it will become an Internet-based directory, keeping all personal or organisation contact information in one place. For example, if a company changes phone number or address, it would only be necessary to change the entries in their .tel account and publish this information immediately to the Internet. With its “free text” feature, an organisation or individual can also post current information, say, about an upcoming sale or event, or a company profile.

The type of information that can be stored in a .tel account includes personal information such as name, address, hobbies and interests; phone numbers; websites; Flickr sites; Skype and Google accounts, and geolocation information. A user can decide what information to make public and what to show to selected people only (Telfriends), who must also be .tel account holders. Organisations can publish similar information as individuals and, using an internal directory structure, can add specific information, such as details of regional or branch offices. This makes it easier to navigate the .tel site.

Given the type of information that a .tel domain holds: contact information; web sites; identities; location information and searchable keywords, it is a little difficult to see how .tel is a lot different from an informational web page, blog, or OpenID profile. Indeed, I have stored all that type of information on many of my websites, blogs, social media sites, etc. I also set up a VeriSign Personal Information Portal (Beta) that provides much the same information as .tel, although it is web-based. It would also be very easy to set up a single web page on your existing domain with all of the information you want on it; by simply changing details on this page, you could, in theory, achieve the same end as a .tel account. However, Telnic say that the benefit of a .tel account is that a website is not needed and that a user’s account can be accessed easily over mobile devices, using very little bandwidth and low amounts of data transfer. They also suggest that there will be many new applications developed to exploit the features of .tel and that, for this reason, it is a useful service.

They offer ten reasons to use a .tel domain:

1. Controlling your information hub
2. Being part of a global online directory
3. Routing customers to your departments and locations
4. Increasing online discoverability
5. Connecting with customers from any device
6. Having an effective online presence
7. Performing live updates anytime from anywhere
8. Promoting premium rate numbers
9. Generating revenue from generic domain names
10. Driving traffic to e-commerce shops.

Before deciding whether to open a .tel account, I did a little research on the web and in discussion groups to see what the chatter in the community was. I found mixed views on the whole concept. Many companies who were selling domains or services were positive about .tel, while many individuals and IT professionals were more sceptical. Some people felt that it was just another over-hyped product. Concerns have also been expressed about privacy and identity theft.  I share, to a degree, the views of the sceptics and wonder how useful and secure this service will be. Nevertheless, I decided to get my own domains, johnlawlor.tel and lawlor.tel, to test their utility. All of the information I have added to my account (johnlawlor.tel only; lawlor.tel is not completed yet) is already publicly available on the Internet, so I am not too worried about publishing it in the one place. However, I have some concerns about the possibility of suffering an increase in spam or phishing attacks and will monitor my email, in particular, to see if there is an increase in these nuisances.

.tel domains cost from around 10 to 15 euros per year. There is no associated hosting cost, as all .tel accounts are hosted by Telnic as part of the domain registration. It’s very easy to register a domain and I registered mine with Blacknight Solutions in Ireland. If you’d like to have a look, check out http://johnlawlor.tel/.

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!