By: Rob Bamforth, Principal Analyst, Quocirca Posted: 23rd July 2008 Copyright Quocirca © 2008

Information technology now plays such a large part in our lives that its emotional impact in the workplace has drifted through a feeling of imposition and indifference and arrived at one of desire. Recently thousands queued to be the first to buy a new Apple iPhone, with Apple claiming over a million sales in the first three days. As well as device appeal creating populist swings in favour and fashion, a similar effect is occurring with online content and services. Traffic on the internet is becoming dominated by the extensive use of mass media and video download sites and services such as YouTube and the BBC iPlayer—technology not only ‘on demand', but in demand.

Mobile phones, internet access, compute power and storage capacity have become accessible to all; cheap, and easier to use. Commoditisation and open standards have led to further improvements in design, service and integration, although some products are better than others. For consumers this is great news, and in theory it should be true for businesses, but the reality is more complex. While standardisation has driven down per item costs and made interconnection simpler, the variety of available technology still makes the overall system more complicated, especially when different options are expected to co-exist—a particular problem when users are given a free choice.

Within the confines of office- and workplace-based IT equipment this is less of an issue. While termed the personal computer, in reality there is little individual attachment to the deskbound PC. Uniform deployments are commonplace and sometimes virtualised into a thin or slimmer client, with some exceptions for the engineering departments hanging on to high-powered workstations and creative departments with their Macs.

But outside the premises, individuality returns. Asking someone if you can borrow or use their desktop PC is unlikely to raise any objections, asking the same question about a laptop or, even more pointedly, a mobile phone, will probably raise hackles as well as barriers. Where once employees would have been indifferent to the laptop they carry—as long as it is functional—or the mobile phone they use—as long as it makes calls—they now link personal attributes such as style, status and individuality to these devices. After all, in their personal lives they now browse, choose and buy IT and communications products just like any other form of consumer electronics goods—tv and hi-fi intertwined with pc and wi-fi.

So for their working IT and communications tools, it is no surprise if employees like to make their own choice of mobile tools to reflect their own personalities. But how does that fit with the needs of the business?

Many companies have tried the prescriptive approach—the corporate standard issue—and applied restrictive consistency to remote software tools, laptops and mobile phones. That may work fine if the technology is issued and paid for by the company. But not every company can afford to operate that way, and with an increasingly technology-savvy set of consumers as employees, the corporate issued and controlled devices will often disappoint.

In theory, standardisation of technologies helps, but in practice standardisation, in one aspect, creates opportunities for divergence elsewhere. There are several open mobile phone operating platforms—Windows Mobile, Symbian, Linux—and many popular closed platforms. They mostly share and support standard Java platforms, email protocols and web standards, but the complete package delivers many variations. For example, companies offering trans-coding solutions to make web pages work across all mobile phones manage dozens of different attributes across the thousands of uniquely different models of mobile devices in circulation.

Past Quocirca research has indicated that not allowing employees some flexibility in selecting mobile devices means they will care less about security, as user buy-in stimulates personal responsibility. There is also the issue of productivity. While many vendors will enthuse about how mobile technology offers productivity gains, the only really concrete examples involve those workers who have to follow well understood, often largely repetitive, processes. For example, field service engineers, delivery and logistics control.

The remaining examples are dressed up in terms like customer responsiveness, faster decision making, instant access to information etc. For these workers the technology does not make the process more efficient, it allows the worker to be more efficient should they desire it.

The employees' attitude to the technology at their disposal will have a significant impact on how quickly they adopt it, get the most effective use from it, and ultimately how much it increases their productivity. Something that does not fit with the individual's personal mode of working, and differs from what they have chosen for personal use, just adds to the challenge. If someone has spent hours queuing for an iPhone, how will they view being compelled to carry and use some other less desirable device, especially if they find it harder to use?

At one time, many employees would have seen technology at their place of work and thought it might be great to have that at home. Now the reverse is more likely to be true, partly for some to extend their personal life into work time, but for many to get access to what they think are the best tools for the job.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 11th July 2008 Copyright Quocirca © 2008

Mobile communications have transformed both personal and working life. Not only do most of us regard the mobile as one of the three items we check we have on leaving home—wallet or purse and keys are the other two—but the mobile number is likely to be the primary business phone number. Recent Quocirca research, commissioned by RadioFrame Networks, looking into the communications needs of European small and medium-sized businesses (SMBs) backs this up. The contact routes that appear most on business cards are email address and mobile phone number, with switchboard numbers and especially direct dial fixed extensions lagging some way behind.

The mobile is critically important for some SMBs as not only do a third overall not have a direct dial or fixed phone extension listed on their business cards, but in those with fewer than 50 employees, over a quarter no longer bother with a fixed phone at all. For them and perhaps many others, the mobile has become the hub of business communications, boosting the productivity of time spent outside the business premises.

No wonder then that combining the individual flexibility benefits of mobility and the organisational management needs is becoming of interest, with a telecoms industry now seeking to offer the benefits of both fixed telecoms and mobile telecoms through some form of fixed mobile convergence (FMC). This approach needs to be evaluated carefully, and there are some key questions SMBs should ask when deciding where to invest, outlined at the end of this article.

Bringing mobile into line with long held guiding principles used for purchasing fixed telecoms services highlights three issues that affect all those struggling to manage a fleet of mobile phones across their workforce: control, cost and coverage.

Control relates to who provides the mobile phone and pays for the underlying contract—organisation or individual? While it might seem simplest to allow employees in SMBs to do what they like, bringing their own mobile devices to the business quickly causes problems when the phone links into the IT systems—for example for mobile application and mobile email—and results in a mess of incompatible chargers, headsets and phone capabilities. This is even harder to manage in companies that are unlikely to have dedicated IT staff.

The free for all approach also raises cost issues not only in the management and control of bills, but also in that the company may miss out on cheaper tariffs by not having its mobile fleet with the same operator. Cost is already the main concern for most companies when considering mobile telecommunications.

Coverage, however, can become an issue for those organisations where a corporate choice of mobile operator is taken and applied to all employees provided with mobile phones. These decisions will often be taken purely on price, but with mobile as a primary form of contact, some thought will also have to be given to the level of coverage.

Some SMBs have clearly struggled with this decision, as over a third report occasional or frequent problems in obtaining a signal while on their own business premises. In one in six cases employees have to move around the office to seek out a signal, and in one in twenty employees have to go outside to get a signal. Not only is this frustrating for the individual, it also wastes time, and if the calls are important it creates a poor impression. Ultimately it impacts the bottom line.

However, many employees spend at least part of the business day working from home. Issues of coverage here are more marked, with almost half of SMBs believing that some employees will probably or definitely be having issues obtaining a mobile signal at home. This may be more pronounced when the organisation has a single corporate contract, as even if that takes into account one mobile operator's coverage at the company's' premises, employees' homes might be in locations far better served by other operators.

As consumers, employees will have chosen the best deal for themselves, and if home coverage is an issue with one operator they will have sought out an alternative. But while working from home, their employer would like the business-supplied mobile phone to still work. So, in taking control, the business might run the risk of making those working at home less contactable. Given their increased reliance on the mobile, SMBs need to be even more aware of these issues and how to deal with them.

The issues of cost and coverage in particular are those often addressed as part of the marketing messages surrounding the many suppliers who are promoting services under the banner of fixed mobile convergence (FMC). These are a mix of traditional large operators, historically offering fixed line services and now wanting to embrace mobility, existing mobile operators seeking to extend their reach while containing costs, and new entrants looking at what spectrum is becoming available and how they might capitalise upon it.

Underpinning these offerings are many differing advances in technology, each bringing their own complexity. There are also options to combine more elements of communications into a unified whole. While larger businesses may have the luxury of resources and support to explore several different approaches to see how these may advance their business to make them more competitive in the future, SMBs just need something to help with the task at hand. With that in mind they can still look at how to address the issues of control, cost and coverage, but with a pragmatic rather than technology-tinted view of the potential FMC solutions.

• Cost. Does it really save money, and how will investment costs be recouped? To manage cash flow businesses need ongoing bills to be predictable and flat, rather than outpacing value gained.
• Utility. For example, does it require specialist training or for users to change their behaviour? SMBs need something that works out of the box and delivers business benefits without getting mired in technology or jargon.
• Individual value. Does it make the working day simpler for employees as well as the organisation? Providing employees with tools they value encourages them to be productive.
• Ubiquity. For example, is it applicable and cost effective for all types of employee? SMBs cannot afford the time, skills or effort to mix and match different solutions.
• Quality. Voice calls are a basic business need—does it sound right? Low call quality and frequent disconnections present a poor image.

The technology employed to deliver FMC is often given far too much prominence, and sold with a vision of a unified multimedia, multi-format future, when all many SMBs want to do is just communicate—coverage with cost control. For a further exploration of this area of mobile communications for SMBs download Quocirca's free report "Loud and clear".

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 16th June 2008 Copyright Quocirca © 2008

When the first Apple iPhone appeared a year ago it created a huge stir among consumers. It was a particular hit with the Apple faithful, with an expectation that anybody with a creative bone in their body, or a tendency to wear sandals and sport a ponytail would go for the device no matter what the functionality.

There were many naysayers, and many technical issues were raised as ‘big problems' that would deter users; a poor camera, a closed battery, no 3G - a supposed deal-breaker for any European user. It was also very expensive and tied to costly contracts with only one choice of operator. Despite all this, Apple can be fairly pleased. Usability and design have trumped all the techie issues, it is a communications device centred around the user, balanced across all applications - a simple to use and handsome jack of all trades.

But of course, it shouldn't appeal to the business user. After all, they are too sensible to be lulled by ease of use and beauty of design, especially as a major flaw for them was the lack of full connection to enterprise email, calendar and contacts. They want a tool that allows them to get on with the job, not a style icon or object of desire.

However, business users turn out to be human too, and even the first generation iPhone appeals to some. It's probably only as a second device to another enterprise supplied phone, and as only really the top execs would get away with it on their corporate contract, it couldn't be positioned to challenge the corporate handset suppliers, or could it?

Well, this creates an interesting feeling of déjà vu. A companion device, only senior execs, early security worries, proprietary architecture - this all mirrors Research in Motion's (RIM) early progress - perhaps Apple's new device is more ‘BlackBerry two-dot-oh', than iPhone 2.0?

So what does that mean for RIM, its bunch of BlackBerrys and the other corporate smartphone handset suppliers?

It is clear that many of them have tried in some way to latch on to the handheld style and usability that Apple brought to everyone's attention. Their products are not all necessarily as aesthetically pleasing, but the entrance of the iPhone onto the scene appears to have raised everyone's game. Touch screens and icon interfaces have abounded, but some suppliers still fail to understand that it's not simply about hardware features, but the right blend of hardware, software and service. This was something RIM recognised from the fruition of the first BlackBerry.

Having created the mobile email category, RIM has had enormous success with both its chunky PDA-style devices and their full qwerty keyboards, and slimmer smartphone style hardware. Its attempt to widen appeal to other manufacturers by licensing the software platform has been slow, and in reality, stumbled. The combination of hardware, software and service that made the concept such a success means that hiving off any of the elements was always going to be a challenge. Offering the software on someone else's plastic, even with the same push email service, still pits any licensee against the BlackBerry branded hardware.

As a result there have been large numbers of the BlackBerry hardware devices sold, 20 million at recent count, although that's still tiny compared to the billions of mobile phones. Use has spread beyond email to many other applications. The increasing spread of the BlackBerry across all layers of the organisation opens up a different challenge for the first time. It is no longer a mark of seniority, status or prestige - if anyone can get one, where's the deferential differential?

There are other challengers for RIM too, coming from Symbian and in particular, Windows Mobile. As the BlackBerry normalises many more enterprise activities onto a mobile handset, this increases the need for closer integration into existing IT infrastructure. In many areas Microsoft products - Exchange, Office, .NET - will form crucial parts of the corporate IT services. Skills in these product areas will be widespread, and despite many concerns about specific product issues, there will be an undercurrent of acceptance. This makes Windows Mobile devices more acceptable as the mobile workhorses, but thus far, the range of products has been limited, some struggling with the operating software and some designs a little uninspiring.

Now, Windows Mobile has evolved from feeling like a slightly flaky Windows 3.1 into a very capable Windows 98. The licensees building handsets based on the Windows Mobile platform, in particular Taiwan-based handset maker HTC - perhaps in response to Apple and further developments of their own - have significantly improved form and functionality, despite some lingering concerns about battery life (something RIM cracked a while ago). There is of course still further to go, but this broadening range of handsets from HTC and the other licensees is now ready for a mass business market.

By adding Microsoft Exchange ActiveSync mail, calendar and contacts synchronisation, security and device management features, and positioning the new iPhone as enterprise ready, Apple has thrown a new challenge into the smartphone industry. The style and cool appeal will certainly undermine the kudos crown held by the BlackBerry, but it might also have given an unexpected shot in the palm to other smart handsets as well, in particular to Windows Mobile.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 4th June 2008 Copyright Quocirca © 2008

Almost half of UK organisations subsidise employees' personal calls made on company supplied mobile phones—either completely or only requiring a partial contribution from the employee—according to recent Quocirca research. With the average personal usage on company mobile phones estimated to be as much as a third of the total bill, why are companies letting this through? Is it intended as a perk for employees or are those in control of the purse strings just being casual with money they could add to the value of dividends paid out to shareholders?

It might seem like mean penny-pinching to some, but pennies saved quickly add into pounds, which might be important in harder economic times. Take a simple example, where an organisation has 3,000 mobile phones with an average airtime cost per user of £30 per month. The total annual expenditure would be £1,080,000. Using an average of around 30% for personal use (probably optimistically low), the total cost of this would be £324,000.

The values per person might be deemed to be low and, as such, many organisations may see this as a minimal or acceptable loss, but when equated to the entire mobile fleet this becomes a significant sum to be given away as an informal benefit. In most cases it is unlikely to be recognised as forming part of the employees' benefit packages.

This could be only the tip of the mobile personal usage iceberg, with many new elements contributing and becoming more appealing. For example, ‘personal content’ on the mobile phone such as premium text messaging (voting for reality TV shows), services that cannot be barred by the networks, the increase of personal text messaging (over two-thirds of company text messages are thought to be personal), then there is the possibility of making payments via the mobile phone.

In addition to the loss there is also a compliance issue, in particular relating to VAT, which cannot be reclaimed on personal calls. According to Quocirca's research, in many instances companies use a ‘finger in the air’ estimation, or leave it to the employee to work out a value to assign for personal use in order to satisfy HMRC requirements. The issue with this is that organisations have no or very few processes in place to actually audit their employees’ personal usage levels and, as such, could be under-declaring the VAT value and, in some instances, over valuing.

As organisations begin to deploy more and more mobile data applications this adds further complexities in understanding and in managing such expenditure. In one anecdotal example a company was stunned to receive a mobile data bill for one user in excess of £8,000. When investigated, it turned out the user had been streaming a live football match to their smartphone whilst away on holiday. The employee's response—"I thought we were allowed personal use of the mobile?"

There is a further issue most organisations do not even consider that could have greater repercussions from a HR perspective. If the company allows employees with business-supplied mobile phones to benefit from free personal calls then, in practice, they are excluding all other employees that have not been issued with one from receiving this benefit. This is an unwelcome potential headache that could lead to claims of unfair treatment from the many employees without them, or those expected to provide their own.

Overall, the need to make personal mobile use visible and to effectively manage that use is evident from the impact it might have on the bottom line. Brushing it under the carpet is no longer acceptable in times when companies should be prudently managing their costs, or at the very least understanding the true value of all the benefits they are providing their employees.

Some companies will dismiss the amounts involved as of little consequence, but their shareholders might like to ask if the business's decision to ignore personal calls is taken by default by being unaware of their true cost, or whether it is deliberate, based on the facts.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Simon Parums, Managing Director, Themis Posted: 8th May 2008 Copyright Themis © 2008

Although IT department employees are covered by the same Health and Safety laws as other workers, there are many issues specific to the industry. Staff working in IT are required to spend much of their time sitting at a computer so the most common complaints are limb disorders such as repetitive strain injury and eye strain from long spells working at a computer screen.

Computer screens are wrongly blamed for a wide range of health problems. In fact, only a small proportion of computer users actually suffer ill health as a result of working at a screen. Where problems do occur, they are generally caused by the way in which they are being used, rather than the computers themselves.

Employers can avoid claims from staff for these issues by ensuring a good working environment and examining the ways computers are used. All employers should also have a Risk Assessment. This will help them identify the risks so they can take the relevant steps to reduce them.

IT employers should have:

• A full written Health & Safety Policy in place;
• A Fire Risk Assessment carried out on their premises;
• Adequate First Aid cover;
• Training in Display Screen Equipment (DSE); and should
• Look into obtaining separate Risk Assessments for groups of employers including young workers, pregnant workers, noise, stress etc.

All of the above should be carried out on a regular basis and not just as a one off.

Here are some other common complaints from IT workers and tips on how employers can combat them:

Aches and pains
Repetitive Strain Injury (RSI) has become the common term for all manner of aches, pains and disorders, but it's not always correct and can mean different things to different people. A better medical name for the whole group of conditions is ‘upper limb disorders'. Usually these disorders do not last, but in a few cases they may become persistent or even disabling.

Employers can avoid problems by good workplace design, to make sure staff can work comfortably, and that they take regular breaks from the workstation. Short and frequent breaks are thought to be more beneficial than longer, less frequent ones. Preventing upper limb disorders is easier than ever.

Limb complaints can arise from employees who use laptops and portable computers. Make sure are compact and easy to carry. Design features such as small keyboards can make prolonged use uncomfortable so consider advising staff to use a docking station.

If full-sized equipment is available advise staff to use it. Like other computer users, people who habitually use a portable should be trained how to minimise the risks. This includes sitting comfortably, angling the screen so it can be seen clearly with minimal reflections, and taking frequent breaks if work is prolonged. Wherever possible, portables should be placed on a solid surface—importantly this should be at the right height for the user to prevent back injuries

Damage to eyesight
Extensive research has found no evidence that working at a computer can cause disease or permanent damage to eyes. However, long spells of screen work can lead to tired eyes and discomfort. Also, by giving eyes more demanding tasks, it might make users aware of an eyesight problem they have not noticed before. To prevent problems employers can help ensure screens are well positioned and properly adjusted, and that the workplace lighting is suitable.

The heat generated by computers and other equipment can make the air seem drier and some contact lens wearers find this uncomfortable. Where the air is dry, employers should increase the humidity.

Employees covered by Health and Safety regulations can ask their employer to provide and pay for an eye test from an optometrist or doctor. Employers only have to pay for spectacles if special ones (for example, prescribed for the distance at which the screen is viewed) are needed and normal ones cannot be used.

Headaches
Headaches are a common complaint in the workplace and it's often assumed they are caused by working at a computer screen, but this isn't always the case. Headaches may result from several factors, such as:

• Screen glare
• Poor image quality
• A need for different spectacles
• Stress and anxiety
• Reading the screen for long periods without a break
• Poor posture

Try to identify the reason for any headache complaint as it can usually be put right quite easily. It could be something as simple as adjusting the employees chair, changing the monitor or providing further training on how to use the computer. This is something that will be identified if you have a full Risk Assessment carried out.

It's extremely important to remember that, no matter what size of the business, all employers have Health and Safety obligations to ensure staff have a safe working environment. If you are confused about any of the information given in this article it's essential you speak to an expert. A small cost to seek advice could save you thousands in the long run from claims brought against the company. Good Health and Safety practice also increases productivity which will have an impact on bottom line profitability.

If you require further information please visit http://www.themissupport.co.uk/

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Simon Parums (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 6th May 2008 Copyright Quocirca © 2008

In economically challenging times it is no surprise to see the knee-jerk reactions of many organisations to ‘cut costs'. Overall solvency (profitability), and the monthly demands of liquidity (cashflow) are vital for the health of any company—most businesses cannot rely on government rescue like that extended to some now infamous banks—so it sometimes seems that cutting costs is the best thing to do.

However cutting equally across all cost centres in a blind panic is rarely effective in the long term and should be taken as a last, rather than first, resort. There are often many avenues that can be addressed before wielding an indiscriminate axe. This is particularly important in those areas where direct expense is most visible, but the true business value is opaque or diffuse.

Take mobile telephony as an example. Those responsible for telecommunications in most organisations have a pretty good idea of how large their total phone bills are and can see how much certain elements, for example mobile calls, are growing by. This makes it an easy target area for swingeing budget cuts. According to recent Quocirca research, around a half of companies are not seeing mobile spending falling in line with tariff reductions. Telecoms managers can also see who the worst offenders are, as over two thirds believe they have sufficient accuracy and detail to know ‘how much' and ‘who spends what' from itemised charges on a mobile phone bill—what they don't know is ‘why?'.

This piece of information is critical, because not only does it provide an indication of what value might be being gained, it also offers some intelligence that could be used to decide if it is possible to find an alternative, so that the value can be retained while the cost reduced.

Businesses obtain significant value from voice communication, and the mobile phone has become a primary tool for delivering this, ensuring that people can be reached when away from their desk. Decisions can be made faster, avoiding costly delays, and improving responsiveness. Individuals are able to make use of previously dead time, hopefully either improving their personal productivity and taking control of their work/life balance, or perhaps just as likely staying in touch friends or relatives.

Making mobile calls while in an office with perhaps a lower cost fixed phone nearby is of more questionable value, but something that many employees will do. Why? Because it is more convenient and generally the desired contact numbers are already in the phone and just a click away. There's also the flexibility of being able to start a call while sat at a desk but not having to hang up and call back when other demands make it necessary to get up and move, say to head off to a meeting, or to go home.

If the call is important, mobile flexibility means it does not need to be curtailed, promoting value over cost. What is the value of a lost opportunity when a salesperson is unable to make a mobile call because of penny pinching, or the loss of loyalty when a rapid response to a customer can not be made because the person needing to call is out of the country? The reason for the call is more relevant than its length or distance.

However not all calls are that instantly vital. They may simply be being made because it is all too easy to call a contact out of the address book or click to return a missed call. Employees are so familiar with using a mobile phone as consumers that they would rarely think twice about the cost of making calls from a business supplied mobile phone. Other alternatives—an email, instant message or text message—may be seen by the employee as too awkward to use, are not encouraged by their employer or are not available because of the devices or services currently being supplied.

These alternatives can only be pursued with appropriate knowledge of ‘why', and this requires an appraisal of the impact of current usage by line managers and the individual affected employees. This awareness encourages personal responsibility among employees, perhaps making them think twice about too many personal or unnecessary calls, and allows managers to make business oriented decisions balancing value with cost.

There is also a need to understand outside influences, such as the viability of other services, a comparison of current tariff options and best practices in place elsewhere. This is where a good telecoms manager, either on their own or with external specialised help, can provide more effective support to users than simply an itemised bill and a budget squeeze.

The business value of mobile telephony stems from the importance and timeliness of making contact there and then, coupled with the convenience of how contact is made. If companies take too simplistic a view to cutting costs of mobile telecoms that means cutting usage or users. They may of course be able to negotiate a better deal with a supplier, but according to the same research, even with falling tariffs, for most companies mobile bills are still rising. Convenience, timeliness and perhaps over familiarity are driving up the demands for usage and the number of users.

Companies have to be more effective to continue to get good value out of advanced communications, and use other tools to help manage telecoms budgets than just an axe. To look in more detail at obtaining value from telecoms, download this free report from the Quocirca website, "Total telecoms expense management".

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 22nd April 2008 Copyright Quocirca © 2008

The importance of assessing and measuring records management policy and the subsequent procedures used has been thrown into sharp relief by the disaster that last year befell the UK's Revenue and Customs organisation. The personal records of 25 million of the UK population were sent protected only by a password in an internal postal system, and lost.

It's bad enough that it happened at least once, but worse still to think that organisations get away with bad procedures for some time, before only a combination of circumstances cause them to be revealed. Even if the strategic policy is robust, when a system breaks down in the implementation of the policy, its effectiveness isn't being correctly measured.

Organisations need to know how their systems and processes are performing—well or badly—before any fallibilities are exposed with potentially far more catastrophic results. There is also the more basic and straightforward reason for checking—having invested in a records management system, is it providing good value?

Most organisations will have justified the expenditure on some combination of expected benefits—strategic and tactical. In both cases, they need to know if these benefits are being realised and must put some form of measurement and benchmarking systems in place.

There are two main drivers for this. The first is to demonstrate the short term benefits to stakeholders to show where the investment has been a success, and where there needs to be changes or enhancements based on lessons learned. It should not just be a set of check boxes as part of the project review and seen by only a few, but a broad internal presentation of current and expected progress. This should have been set out as a main part of the initial plan, and have straightforward measurement criteria set against each benefit, including:

• improved productivity
• competitive gains
• costs savings
• reductions in storage space
• better workflow

The second reason for measurement is for the longer term, more strategic or indirect benefits that need to be enhanced and protected. This includes those that might form part of an external vision or message, both for ongoing present promotion, but also for defence in the event of some future failure. These benefits are harder to quantify, but should also have been outlined from the beginning:

• image or brand value
• the need to meet statutory requirements
• enhanced knowledge management
• improved customer service
• business resilience or disaster recovery

How should an organisation start to quantify what they might need to measure in their records management projects? Well there are established standards to address this, such as ISO 15489, which covers plenty of ground in addition to providing a benchmark for best practice.

ISO 15489 is about the entire approach, methodology and processes for ensuring that an organisation's records are properly managed and made usable and accessible throughout their lifecycle. For the sake of external validation and verification, the standard also ensures that critical stages, such as final disposal, are carried out in an open and transparent manner and according to pre-determined criteria. This is particularly important where there are regulatory or data protection requirements from legislation.

The value of measurement is not only for the benefit of external stakeholders. Improvements made in information access and workflow can have a huge impact on individuals, both in terms of their effectiveness and their job satisfaction. Office workers can waste many hours searching for badly labelled, badly filed or simply ‘mislaid' records, which eats into their time and morale. So as part of the introduction of new procedures and systems, the personal benefits can be identified, and then captured over time to show even the most reluctant individuals and, perhaps, more importantly, their industrial relations representatives, that improvements are being generated for both organisation and individual.

Tackling measurement from an early stage can also help if a project is struggling to obtain sufficient management resources by identifying some early success stories. If some of the expected benefits have not been achieved there will be a need to look for reasons and seek to overcome them so that later phases can be directed to address the shortfall.

However, it is best not to over-rely on measurement, and more useful to measure what is important, rather than making important what it is often too easy to measure. Always feed back good news items with reasons as to why they have happened and how they will be capitalised upon, but don't shy away from making clear where there are problems, and what corrective action will need to be undertaken.

Finally, if internal measurement or external exposure in the media highlights major flaws, take prompt action to tighten up procedures and communicate them so that all staff understand why processes have become more restrictive. These can always be relaxed later, but everyone needs to know that the organisation takes its records management seriously and effectively measures how well it is being performed. No one wants to discover inadequacies after a public failure—just ask the UK's Revenue and Customs, or any of the other large organisations that have recently inadvertantly hit the media.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 18th April 2008 Copyright Quocirca © 2008

There is no doubt that many markets are facing challenging or at least uncertain times. Those predicting a falling market are known as "bears" and are often thought of as pessimistic. The term is thought to originate from the inverse of the concept of "don't sell the bearskin before you've killed the bear", known in trading circles as selling short. The other strategy in bear markets is to stay away, but that's not possible if you want to keep a company in business in a bear-ish economy.

A hunting story might indicate a better direction to take in a falling market. Two hunters out tracking bears suddenly encounter one and realise they have no ammunition for their guns. While the first hurriedly tries to drop rucksack and surplus weight, the second stops to put on running shoes. "You won't outrun the bear in those" says the first. "No, but I'll outrun you" is the reply.

In almost all industries except the stock market and gambling, the object is to stay ahead of the other participants, not the market itself. When times are hard, it's better to be more competitive than simply slashing budgets. This is particularly true in the area of telecommunications where companies have put useful or even vital tools in the hand of employees, only to now apparently say, use fewer of them and less often.

These capabilities were put in place for valid reasons, such as making the company more flexible, more customer-centric and competitive, or enabling employees to be more responsive, efficient and effective. So why would any company want to compromise these advantages by adopting blanket restrictions that might just put it in the jaws of the bear?

Communications costs are an easy target. They spread right across the organisation, can be identified to an individual, have been seen as growing rapidly in recent years and there is a general undercurrent feeling that the organisation is subsidising inappropriate personal, as well as legitimate business, use. Not only does that raise an issue of potentially avoidable expense, it also brings in both personal and corporate taxation, most especially VAT.

Applying swingeing cuts across the board might seem right the right thing to do as it appears to be evenly unfair to everyone, but it doesn't tackle root causes and runs the risk of disabling functions that are important to the business. There are, however, a number of things that organisations can do to try to outrun the competition:

• First decide on policy. Will employees be charged for personal phone calls and will they have to pay for their broadband at home when it's partly used for business? What sort of restrictions will there be on making international calls, accessing the internet from the office, using Wi-Fi on laptops, or using premium rate services? Any or all of these may be supported by some technology, but first the rules have to be decided, then made clear to everyone, then enforced.
• Converge thinking on communications. Different technologies, mobile phones, desk phones, landlines, laptops with datacards—historically may have been the responsibility of different groups or individuals in IT, procurement, finance and facilities. Move the overall responsibility into one place, so that decisions are more strategic and less territorial. The technology is converging, so apply the same attitude to budgets.
• Find out what is already in use. Do a proper audit of the telecoms estate, and if internal resources or skills are in short supply, get outside help. Make sure this is not a one off exercise, as the portfolio of assets shifts as employees leave the company, or new services and suppliers are brought in. Mind the gaps and don't pay for things that are necessary or people who have left.
• Face up to personal usage. Measure it, manage it and bill for it. It not only does employees good to see and agree what they've used, it also makes managers able to sign it off as appropriate and allows the company to verify the suppliers bills are correct. Errors frequently occur, for many innocuous reasons.
• Take a longer view than simply negotiating a better deal with each supplier in turn. That only provides a short term boost to the budget, but doesn't address underlying issues or costs that could be avoided. The longer term view also has to take into account the broader goals and needs of the business, rather than the pressure on one individual to squeeze a budget to hit an objective.

Companies need to put in a little effort to optimise their current spending on communications and avoid unnecessary future expense. Rather than simply lightening their loads, they need to invest wisely on ways to be nimble. To look in more detail at obtaining value from telecoms, download this free report from the Quocirca website, "Total telecoms expense management".

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 15th April 2008 Copyright Quocirca © 2008

No, not a prediction for the winner of the next UK Grand National horse race (this year it was ‘Comply or Die' who won), but a siren call across the IT and communications industry for ‘Unified Communications'. So is it just the buzzword du jour, the latest bandwagon to jump on, the current trend being peddled around hype cycles, or is there something real and tangible for businesses to gain benefits from?

One thing's for certain, there are now more options for connecting people than ever before—fixed, mobile, rich media, and social as well as business networking—providing more opportunities for communication to be dis-unified rather than unified. Too many points of contact, or ways to go ‘on hold', coupled with multiple repositories for either typed or spoken missed messages makes life complicated for the user. A collision of IT and telecoms around IP is bearing down on the capacities of enterprise and service provider networks trying to run voice, video and regular business applications at acceptable service levels.

Add to the mix an uncertain economic landscape and an increasing pressure to bear down on costs. IT and telecoms has often been seen as an expensive business ‘investment' and, with new services and increasingly mobile workforces, many businesses are seeing their communications costs grow, even when supplier tariffs are shrinking.

So why invest now in unified communications?

Better to ask, what to invest in as we move along a path towards unifying our communications. This shouldn't be seen as a big bang—one day we're all over the place, next we're unified thanks to product ‘x'. First it's necessary to see what unified communications is, and see how this concept and the technologies it comprises might fit into the current and future needs of the business.

One important component has been voice over IP (VoIP), not as a technology or series of technologies per se, but as part of the transition from thinking as voice telephony as a separate service requiring its own dedicated network and endpoints, to becoming JANA (just another network application). Of course it needs its own services in the network to ensure quality and provide security, but it is a communication component, not a discrete channel.

VoIP is also important because it generated the idea of saving money by converging networks and coalescing or sharing endpoints, and running the phone system parasitically on the back of an existing data network. The reality is more complex, as many early VoIP adopters have found out. Simply throwing VoIP phones onto data networks, bashing connection capabilities together into softphones and letting the network cope just won't deliver the real benefits. The network will wilt, quality of service will falter, or if really unlucky will fall over, and users will still have a confusing array of options, often making the mobile phone look the simplest, if most expensive, way to contact someone.

The interest in unified communications might be about a desire to save money over time, but crucially it has to make the business more effective and individuals more productive in the short term. There are three levels to address when considering how much and what to unify—people, processes and plumbing. People need to be in control, the processes need to be collaborative and the plumbing needs to converge.

Why do people need to be in control? Mainly to improve their time management, avoid unnecessary interruptions and get hold of people when they really need to. It's about controlling and managing a digital workflow increasingly spread across geographic and organisational boundaries. The working processes are increasingly complex and convoluted creating an opportunity for collaboration. The cornerstone for the value that unified communications can offer is an awareness of the state and availability of those being contacted. This is summed up by the term ‘presence', which is familiar to instant messaging users as the current indicator of the state of their buddy list, but for a unified set of communications tools for an entire business, this becomes the context-aware corporate directory.

While fully integrated and federated presence delivers a powerful tool, how it is used from a social and interpersonal level is critical to whether it successfully delivers. Organisational processes and personal prowess mean that training on soft skills is more important than the technical skills of how to use the tools. This is part of the roadmap to unified communications—identifying personal and organisational efficiency.

The other major part of the roadmap which can be developed in isolation from the people and process improvements is the convergence required in the plumbing. However too many companies focus too much on this as a simply a set of technology innovations and initiatives. The technology is important, but rather than concentrating purely on innovative communication products, more attention needs to be placed on convergence of other aspects, such as the financial management and organisational responsibility.

That means taking a different view to managing costs and charge backs to users. The budgets for the varied telephony and IT services being combined will sometimes have been managed in very different parts of the organisation—facilities, IT, procurement. The converged infrastructure required for unifying communications needs to be justified at a strategic level in the organisation, and this means converging budgets and lines of responsibility before converged technologies can start to pay dividends.

Access, communications tools and services can be dealt with separately from a commercial control perspective, with the IT infrastructure and department essentially becoming a communications service provider to the rest of the business.

Want to be successful with unified communications? Drop the narrow focus on the technology and think about how people and processes will need to evolve, and how to commercially separate plumbing from service so that the infrastructure specification isn't compromised, and services are justifiable and of real benefit for the business.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 2nd April 2008 Copyright Quocirca © 2008

Big news. A state of the art, high tech system aimed at saving time and improving efficiency is launched fully live into a critical environment to a waiting public with instant worldwide media audience in attendance, and fails.

This month's debacle was the British Airways' / British Airport Authority's flagship, £4.3billion development of Heathrow's Terminal 5. But sadly that first sentence could have been directed at many systems in many different institutions in many different industries. Whether for baggage processing, hanging on to the population's personal data or the monitoring of banks with aggressive business models—each has a business process where IT systems now play a crucial part. It's not quite the level of mission or safety criticality required to keep aircraft aloft or nuclear power stations from overheating, but IT in general is tightly interwoven into the businesses processes. They share a common dependency that is symbiotic, no longer parasitic.

So the first culprit to be suspected will be the IT system. Was it too new? Was it tested to be safe/secure/robust? Then the techno-quasi-religious battle lines will be drawn. The Java fans will say it was the use of clunky old mainframes and flaky desktop operating systems. The open source community will bemoan the adoption of proprietary closed software architectures, and the proponents of those traditional platforms will blame the overly trendy Web2.0 generation with a dismissive ‘web-two-dot-oh-dear-me'.

There may be problems with some of the technology decisions and perhaps some of the solutions weren't as perfect as they'd been presented in slideware or in the response to tender. No IT system is perfect; bugs in software and hardware failures always occur at some point, usually when most inconvenient, and there is always a risk that technology doesn't get used according to the manual.

Therefore the next culprit will be the unfortunate individual at the coal face. The handlers didn't operate the machines properly, some office junior copied a disc they shouldn't have, someone at the call centre mis-keyed in the data or somebody didn't bother to take the train as far as Newcastle. These people are easy to blame, after all they probably did something wrong, usually accidentally or with no malice aforethought, and they are often easy to track down and cheap to fire. Job done?

Well not really. So how about making ‘heads roll' in top management? They congratulated themselves when the new project was announced, were visible early on the day it was launched, and managed to give themselves a huge bonus for their efforts—surely they are at fault? Well they may be, but not directly, and getting rid of one chinless big cheese still doesn't fix the problem, even if it does make the media and general public feel better that the blame was lain somewhere.

None of these address the systemic problem that has occurred. The term systemic is cropping up with increasing regularity whether talking about the banking industry, power transmission, transport, IP networks—in fact, any large project. It refers to the overall total system which includes the technology or physical assets, the people involved and, most critically of all, the processes that link it all together. Systems are now far more highly connected with unimpeded transmission of information across the technology and so many methods of instant communication between individuals.

People making considered and well informed decisions act as the ‘dampers' or shock absorbers in highly connected systems, but an over reliance on people has become increasingly expensive—salaries, benefits and expectations rising—and since collaborative technology has allowed organisations to flatten, something has been lost. Not simply superfluous workers and flabby layers of middle management, but vital intelligence about the business process and the ability to deal with problems on the fly, including how to take decisive action in the event of the unexpected combination of error conditions.

Over confidence or reliance on the technology leads to uncontained and escalating failures when things inevitably go wrong in highly connected environments. Historically, organisations have employed professionals who blended business process experience with sufficient IT knowledge to build effective processes and systems that were then supported by, not blindly dependent upon, IT. Today, a combination of off-the-shelf, rather than tailored ‘solutions', flatter organisations and less empowerment or less willingness to take risks in the middle layers of larger businesses and institutions is becoming a systemic problem as the shock absorbers have gone. The technology looks good, the people work hard, but it is not enough to bring stability in large and complex systems. Companies and large institutions have to find a way of re-applying control and vibration theory to their increasingly over-flexible, but under protected, major projects.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 4th March 2008 Copyright Quocirca © 2008

The old joke about the office worker who says to their partner when they get home at the end of the day: "the computers went down and we all had to think for ourselves" is getting too close for comfort.

As the mobile industry started its grand annual event in Barcelona—Mobile World Congress—a breakdown in the BlackBerry email service meant that many thumb weary executives had a break from their mobile email habit.

The device is often known informally as the ‘CrackBerry’, but the reliance on frequent hits of email and the subsequent cold turkey of withdrawal are very serious for many. This latest breakdown impacting North America, the second in less than 12 months to be caused apparently by the same problem—a system upgrade in the network operations centre in Canada—lasted for almost 3 hours. As the number of mobile email users has grown rapidly in recent years alongside their increasing dependency, the impact of any loss of service is greatly magnified, and felt in several quarters.

Take the hard-pressed IT manager for a start. The almost continuous operation of IT systems is taken as a given in many organisations.

When IT applications decentralised onto the PC, there was a time when the office desktop was mostly autonomous and independent in operation from the network, and intermittent service may not even have been noticed. Open standards and universal connectivity have now rendered the network critical and visible to almost any application. This is especially the case with email and, in particular, mobile email. Many an executive has assessed IT departmental efficiency based on whether or not they are receiving emails on their BlackBerry. Faults like this recent one are outside of an IT manager's control, but no doubt they will still be the focus of blame from users.

Then there's the recipient of those emails that the BlackBerry wielder has shot from the hip—literally and figuratively—with insufficient screen real estate for broad viewing, time for consideration, or a "real" keyboard for a response that might be misinterpreted. The only caveat is the sender's apologetic (or boastful?) signature line of "sent from my BlackBerry". These ‘stationary’ (as opposed to mobile) recipients put up with the constant drip of terse one liners from users who are unconcerned that their idle moments might not correspond with their colleagues', thus distracting or interrupting the working pattern of the recipient. One can only imagine the flood of pent up message/reply demand after a service outage is fixed.

Finally there is the impact of the outage on the BlackBerry user. Many complain about not being able to switch it off and the expectation from others that they are always contactable. It's becoming quite common to take a BlackBerry on vacation and some, no doubt, to bed. Of course the user would argue they are more responsive, with decisions being made in real time and customers or other external parties more involved in the process. The question is, are those quick responses the right ones or best ones in all situations? Are CrackBerry addicts running the risk of losing the ability to discern the difference between "Important" and "Urgent"? These abilities are tested to the limit when the user is deprived of a service they have come to heavily rely on.

The answer lies not in faults with the core technology, or, save the odd system wide crash or other, in the implementation. It lies primarily in the ways in which people are managed—mobile users and their more ‘stationary’ peers—and what expectations are set. Getting these right is not only going to benefit the BlackBerry-wielding executives, but also the wider workforce as they all become increasingly mobile. As more applications become network accessible and relied upon by mobile workers and their use becomes embedded in critical business processes, it will become even more vital to understand how the technology use intersects with the working practices and business processes of both individuals and the organisation.

Technology, in particular personal communications technology, should support, improve and extend established working processes, rather than trying to invent brand new ones. That's not to say it is impossible to create new processes, but it does require a wider, more strategic, business process re-engineering assessment to take place, and most mobile deployments are tactically driven. Quocirca research has shown that around a quarter of large European companies will retro-fit a strategy after making mobile deployments, a figure that has remained consistent for several years.

As part of the supporting, improving and extending of established processes, those using the technology need sufficient guidance to make the best use of what it can offer, without being sucked into bad habits or behaviour their colleagues may regard as anti-social—in short, good mobile netiquette.

In the days of LOL and L33T (text, chat or hacker-speak in these cases for ‘laughing out loud’ and ‘elite’) it might seem somewhat quaint to think about etiquette and the art of effective communication, but from a business perspective it is critical. Not only so that mobile workers and their colleagues do not feel as if they are being unnecessarily overloaded, but also to deliver on the main business benefit of mobility—productivity. Individual responsiveness is all well and good, but the final measure of productivity is on the corporate bottom line, which takes into account everybody—mobile user, stationary colleagues and IT manager.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clay Ryder, President, Sageza Group, Inc. Posted: 4th February 2008 Copyright Sageza Group, Inc. © 2008

HP has recently announced a collection of virtualization and power management technologies that are designed to help customers streamline IT operations, realize cost savings, increase flexibility and improve energy efficiency.

The HP Virtual Connect Enterprise Manager extends the capability of HP BladeSystem Virtual Connect technology to all blade enclosures in a data center. The new Enterprise Manager enables IT administrators to manage and control these connections across 100 c-Class enclosures, or up to 1,600 blade servers, from a single console. The new HP Server Migration Pack Universal Edition combines virtual and physical migrations into a single tool to speed migration time of HP ProLiant and BladeSystem servers. The Management Pack provides central management with expected support of Citrix XenServer, Microsoft virtual machines, Oracle VM, and VMware. HP PolyServe Software for Microsoft SQL Server consolidates large SQL environments onto a single cluster so customers can manage all instances at once, freely add and recover multiple instances, and roll out business applications more quickly while improving reliability. HP stated that it plans to integrate the Opsware Automation Platform with its existing management solutions for future automation of data center capabilities across the full software stack.

Also included in the announcement is the new HP Power Distribution Rack, which controls three-phase power distribution across a row of server racks. The offering allows IT managers to connect to power once across a row of server racks and adapt power distribution as needed; prevent overloads and resolve problems quickly with HP Thermal Logic technology; and reduce cabling complexity with one set of input cables to the end of a row and short power drops to each rack. According to the company, the new HP Rackmountable Parallel 3 Phase UPS provides the highest level of power protection from HP and dissipates less than half as much heat as competitive offerings. It enables attached servers to save all work in progress and initiate a shutdown in the event of power loss, and restores it with Thermal Logic power policies.

The new technologies in this announcement are actually rather useful for the intended audience. The Virtual Connect Enterprise Manager offers a considerable range of control over many hundreds of servers from a single console, which is the kind of control that IT managers tend to favor. Likewise, the Server Migration Pack Universal Edition offers another desirable capability, namely the ability to handle virtual and physical servers in the same fashion with the same tool. Further bolstering its power-aware position, HP Power Distribution Rack brings enhanced flexibility to IT personnel who are seeking to place power where it is needed, but without over provisioning or otherwise wasting the precious resource. According to the company, the new 3 Phase UPS can save $1,000+ annually in power and cooling costs in the 12-kilowatt rack-mount model and $6,000+ for the 60-kilowatt row-level configuration. These numbers are impressive and are worthy of PR attention. Overall, we see these new offerings as valuable assets for data center managers. So what's the rub?

What's troubling about this announcement is not the technology, nor the vision of the company, but rather the seeming need by the company to promote a larger-than-necessary aura around everything HP. These announcements were part of a long press release from HP that covered a litany of existing and new product offerings. At first glance, one might be tempted to view this as merely undifferentiated verbiage about blades and energy efficiency in the data center. However, there were new product details buried in the announcement, and it is unfortunate that clarity may have been sacrificed by the company's perceived need to be seen as larger and omnipotent than the competition.

HP clearly remains an engineering-focused firm, and arguably this is one of its strengths. So too is its ability to create well rounded solutions that transcend a mere collection of point products. Yet at times the company's messaging can become so focused on bolstering its position (declaring itself King of the Hill) that it loses the ability to let its products speak for themselves.

In an era where the totality of the product, solution and services is paramount, at first glance this messaging approach would seem sound; however, it can also come across as obsessive, if not paranoid. To our way of thinking, removing the aura of grandeur often results in a grander and more honest position than the puffed up alternative. Further, the clarity of what is being offered, and its value, is enhanced.

HP has extensive, credible credentials in the blade and energy efficiency arena. We only wish that the firm would at times realize it is often best to state simply and plainly what's new and exciting and leave the extracurricular PR fluff behind. This would make it easier for their customers and business partners to immediately glean the considerable value the company can impart, while also delivering a more confident and down-to-home feeling to an important player in the IT marketplace.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clay Ryder (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 28th January 2008 Copyright Quocirca © 2008

Managing information is always a challenge. When it's locked inside an individual's head—arguably information mobility in its most basic form—teasing it out and sharing it for the benefit of many rather than the power and influence of one has often proved difficult.

The problem now is quite the reverse. There is such a variety and scope of information, not only the core records that IT systems have captured over the years, but almost anything and everything else has been digitised: images, sounds and video, location and identity tagging, and behavioural data from supermarket shoppers to telephone call records. This is great for data mining and analysis, but the sheer volume of data poses many challenges.

For many it's not, however, a problem of storage capacity—how?—but one of access and discovery—where?—and of containment or security. Storage capabilities have increased dramatically, essentially outstripping the amount of data that has to be stored, not just at the large volume, heavy end of data centre storage systems, but at what could be termed the tiny end of storage.

By this we mean the explosion of finger sized memory sticks with one or more gigabytes capacity and portable hard drives the size of a deck of cards holding hundreds of gigabytes. Added to this almost every mobile device from mobile phones to cameras is capable of storing not only its own internal data, but also of acting as an external mobile storage facility.

As information can then become more mobile, keeping it under control is a challenge. Once, taking work home from the office meant risking carrying a stack of papers containing kilobytes of information. In those days, a select few might be permitted to take some files on a laptop, but now almost anyone could carry a bank's entire customer database in their pocket. As more information is condensed into smaller physical spaces, its value is no longer diluted but distilled, and the risks increase.

According to Quocirca research, loss of data through theft or the mislaying of some form of mobile device—laptop, handheld, phone or memory stick—is seen as a greater issue than the problems caused by viruses or the potential for breaches in access security. This should be no great surprise, but the underlying fears over this loss need to be addressed, as employees and businesses are unlikely to give up the flexibility that mobility brings to their working lives.

The first issue to consider is the shift from perimeter and barrier protection to a shrinking bubble of defences applied directly and proportionately to vulnerable items. In this case, anything that may travel outside the physical confines of the organisation is potentially vulnerable and needs a level of protection. This does not mean a blanket approach of, say, encrypting everything inside the IT system just in case, but neither does it mean assuming that just because private customer accounts should stay in the building that they will.

A realistic approach to the value, vulnerability and secrecy of various types of information has to be taken, assessing who needs access to what, when and how. It is not enough to ensure that employees will ‘do the right thing', as even the most trusted may make mistakes or fall foul of faults in hardware, software and networks, or inadequacies in business processes. The simple guidance should be, the more valuable the information—where value means not only the value of having it, but also the cost of losing it—the more stringent, complete and discrete the protection should be.

The relationship between the individual and the technology raises the next issue to address, as the small size and simplicity of use of mobile devices mean they are prone to abuse—either deliberately or accidentally.

Firstly, it is easier than ever to bring a small device into the organisation—whether legitimately or not—transfer information onto it and take it elsewhere. This means organisations should take greater care with access to traditional fixed IT systems and PCs, and should consider products to protect, or at least detect, when external devices are used and, if necessary, only permit the use of corporate sanctioned and managed devices. This might disappoint the increasingly technology aware consumer-as-employee who wants to use their own better or more convenient technology. However, the organisation has to balance these wishes against protecting its assets.

Outside its perimeters, an organisation is far more dependent upon the diligence of the employee to protect and look after the mobile assets in their care. All too often this is a little lax and, according to Quocirca research, some IT managers would characterise user behaviour as ‘irresponsible' as they lose, leave or forget laptops, BlackBerries and mobile phones in taxis, coffee shops, bars and hotels. This is difficult to stop entirely so, as far as possible, protection has to be applied automatically. Beyond that, part of any security policy has to include educating users of their responsibilities and the consequences of their mistakes.

Overall, the diversity and flexibility of many technologies makes the management of securing information against device loss, or leakage through vulnerable points of access, a far harder challenge. More than ever before, those tasked with applying and managing security policies need tools that streamline the processes and blur the distinctions between different devices, storage systems and access methods, to ensure that common and consistent rules apply to data wherever they are used inside or beyond the organisation.

These principles apply even to organisations that do not condone or provide mobile tools or remote access to their information. The accessibility of consumer technology in terms of price, capability and ease of use means the physical barriers can no longer be relied upon to safeguard an organisation's information, so the focus has to be placed directly on the valuable data and on those who use it.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 25th January 2008 Copyright Quocirca © 2008

All organisations depend on safe, reliable and secure storage of their digital records, but the challenge of securing this information is becoming more difficult due to expansive global networks, more users and increased data portability and mobility. This internetworking means that physical and logical perimeters around the organisation no longer apply, so the security of applications, the end points of access and the data itself needs to be taken even more seriously and become more fine grained—focused directly around the items being secured.

In addition, despite the melting away of the perimeter, the security risks for all organisations have always been from internal as well as external sources. These can come from the deliberate or accidental acts of employees, or weaknesses in business processes. External threats vary from those that threaten the resilience of the business—terrorism, weather disruption or communications breakdown—where records might still be ‘lost', to those that are malicious or deliberate acts for financial gain, sabotage, notoriety or a prank—stealing, spying and hacking.

Whether as a result of an accident or deliberate act, the end result is that data has leaked outside the organisation, with potentially disastrous consequences. Some accidental data loss may appear to only necessitate a simple short term cost to repair or recreate, but could have further negative impact on corporate image or increased regulatory scrutiny in the longer term. Deliberate acts are likely to have far more direct consequences to actual data and the concern that it may have fallen into the wrong hands, but the accidental leaks are more likely to cause indirect consequences, such as damage to a brand.

The first objective in mitigating internal or external vulnerabilities is to define which particular resources need to be protected the most, and identify the range of threats they face so that appropriate measures can be put in place. It is important to distinguish between information that is critical or sensitive—for example customer, patient or accounting records—and information that is simply a collection of public knowledge. Somewhere in between lays general purpose internal information, such as emails, where content may vary from mundane to secret and care needs to be taken to ensure suitable protection is in place.

While the organisation's physical perimeter could at one time be relied upon to provide a level of protection, the use of open networks like the internet, wireless and public cellular networks, mobile devices and tiny high capacity storage devices mean this is no longer the case. Information can be detected and snooped while travelling over these networks and small smart devices are highly vulnerable to loss or theft. Organisations now have to focus their security efforts on specific resources—the applications/databases, end devices used for access, the users and the records themselves.

Those with access to managed information need to understand how and why the information is being protected, and their role in ensuring it is kept secure. The onus is then on the organisation to keep security processes as simple as possible to accomplish the level of security required. This means identifying where security needs to be tight, and where it can be relaxed, and to distinguish how policy or controls should be applied. If the organisation is providing tools that can offer more security, users need to be fully educated in the effective use, and must appreciate the consequences of incorrect actions. The best way to set this out is as follows:

• Start with a pragmatic and granular security policy based on business needs. This should follow good common business sense that can be easily justified as a means of protecting the organisation's assets, but still operating to fit within day to day working practices.
• Engage users with consultation, not prescription. Any policy must be well communicated throughout the organisation and delivered using well understood business procedures. Involving users early will generate trust and encourage responsible behaviour in return. They need to appreciate any security challenges faced, understand the measures being put in place to tackle them, and how they play their part.
• Automate procedures with technology where possible. If the policy dictates the use of strong passwords, encourage or compel users to change these regularly, and have systems automatically refuse passwords that are too short or simple. Anti-malware and firewall protection must be installed on every device and updated regularly, but it is important to make sure that these products themselves do not render the very devices they are there to protect unusable—so choose carefully. Known risk areas such as mobile devices must be properly configured by default and before deployment.
• Train users before, support during. Run comprehensive training, use workshops and user participation to establish best practices and etiquette that everyone can buy into. From then on ensure users are kept informed and updated with any changes and that they have a simple and straightforward route for getting support in the event of a security problem. One number to call, one website to visit, one email address for support.
• Strictly enforce policy to show they are important. Policies must have consequences to be effective, and there are times when rules must be enforced. These must be clear and understood from the outset, so that violators are not surprised. As with any form of disciplinary practice, enforcement should scale according to severity and frequency of the problem.

Records management security is not something that should be buried deep in the IT department, or seen as an arcane art, but as a set of business principles with the intention of ensuring efficient and safe functioning of business processes. Just as all individuals play their part in their respective business processes, so they all play a part in ensuring security.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 23rd January 2008 Copyright Quocirca © 2008

The internet has already had a massive impact on the way we access and distribute information as public websites led to intranets and all sorts of web enabled applications, but it has also started to change the process of collecting, creating and contributing to documents, files and records.

This should not be a surprise as many of the internet tools have a concept of shared interaction at their roots, and the original idea that Sir Tim Berners-Lee had for a web server was a collaborative way of building information and records. What is surprising is that it took so long for the rest of the internet community to catch up and largely this has now happened because of the creation of simple to use models and their supporting tools for non-technical users to generate their own content. Not by creating or editing web pages per se, but by working on information in forms they can understand—using constructs such as diaries and encyclopaedia, and environments such as golf clubhouses, market squares, bars etc.

Being the internet, a whole new ‘paradigm shift' in nomenclature had to occur, so these models are re-branded under the Web 2.0 banner as blogs and wikis and the umbrella term for all online gathering places—social networking. These concepts have swept the consumer and professional space rapidly with millions of people blogging and participating in social web sites. The basic process behind all this is to publish content to a large group for comment, with the hope and expectation of finding skills and knowledge beyond that immediately available to the publisher or their direct contacts.

The idea of wikis, in particular—shared access, shared edit, record entries—is an interesting way for organisations to manage, update and disseminate information, but steps have to be taken to ensure it provides an accurate picture. While blogging and entries on social websites generally reflect more personally held views, wikis encourage multiple participation and collaboration. They are relatively self regulating which tends to amortise the personal and oft times biased opinions of individual into a wider ‘group think'.

Like many self regulating systems, continued growth will depend on tools that make usage and access simpler, yet allow procedures to maintain some form of control. Many tools are appearing in the consumer market but most will not survive or translate well into the commercial world. For many organisations, the pace of the consumer market causes problems in the selection of tools for business use, especially if employees feel externally available tools are better than those provided by their own IT department.

Even if they want to embrace the new opportunit