Thinking Tech

I've been pointing out for several years that any wireless device could be a potential security risk. Take the venerable Palm, for example. The infrared connection that's available to transfer information is a potential risk.

Forget about the potential for hacking or tricky programming techniques (those are a possiblity, of course), but forget about them. Suppose this: you're at lunch with a salesperson. You need to take a Bio break, and you leave your Palm on the table. While you're gone, the salesperson grabs your Palm and starts a transfer. By the time you're back, they've got your entire contact list.

So it's not too surprising that Blackberry is vulnerable. So, too, is Treo, and all the other devices. All it takes is for someone to get the idea that the data that's available on a device is worth getting. They'll figure out a way.

Security Watch - Exploits and Attacks - Cracking the BlackBerry with a $100 Key

I'm not sure that anti-virus will die quietly, but Gartner is saying it's dead. There are some real issues here that you should stay aware of. Businesses will need to make sure that they keep track of the emerging market in anti-virus and security.

The concept is good...security needs to be integrated across the enterprise. How this will play out in actual products is another question entirely.

Security Watch - Virus and Spyware - Anti-Virus is Dead, d-e-a-d, Dead!

Here's an interesting thought. Did you know that the date daylight savings time changes will change in 2007 for the first time since 1966? And have you thought about the fact that your computer (if you turned on the feature to automatically update the time) will need an update to do this correctly? It will.

Oh well, so twice a year, the time will be wrong. At least it's better than the clock on my mantle...it's exactly right only twice a day.

Daylight Saving Time - When do we change our clocks?

Please, please say it ain't so! Surely no one would hack a computer and risk jail for Chester Bennington's cell phone records. But evidently, someone did.

Am I showing my age if I ask what Linkin Park is?

Feds: Linkin Park fan hacks phone data - Yahoo! News

You may have read that Microsoft launched Windows Vista, Office 2007, and Exchange 2007 simultaneously last week. Microsoft also has about 30 more products that will launch during 2007, including version 5.0 of Dynamics NAV (had to backspace and change that from Navision...old habits die hard.), and several of their other upgrades to Dynamics products.

All of this is a good thing, I think. Office 2007 has a great new look, the first substantial makeover in the history of the product. I've been using it for about 3 months now, and have forced it on unsuspecting users of my home office computer (my family). All of them have adapted well--in fact, they haven't mentioned it at all, not one complaint (and--believe me--that's unusual). I think end users will like it equally well.

But all of this isn't the issue...I have MS Office 2007 because it comes FREE with one of several subscriptions I get with my Partner Program membership (which, believe me, isn't free at all). So, as long as I've got it, might as well use it.

What about your business? Should you spend the (probably substantial for any business) dollars to upgrade? Should you do it now? Should you wait? How should you decide anyway.

I'm an old business strategy guy. I believe in things like ROI and internal rate of return (IRR). So my answer is pretty simple.

Bottom line.

Not bottom line "colon" as in "Bottom line:" followed by an explanation of what for me is the Bottom line. The bottom line--as in the bottom line on the income statement--is the BOTTOM LINE.

If upgrading to the new version of Office and Exchange and Vista makes you money, your business should upgrade. If not, you shouldn't.

Bottom line.

My take on the new products? I imagine DGG will be upgrading as soon as all of our software is fully compatible with the new releases, and as soon as we can move data to the new release. For MOST clients, at least the Office upgrades will be significant if they are heavy users of the products. Outlook has some significant productivity enhancements as do Word, Excel, and Powerpoint.

But of course, you'll have to evaluate for yourself. Might be a good time to get started. And--by the way--this isn't just a job for the IT staff. Administrative Assistants, Controllers, Bookkeepers and Accountants also need to be involved.

And that...dear readers...is the bottom line.

Suppose you've been reading this blog and others, and you've decided to upgrade your information on security vulnerabilities. So you subscribe to a few of the newsletters from SANS, check out the CERT newsletters and site on a regular basis, and in general are flooded with information that you never knew existed. "How could there be so many security issues in the software I use on a daily basis?" you ask. But there are.

So you read an article like this one from the 12/4/06 (yesterday's) @RISK newsletter from SANS:

Description: The AcroPDF ActiveX control, included with Adobe Reader and Adobe Acrobat contains multiple vulnerabilities in its "setPageMode()", "setLayoutMode()", "setNamedDest()", and "LoadFile()" methods. A web page that instantiates this control and calls one of these methods could exploit these vulnerabilities and execute arbitrary code with the privileges of the current user. Users can mitigate the impact of this vulnerability by disabling the affected ActiveX control via Microsoft's "kill bit" mechanism for CLSID "{CA8A9780-280D-11CF-A24D-444553540000}".

Status: Adobe confirmed, no updates available.

Council Site Actions: All responding council sites are waiting on
additional information from the vendor. Almost all sites rely on the
automatic update feature for their clients.

Now what do you do?

Really, there's not a lot TO do. You've got two basic choices (since the vendor hasn't released a fix): (a) Stop using the software, or (b) Wait for a fix. The important thing is that you now know that you need to be more careful when opening PDF file attachments to email or PDFs someone sends you, or PDRs from a web site.

Generally, the rules haven't changed: Don't open email or visit web sites that you aren't sure about.

I once had an otherwise pretty intelligent guy tell me: "I get lots of unsolicited emails. Resumes. Job applications. Papers. If I didn't open them, I couldn't do my job!" Ok. I accept that. Just don't ask me to connect your computer to my network.

Microsoft reported today that a zero day exploit in most of the commonly used versions of Word could cause problems. The answer: don't open Word documents--whether or not you know the person who is sending them to you.

Yeah, right Microsoft! Read all about it below.

Microsoft Issues Word Zero-Day Attack Alert

Many clients like the idea of "do it yourself" software implementation. After all, industry studies show that between 1 and 4 times the cost of the software is invested in services (customization, implementation, training, etc.). Saving that money looks pretty good, and sounds even better.

In reality, ERP software is complex. It generally takes one full implementation for someone to figure the general functionality out, and several more for a consultant to begin to understand the true abilities of the software. This is in addition to weeks of training and staffing the call center. Until then, there are many mysteries in ERP software. How exactly does pricing work in this scenario? How can you get the sales tax report to come out like you need it to come out for TN sales tax? Is it possible to calculate TN sales tax (including the 2 tier, $3200 per item limit) with this software? Will that even matter?

When you get into specific features, you need to understand both the business and accounting implications of things. What exactly does backflushing do? What if I use LIFO and backflushing? How are items relieved from inventory if I purchase them and tag them for a particular job? Do they go through inventory? Do they affect average cost? And on it goes...These things are only learned through years of experience...even knowing to ask the questions, or that there may be issues requires experience.

And then there is the matter of add-ons and customization and modification. All-in-all, it takes years of experience to understand ERP software.

If I'm ever responsible for implementing ERP software as a CFO or CEO in another company (and I plan to be at DGG for a long time; someone else needs to clean out my desk), believe me I'm hiring a consultant to do the dirty work. And the first questions I'm going to ask are: How long has the lead consultant been implementing software? Will I be able to get hold of her or him when I have a question, no matter how simple? How long has the least experienced person I'll be working with been implementing software? How closely will that person be supervised? Do I have an option to pay more to get a more experienced consultant if I want to?

I've seen a few companies do-it-themselves. Generally, they spend more trying to straighten out the mess later than they would have spent getting assistance in the first place.

Kinda reminds me of that time I was going to paint the house....

In the 1980s when I was in college, an article came out in one of the leading journals describing technology projects as a process of "unfreezing," "change," and "refreezing." I've found this image useful for what DGG does. In most businesses, there is at least some element of resistance to change. Often, I see businesses that delay needed Information Technology changes until the last minute, then expect them to proceed without a hitch.

Reality intervenes in these cases.

I've written somewhere else that 10 years ago software was behind business. If we got a 75-85% fit for needs with off-the-shelf software, we were doing pretty well. Now, with the advances in hardware that make extensive software optimization unnecessary, and the advances in software development tools and techniques that allow quick development of complex software, it's possible to quickly add features to software. So software--in many cases--is ahead of the business...it does things the average business doesn't need to do today.

And therein lies the opportunity and the danger.

The opportunity to become much more efficient by applying best practices to the operation of business. And the danger that the change will be too difficult to absorb.

Make sure your business is thawing before you begin a software project...it will go a long way toward ensuring the project's success.

In an easy-to-miss article, InformationWeek reported on legal challenges that SecondLife, the virtual world, is facing. Since people in SecondLife talk about the virtual world as if it were real (leading some to suspect that the only reason they need SecondLife is that they don't have a first one), some of the residents of SecondLife are suing the company that created it, Linden Lab, for property rights violations.

As the article points out,

[T]he company sells the idea of ownership on its site: "Become a part of history by purchasing land and developing your own piece of Second Life," the site says. "The Pricing and Fees are simple; you pay $9.95 a month plus a Land Use Fee proportional to the amount of land you own."

So what exactly does this mean legally? Do we have property rights to property that lives only on a computer?

Shudder....

Reminds me of The Matrix....

Maybe the people in SecondLife are just a bit too un-focused on their first one...

Virtual Worlds Collide With Real Laws - News by InformationWeek

The most stressful thing that I had to do when I was in public accounting was go into the office. It wasn't because there were other CPAs there, either. It was because of phone messages. It never failed that I got stuck in the office and was late for appointments because I was trying to return calls. And I hate to be late. People who know me may find that hard to believe...but it's true.

The best thing to happen in those days was the advent of the Motorola "brick" phone. With it, I could hit the office, get messages (or even call to get messages), and be on the way to an appointment. Reduced my stress immediately. Great addition to my life.

I feel the same way about the email on my Treo. Unlinked me from the office or home computer. Allows me to read newsletters when I can. Great addition.

Some executives are torn...is this good or is this bad? Guess you'll have to decide for yourself.

Executives Torn Whether Tech Gadgets Help, Hurt Work-Life Balance, Survey Says - News by InformationWeek

This info is from Zebra, so of course it's mostly marketing spin, but there is some good information about RFID and a whitepaper with a case study. Thought you might find it interesting.

Z*Mail November 2006

What process will you use for selecting your software? Let me describe the typical process I've seen:

• Make a list of the things you don't have now or don't like about your current software.
• Identify possible packages
• Call the vendors of the software for demos
• Review the demos
• Get together with staff to discuss the demos
• Select the software based on the demos and price--particularly price, since by this time most of the software will have started to look and sound the same.
• Begin to implement the software.
• Wonder if you made the right decision.

This is the process that most businesses seem to use. It has a several issues:

• The only needs identified (first bullet) are things that are wrong with the current software. Things that are right with the current software are ignored (see The Gladys Principle post).
• The vendor generally controls the demo. Only things that work well will be shown.
• Proposals are rarely apples to apples.

If you do things this way, I can just about guarantee you that you'll select the software vendor with the slickest presentation rather than the best product. If you don't want to do that, use a process that includes a needs analysis and a review process that evaluates your needs against features rather than vendor against vendor or (more likely) price against price.

According to most of the surveys I've seen lately, the web is becoming more important to decision makers. Some 57% of purchasing officials in a recent survey (can't recall where) confessed to checking the web before doing business with a company.

This means that it's more important than ever to have a solid web presence.

There is also some new research from MarketingShurpa.com that suggests some improvements for landing pages on the web. Take a look. A little bit of improvement could be a big benefit to your prospecting.

While I'm thinking about the web...

I've put in inquiries to several sites lately. Places like libsynpro.com (Podcasting), a ton of employee psychological testing sites, and some sites for information on product purchases. And I've not gotten a single response from several of them.

The sad thing is, the first group that picked up the phone or answered my email got my business.

Good old fashioned courtesy doesn't need to be a thing of the past.

I thought only kids got strep. Oh well, I've evidently got it. Had a routine doctor appointment, and a little runny nose one minute...the next I've got strep.

It's a good time to get a little rest, but I hate being sick. I'd rather work than be sick!

Given that one of the major reasons businesses will be motivated to move to Vista is the security it promises, the availability of a serious, verified, hack within 15 days of its official launch would be a bad thing. If you read the messages posted against this article, at least a couple of people think it's a bad joke from the Free Software Foundation.

I'm not sure...but time will tell. As for me, I'm still taking the "wait and see attitude..." And I still haven't gotten around to loading the release copy at home.

Hackers Selling Vista Zero-Day Exploit

As I've noted before, converting money from SecondLife Linden dollars to real dollars depends on an exchange where people want to exchange real dollars for virtual dollars. As I read it, for $9.95 per month, you get a signup bonus of 1,000 Linden (virtual) dollars (L$), and a weekly paycheck of L$300. Figuring that out over a year, that's 7.2 cents ($0.072) per L$ if I did my math right (it includes the L$1000 signing bonus). It also assumes that you pay monthly rather than annually. If you pay annually, L$ are worth even less.

Stats on population are getting a little better, a few over 2,000,000 residents today, and 233,536 visitors in the last 7 days, with about 18,000 logged in as of the moment (just a second ago) I visited the home page.

And right now on the LindeX (where you trade L$ for real $), the going rate is US$1/L$268. Lest you were wondering, that's 3.73 cents per L$.

Now, I'm not going to interpret that for you...except to say that somewhere someone is paying 7 cents for something I can buy for 3 or 4 cents. Something's not right about that! Somewhere, there's 3 cents worth of value for every dollar going down the toilet.

If that sounds like a good deal, you'll really like the odds on the lottery.

But perhaps I'm being too analytical...it's about social media, after all.

'Second Life' mints a millionaire? | News.blog | CNET News.com

The real problem here is that I understand how our clients think. And I agree--somewhat. The speech runs something like this:

I bought Windows 2000 just six years ago. It still works good enough for me. Why is Microsoft forcing me to buy a new version? And oh, by the way, my computer isn't powerful enough to run Vista, so I guess I'll have to buy another one of those, too.

I wish I didn't understand the feeling. I have it every five or six years when my car rolls over the 100,000 mark. Just in case you're curious, I have one vehicle that is moving toward 130,000 miles, and another that's just over 102,000 miles. I plan to get about 250,000 on both of them...but I guess that's just the way I am about cars. By the time I'm done, the cars will be 10 years plus old, I hope.

But why do I have to replace my Windows every six years or so? The answer--realistically--is that you don't. But the issue is that the technology is moving so fast and making so many improvements that if you want any of the benefits of the new advances, you've got to upgrade the foundation (Windows). I replace a copier every six or eight years, and it still just makes copies for me. Windows (theoretically) does a lot more.

So as long as you don't want your software to do anything different, ever, you're safe with Windows 2000...at least until your hardware breaks...and even then you can probably patch it together for a while.

So about the time I'm ready for a new car, some of our clients will be ready for a new version of Windows.

By that time, I'll have forgotten everything I know about the their version. Windows 98? Some clients still have it. Problem is, I've forgotten all the tricks and so has most everyone else. At the very least, we're not as good as we were when it was new...say 10 years ago.

So hold off for another year or two if you really want to...or bite the bullet and start thinking of your computer system like your cell phone bill...something you need to invest in on a regular basis.

Now if I can only figure out how to get children to stop eating so many groceries...

Microsoft Turns Up The Heat On Windows 2000 Users - News by InformationWeek

Ok, before you think this is my wish list, I've had my eye on this little orange tie number for a couple of months. Problem is, I can't buy it for myself. I was brought up in public accounting and taught the ditty:

Early to bed, early to rise, work like heck and wear a red tie.

I don't own a blue dress shirt...all of mine are white. All of my suits are dark; I've never owned a summer weight suit of tan or olive.

So my problem is...I really like orange ties on other people. I know I'd wear one if someone color savvy picked it out. But everytime I go to buy one for myself, I bomb out.

Too forward thinking...

I don't have that problem with technology. I'm still running Vista Beta 2 on my home system with the Beta version of Office 2007. Clothing...conservative. Technology...bleeding edge. Politics...I'm not saying...

On the other hand, maybe you should just get me the phaser...here's the list for your techie friends.

IT Stocking Stuffers

For years, the standards in anti-virus have been Symantec (Norton) Antivirus and McAfee. McAfee has lost a bit of its appeal in the last few years as Norton several years ago beat McAfee to market with a corporate product that worked quite well.

But the market may be changing. More and more tech savvy installations are moving to Trend Micro's antivirus and Kaskersky Labs. Microsoft is also entering the market. 2007 may be the year to re-think the brand of anti-virus you use.

Kaspersky Lab's Secret Sauce Uses 'Woodpeckers'

The Thinking Tech website will be coming down for maintenance work from the 29th of December to the 1st of January. I'll keep posting until then, and will see you in January.

For the new year, I'd like to propose several questions that I've been thinking about for Data Guidance Group. Most of the issues here may seem to be technology issues, but they really aren't. They're business issues. So here are some business questions I've been asking myself and our clients over the past few months. What are your answers?

• What are you doing to communicate better with your customers or clients? Do you have any technology in place to help you?
• How do you measure how well your business is doing? Do you have regular reports from the computer system? Are you reviewing details, or do the reports give you a management-level view?
• What about forward looking reports? Most businesses have financial statements, but they are history. What about the future? How are you keeping track of how well you'll do next month, quarter or year?
• How are you managing your sales force? What data do you collect? How do you use it?
• How are you managing the operations of your business? Reports? Summary or detailed?
• What are your plans to upgrade technology of all kinds in your business? Phone system? Email? Cell phones? Web site? Computers? Software?
• Are their any pieces of the software you have that you think you could or should use that you are not? Why not? What would you have to do to implement those this year?

Ok, that's a few. We'll consider each of these in future posts. Hopefully, you'll get something out of them.