rb|it : blog

IE Security Warnings, do they work?

I’ve just spent 5 minutes paying my mobile phone bill online, and every page I loaded in the process, IE8 came up with a warning saying “Do you want to view only the webpage content that was delivered securely?”.  I’d consider myself more informed than the average user; I’m aware of the nature of security threats via a web browser, I keep my operating system and applications patched, I run up to date anti-virus and I am careful about which web pages I visit.  But I didn’t feel qualified to answer that question, so how is everyone else reacting to it?  Most people who be stumped, and even I was turn between security (rendering the page only with content provided via an SSL connection) and usability (the page rendering correctly, as I assumed it was graphic elements that were being loaded by HTTP instead of HTTPS).

A quick look at the page source showed various JavaScript elements and CSS stylesheets being loaded via unencrypted HTTP connections, which is what IE was warning me about, but if I don’t load those elements the page renders very badly.  I can still find what I was after but the layout is appalling (as you’d expect with no CSS loaded) and some parts are unreadable.  So what did I do?  I loaded the page regardless, including the insecure elements.

So is this warning of any use?  Should I be able to add exceptions so it only warns for sites I don’t trust?  Firefox 3.5.5 doesn’t popup any warning at all, it just highlights an alert icon on the bottom right of the screen (which 99% of people won’t even notice).  So which approach is right?

I’m stumped.  The UAC debacle (which Microsoft now admit was about encouraging proper coding practise, not preventing malware infection) didn’t help the security/usability issue at all, it alienated and confused a large number of users, but when behaviour which could compromise a users system is spotted by the operating system or application, how should it approach the problem?  The vast majority of users aren’t qualified to make a decision about whether a certain practise is safe or not, and constant intervention by the application or operating system is more likely to encourage them to bypass or downgrade security functionality than protect them.  So what can developers do?  Obviously good coding practise, better code review and quick response to reported vulnerabilities will protect users against malware which manipulates a fault in the software, but nothing seems to be able to stop malware which manipulates a fault in the user.  If this IS the case, then is user education the only answer?  People have to learn to drive a car, they have to learn about basic household finance, and most of them have to learn how to bring up a child, so why shouldn’t they learn how to safely use a computer?   Worth thinking about, but I can’t see how conventional education systems (compulsory and further/higher education) can deliver more informed users, so who can deliver?

Answers on a very large postcard please!

The benefits of mobile computing

Mobile phones are a fixture in every business now, particularly for staff that travel.  It’s assumed that if you need to reach a colleague, you can, where-ever they are.  Surprisingly though, PDA and Smartphone technology hasn't achieved the same penetration, possibly due to the perceived technology barriers and market complexity.  I’m lucky enough to be in a position where I can overcome these barriers, and mobile computing has been a huge benefit to me, to the point where I would struggle without it.  So what are the benefits of PDA's and Smartphones, and how do you make sure you can take advantage of them?

The benefits

1. Mobile Email.  With an 'always on' data connection (GPRS, 3G or Wireless) your mobile staff can be notified of an email within seconds of you sending it, just like they are in the office.  Email can contain far more content than an SMS message, it's free, and easier to retrieve than voicemail.
2. Mobile Web browsing.  If you have an extranet or web enabled services (a CRM or Helpdesk system for example) then your staff can access these quickly from their PDA browser.
3. Mobile Office applications.  Both Windows Mobile devices and iPhones have support for Microsoft Office documents and PDF's.  This means your mobile staff can be reviewing a technical document, quote, or contract while they're on the move.

The 'How?'

1. What are you connecting to?  Make sure the devices you chose can access the systems you already have (don't buy new server systems just to fit in with your mobile devices).  Windows Mobile devices will work with Microsoft servers, and can also access email on any mail server, though the mobile browsing isn't particularly good.  Apple iPhones can access any mail server (including Microsoft Exchange) and have better mobile browsing support.
2. Get the right data package.  Even if your device has wireless built in, your staff can't guarantee they will be within reach of a wireless network, and will need to use GPRS or 3G.  Make sure your SIM contract includes unlimited data at a fixed cost.
3. Test the devices first.  My experience has been that HTC Windows Mobile devices are excellent, but the HTC devices branded by O2 (the XDA), T-Mobile (MDA) and Orange are rarely as reliable.  If possible, get a device to test, or invest in just one for a 'tech savvy' member of staff to evaluate.
4. Train your staff.  There's no point investing in the technology if your staff don't know how to use it.  Make sure they know how to use mobile email, browsing, and any applications they'll be expected to use.  It's also worth making sure someone in the company knows how to configure your phones in case the need to be reset and setup again.

Every day, I receive instant email notification of Helpdesk calls, view and update the calls and research a solution via Pocket Internet Explorer, and email the client with the fix, all from my PDA, where-ever I am.  If you invest carefully in your mobile technology, you too can effectively remove the communication barrier for off site staff.

The good, the bad and the ugly

More of a news round up this week than a monologue, three things that have caught my eye over the last seven days.

The Good
Earlier this month HP launched a babysitting service for SMB's called 'Insight Remote Support'. It's available to anyone with valid warranty or Carepaq on a Proliant Server (bar the ultra low end 100 series), BladeSystem chassis and Proliant Blade Servers, and the StorageWorks EVA midrange disk arrays.  All you need to do is install the agent from the HP site and they will monitor your server for you, making sure it all works, warning you of impending failure, and even ordering spare parts to replace faulty components and dispatching them with an engineer to fit them.  When 90% of of HP's SMB customer base is worried about unplanned downtime it will be a shot in the arm and potentially a huge money saver.  For more info see http://h18006.www1.hp.com/products/servers/management/insight-remote-support/overview.html

The Bad
In October last year I blogged about using the 'inurl' switch in Google to exclude unwanted domains from your search results.  Having recently reviewed this I found some interesting things I either missed last time, or have changed.  Firstly, the Google page on Advanced Search Operators does not state that you can use the inurl switch with the minus operand to exclude words from a URL.  Secondly, there is apparently a restriction on how many words you can enter into a query (32 words), which restricts the amount of domains you can exclude using this switch.  Lastly, I have seen in some search results that addition of an inurl switch actually increased the result count!  Whether this is an attempt to discourage use of this switch I can't say, but it certainly isn't encouraging.  The switch still appears to have the desired result though.

The Ugly
A new(ish) development in network security is the compromise not of home PC's, but home routers.  A worm called "psyb0t" has been detected in the wild by a research group DroneBL, and is estimated to have infected at least 80,000 hosts.  Until now, 'botnets' have been made up of PC's with broadband connections that are infected with a virus or worm, the weakness of this method being that the malware is potentially detectable on the PC by the user.  However, compromising the router (which the user knows almost nothing about) is a far more stealthy method of infection.  This worm appears to have been deactivated by it's author, and possibly the result of a research exercise (though still illegal).  However, now the concept has proven to be successful it no doubt adds another weapon to the arsenal of the bot herder.  I would strongly advise all of those who can to check that their DSL or cable router has remote management (whether that be web interface, ssh or telnet) disabled on the internet interface.  If you must allow remote mangement, at least restrict those IP's that can access it, and use strong passwords.

Open Source Issue Tracking

Customer Retention
Almost any company providing a product or service receives issues or problems from their customers.  They might come in by email, by phone, or even by post, but those issues need to be addressed, and the process for doing that can be problematic.  In many smaller companies there is no software system (or even process) for dealing with these issues, and customer satisfaction suffers as a result.  Several articles recently have identified customer retention as a key survival tool in a recession.  Those who provide good customer service will be seen as ‘high value’ providers, and those who fail to deal with customer issues will lose customers to their competitors.

You get what you pay for
In the past, ‘Helpdesk’ or ‘Issue Tracking’ systems have been very much a case of ‘you get what you pay for’.  The lower priced systems were simple at best and lacked critical functionality (like automated issue logging from email), and the better systems were expensive, often beyond the budget of SME’s.  There is an alternative though, and it looks very promising.  rb|it-Consulting has recently been evaluating the latest version of OTRS (short for ‘Open-source Ticket Request System’), and is now adopting it as a Helpdesk and Issue Tracking System.

The good news
The software is entirely open source and free, runs on Microsoft Windows and UNIX/Linux and comes complete with all the required packages.  The installation is simple and works on both Windows Server and Small Business Server 2003 (the latter requires a tweak to the installation to avoid clashing with IIS).  The end result is a web based system which works in all browsers (including mobile devices), which can be integrated with your chosen email system (whatever that may be), and provides an effective and powerful tool for tracking issues from receipt to conclusion.

Features

1. Automated incident logging via email
2. Automatic email notification to customers and staff of changes to issue
3. Full function web based console for agents and customers
4. Built-in escalation of issues and other time based functions
5. Calendar support (to define working hours and days)
6. Service and SLA Support
7. Extensively customisable via the web interface

The default installation would require minimal configuration for a simple setup, but the benefits are potentially huge.  Your customers would immediately know that their issue had been received and have a unique reference for their problem, and can log into a web interface to check or update their issue.  Your staff can see all the outstanding issues, prioritise them, see which were overdue a response and can assign them to whoever in the organisation (or outside it) is responsible for fixing it.  Take a look at the demo version (see http://www.otrs.org/demo/ for details) and try it out for yourself, I think you’ll find a free, powerful and easy to use system which will make your customers happy, and your Financial Director even happier.

Richard Bartlett offers IT consultancy services through his company rb|it-Consulting.  Contact him by email richard@rbit-consulting.com or visit his website at http://www.rbit-consulting.com

Using a blog to keep your site fresh

Sorry it's been a while since I posted, I've been working exclusively for one client so I've not been able to do any of the research that normally drives my blog posts.  I have however had to find a cheap and easy to for my client to update their website without the expense and resource required to implement full content management.  So here's what I came up with.

Background
The most common reason for websites failing is that they stop getting updated, so people stop visiting them (which is a downward spiral).  The problem is particularly acute for smaller businesses who cannot afford to have even part of one person dedicated to updating the website.  The solution which technology has presented in recent years is 'Web Content Management Systems' (Web CMS for short).  In a nutshell these applications allow people without any HTML or web design skills to update the content on a website, using simple formatting options which everyone is familiar with (bold, italic, bullets, numbering etc.)  The CMS enforces the 'house style' so whatever you type in appears in the look and feel of the site, including pictures and text.

Pros and Cons of CMS
The upside of these systems is that the web design company you employ only needs to set up the site once, and provide you with a CMS to continue updating it from that point on.  Because it's so simple to use, your marketing department can add company news or an event, and your administration staff can add a new job advert.  The downside of these systems is that while they're often free, they're not simple to install, and installation costs money.  If you already have a new site and don't want to spend a lot of money on a web design agency fees then you're stuck with putting all your updates through your agency (with the resulting fees).

The alternative
There is (as always!) another way though.  With some simple changes to the site you can use RSS and FeedBurner to 'push' your business blog entries to your website.  All you need is

1. A blog (I use Typepad, where a Pro Account costs around £100 per year), and
2. A FeedBurner account (free).

You categorise your blog entries according to their type (e.g. news, events, jobs), and set up an RSS feed for each category.  Then you use FeedBurner 'BuzzBoost' to republish your blog article anywhere on your site with just a simple snippet of HTML.  This way, you can have portions of your site updated as often as you update your blog, making it much easier to keep it alive and keep visitors coming to your site.

Note: You will need someone to put this onto your site, and they should use CSS to ensure the blog entries are displayed in your existing web site style, but that's not a lot of work.  You can also (quite easily) 'brand' your blog so it includes your logo in the top banner, and uses the same fonts and colours as your own site.