Unified Threat Management Solutions Now: Chatting with Lisa Phifer

As more and more business collaboration takes place online, threats to online security become greater threats to business agility and efficiency – and continuity. Herewith, some key take-aways from an online audio discussion and chat about unified threat management or UTM devices. These are basically computer-hardware-and-software "appliances" that automatically protect business computing and networking facilities from multiple threats, such as viruses, spam and unauthorized network intrusions. Their all-in-one design makes them affordable, manageable options even for small and mid-sized businesses (SMBs) and small or remote facilities of larger enterprises.

This online chat featured Lisa Phifer, president of security and networking consultancy Core Competence. She has been involved in the design, implementation, and evaluation of networking, security, and management products for more than 25 years. She was formerly a member of the technical staff at Bell Communications Research and senior staff architect at Unisys. She teaches about IT and security, has written extensively for numerous publications, and is a featured speaker at leading conferences.

The event, "Choosing the Unified Threat Management Product That's Right for Your SMB," was part of the Online Audio Series at TheSecureSMB.com, which is open to everyone with complementary registration. An archive of the audio portion of chat with Lisa is available at http://tobtr.com/s/2173127. Many thanks to The Secure SMB team and all of the chat participants for their great questions, some of which generated Lisa's guidance as summarized below.


UTM, the cloud and new network client options: One chat participant asked how UTM appliances can help companies to deal with the growth of "the mobile, social cloud," remote working and "BYOC" ("Bring Your Own Computer") initiatives. Such initiatives create an even greater role for network security solutions and their management, because business can't necessarily put security measures on every authorized device, Lisa replied.

However, "[UTM appliances] that do have the ability to fit into some type of NAC [network access control] architecture can leverage endpoint health and integrity inspection [features] to protect the net from infected devices," Lisa said. Some of those UTM appliances also offer intrusion protection features that can detect and help to "quarantine" infected device activities, she added.

Business and technology decision makers should strive to ensure close integration of the management of their chosen UTM and security solutions. Those decision makers should then invoke all of the available features of those solutions that make business sense and maximize protection against infection, Lisa affirmed.

UTM appliances vs. point solutions: Another chat participant asked, "Is it better than to have multiple devices than one device? This way you can upgrade pieces as they become the slower devices on the network [and] the costs can be managed over time," especially for cash-strapped smaller businesses.

"Multiple devices add latency and points of failure. They are also costly to replace," Lisa replied. "The idea behind UTM is to give you one device to reduce latency, management complexity, and points of failure. However, you do create a potential bottleneck – one that you can manage by upgrading the UTM [appliance] or replacing it with a larger model." Another option is to use load balancing, a feature included with some UTM appliances, to divide threat management across multiple UTM solutions.

Bamboo Solutions: Taking SharePoint Beyond Collaboration in the Cloud

My understanding is that Microsoft is seeking a new, improved cloud strategy. (Microsoft CEO Steve Ballmer e-mailed the company, telling everyone that 23-year veteran Bob Muglia, president of the company's Server and Tools Business and gatekeeper for its evolving Azure Cloud strategy, is stepping down.) I have a modest recommendation. That strategy should focus on starting with what users are already using and build upon it, in ways that are easily accessible and affordable.

This is precisely the strategy adopted by a Microsoft Gold partner I've recently discovered and find intriguing – Bamboo Solutions. The company has built a number of offerings atop Microsoft SharePoint, a collaboration tool in use at and apparently delivering business benefits to many companies. Bamboo adds to Hosted SharePoint features for functions ranging from project and requirements management to sales and customer support.

Bamboo Cloud Applications include BambooCRM (which incorporates sales and customer support features), BambooSupport and BambooRM for requirements management. You can learn more and sign up for free trials at http://cloud.bamboosolutions.com/freecrm/. Pricing for BambooCRM starts at $29.95/user/month, billed quarterly on three-, six- or 12-month contracts.

Bamboo is delivering cloud-based collaboration tools that address specific business needs, build upon a known, proven and widely adopted platform and are available under clear, straightforward terms. They aren't going to be appropriate for every company of user, but they're worth looking at as examples of what to look for in such solutions. And they offer a glimpse at what might be possible if Microsoft were to take a similar tack with its hosted offerings – or at least to promote the ones that seem to "get" users' needs and desires with a bit more enthusiasm and clarity…

CloudPointe: Middleware that Matters to Business Users

If you're going to collaborate, you will likely want to share electronic documents. And you probably already use one if not several tools for creating, editing and storing those documents. So the last thing, and I mean the VERY last thing you and your colleagues want and that your business needs is yet another application to facilitate document sharing and collaboration.

What you really want is a solution that enables these abilities in ways that are, as the most popular and valuable business IT features always become, pervasive, ubiquitous and invisible. From a more technical perspective, what you want and need looks and feels a lot like middleware -- software that users never see or touch, but that makes the tools and services they do touch work better together.

From this perspective, I believe that I have seen the future, or at least one strongly compelling future, where document-centric collaboration is concerned. I believe a harbinger of that future is CloudPointe, which has just introduced a cloud-based service that enables users of Amazon.com S3, FTP, Google Docs, Microsoft SharePoint or Secure FTP (SFTP) to share, collaborate with and store documents easily and securely.

For more details, I direct you to a recent SYS-CON article on CloudPointe by my industry colleague and fellow Focus Expert Network member Tim Negris. You can find the article at http://dortchon.it/CloudPointe, and you should read and remember it, even if you never become a CloudPointe user. Tim makes several points about what's needed for effective document sharing and collaboration -- points I've decided that I don't need to make here if you read his article, because I enthusiastically agree with all of them.

Check out Tim's article, and let him (and me!) know what you think. Ditto regarding CloudPointe. Sometimes, it's true that the future is now, and I believe now is one of those times.

Business Applications, Faster, Cheaper & Guaranteed -- EnterpriseWizard CEO Colin Earl: The Dortch on Collaboration 3-Q Interview

In many companies, the most business-critical collaborations today take place via highly or totally custom-built applications. This is especially true at lager enterprises, and thanks in part to cloud computing, it's increasingly true for smaller companies as well.

Two increasingly critical challenges to effective, money-making, customer-delighting collaboration immediately leap to mind:

1. getting apps built, deployed and tailored as needed rapidly and cost-effectively; and
2. getting and keeping those those apps aligned with critical, subject-to-sudden-change key business processes.

Colin Earl is the CEO of EnterpriseWizard, makers of "adaptive business automation software" (!!) that enables businesses to build and tailor premise-based or hosted/cloud-based applications that comply with and automate business processes, with no code required. And the company offers a no-BS 100-percent money-back satisfaction guarantee. Colin is also a member of the Focus.com Expert Network, and has contributed some useful and interesting content there.

I thought Colin might have some useful thoughts on the current state and near-term future of business application-building. And I was right, as you'll read below. (I've added links to appropriate Wikipedia definitions and other resources rather than inserting a bunch of distracting explanations for some of the terms Colin uses. You're welcome.)

Q1: What is the greatest challenge facing business application builders today?
A1: Time/Cost. The business manager might say "We just need to manage XXX". He/she thinks of it in terms of a simple Web interface and expects that it should take a few days or weeks to complete.

But to meet corporate standards and government compliance, it also needs a ton of back-end and reporting functionality, such as: auditability, dashboards, automated backups, security, [support for] Web services/REST APIs, graphical charts, searching, synchronization with other systems, data integrity constraints, database connectivity [and] export/import capabilities. The list goes on and on.

By the time they have finished and debugged all this, the "little" project has taken man-years, cost a million dollars and may well be obsolete because requirements have changed.

Q2: What is the greatest challenge facing providers of tools and solutions for business application builders today?
A2: Providing a compelling value proposition. The old proposition of "Invest in months of training so that you can build applications that only the original developer can maintain" is no longer acceptable, especially when it involves some proprietary language.

With the possible exception of Microsoft, no single company can really afford to keep their proprietary technology apace with the rate of open-source development stacks. The LAMP [Linux/Apache/MySQL/PHP] and open-source Java stacks are simply evolving too quickly. Compare the rate at which Android has developed, as compared to the Microsoft smart-phone OS (assuming you can still find a Microsoft-based phone).

Tools and solutions for business applications builders must therefore leverage the open-source stacks, while adding compelling value.

For example, the tool might automate provision of all the "standard" functionality such as auditability, dashboards, automated backups, etc. The developer could then focus on development of the user interface and specialized business logic, so that the whole application could be built in a matter of weeks.

Q3: What is the "next big thing" in the building of enterprise applications -- technological, cultural or other?
A3: Removing the need for hand-coding. It is not only a huge time-sink, but the source of most problems.

The Google App Inventor [for Android] is doing this in the smart-phone space and we are doing it in the enterprise application space.

Let’s examine the main reasons that CIOs are fired, as described in a 2009 CIO Strategy article:

Project never gets finished or goes too far over budget. (Removing the need for custom coding reduces the time required to develop a project by a factor of four or more.)

Major application failure. (If the tool allows the project to be developed using the functionality built into the core platform, then it will be leveraging a code set that has been tested for scalability, audited for security and proven in hundreds of enterprises worldwide.)

Non-compliance or a high-risk issue compromises the organization.  (Compliance support can be automated with a tool that only shows an auditor what a defined business process is and how the system enforces it, but how the process has been followed in any particular instance.  The framework can capture and collate data, such as who logged in, what IP address they came from, what records they viewed, edited, etc.)

There are further advantages [when the need for hand/custom coding is eliminated]:

• User adoption is a lot easier with a system that can be rapidly adjusted based on their feedback.
• If there is no custom code, there are no code-compatibility issues with upgrades.
• Business managers no longer need to agree with one another on everything six months in advance. After all, the system can be changed using just a browser in a few hours.  They are also no longer dependent on the “common sense” of programmers to deliver the system they need.
• The system is self-documenting because everything is exposed through the admin browser.
• Data integrity is automatically maintained by the system, not by custom code.
• Code maintenance accounts for 80% of the cost of software projects. With no code to write, there is no code to maintain so cost, hassles and unpredictable delays are eliminated.

Dortch's Recommendations:

One of the major drivers of IT into the heart of almost every business on the planet was this intentionally vague value proposition: automate/eliminate mundane tasks and let people concentrate their skills and efforts on higher-value activities. As technologies for building, tailoring and deploying applications have evolved, "programming" such applications is increasingly becoming more mundane than unique and creative.

Of course, that means the "programming" of tools such as App Inventor for Android and EnterpriseWizard must result in tools that are powerful, yet relatively simple to use for those building and tailoring applications. Colin and his team, like the team at Google Labs building and refining App Inventor for Android, understand the criticality of combining power, flexibility and simplicity in a balance that favors, supports and empowers users.

Companies seeking to build premise-based or hosted/cloud-based applications that improve competitiveness and agility without requiring extensive programming or IT support resources should look closely at solutions such as App Inventor for Android for mobile applications and EnterpriseWizard for others. The better your business applications, and the fewer resources you have to spend on building, running and improving them, the better the collaborations your company translates into revenue and profit. You have little to risk, and much to gain, by exploring such solutions now.

Collaboration, Communication and Business Processes: Why They're Connected and How to Get Them There, in 13 Sentences!

1. Every business relies on collaboration and communication to do business.

2. Almost all business collaboration and communication is supported by some form(s) of information technology (IT), whether e-mail, social media telephone or even fax.

3. To win consistently and thrive competitively, businesses need to be able to do the right things for customers, partners and prospects consistently and respond to changing requirements or conditions in a timely, agile fashion.

4. Ad hoc, inconsistent collaboration or communication practices make it unlikely to impossible for businesses to do what they need to do to win consistently or thrive competitively.

5. The key difference between collaboration and communication practices that help a business to win and those practices that don't are consistent business-driven processes implemented and enforced across all business-critical activities and actors.

6. Processes that are crafted, documented and enforced well and consistently help to ensure that all important actions contribute to satisfaction of customers, partners and prospects and business success.

7. At most businesses, critical processes are often inconsistently and poorly crafted, documented and/or enforced, when they exist, are documented or are enforced at all.

8. The businesses best able to capture, define, implement, enforce, integrate and manage critical processes are those best positioned to win and to thrive competitively.

9. A potentially powerful way to achieve these goals is to process-enable the collaboration and communication solutions upon which the business already relies and with which users are already familiar.

10. Fortunately, new IT tools are appearing that make it relatively easy for even non-technical business decision makers to capture, define, implement, enforce, integrate and manage business processes effectively and consistently, and to process-enable key collaboration and communication solutions.

11. Examples include Cordys, which offers cloud-based process and workflow management that integrates with Google's online office applications, and EnterpriseWizard, which combines cloud- or premise-based application building and process capture/creation with an unconditional money-back satisfaction guarantee.

12. Your business needs to begin by capturing, analyzing and optimizing all critical incumbent processes, evaluating and prioritizing key collaboration and communication solutions and mapping out how best to process-enable these -- preferably now if it hasn't already.

13. For more on this (and on EnterpriseWizard), read my recent Focus Brief at http://focus.com/c/B3E/; to discuss, feel free to drop me a line at mdortch@focus.com and/or at medortch@dortchonit.com.