Online Backups: Evaluate the Risk

The SANS reading room recently published an article entitled: Online Backup: Worth the Risk?

Of course I wanted to know what folks at SANS had to say about online backups. The synopsis of this article is that there are many laws and regulatory bodies governing data security and if a business is to trust another organization with sensitive data, how can you ensure that the other organization (the online backup provider) is meeting all of these requirements?

This is one of the big questions that businesses are dealing with as they evaluate whether to make the leap into "cloud computing". One problem is that cloud computing is such a nebulous term. If we can't define what it means, then how to we speak intelligently about it? For the purposes of this article, I will use the more specific term "cloud storage" and define it as "storing data on a medium owned by a provider and connecting to the provider over the Internet". That's really the essence of what online backup is.

The article enumerates many of the regulations that data security may fall under and asks the question of how to ensure that your "cloud storage" provider meets these regulations. I'm going to take it one step further and ask "how do you ensure that your cloud storage provider has the same or better security controls in place that you do?" It is understandable to simply concern yourself with regulation, because that's what the auditors will nail you one. But when you get right down to it, you really want to make sure that your data is "safe" and that you won't be reading on the Internet one day how your provider got hacked and your data is now in the hands of the bad guys, because that means lawsuits and lost revenue.

The clear answer to these valid questions is transparency. We have been trained to think of the cloud as some black box in the sky that no one is allowed visibility into. Where is Amazon keeping your data? What controls do they have around it? Are they monitoring their network for intruders? You don't know because it's just out there in the cloud. These are the questions that we at Data Knoxx tackled when we designed our service offering. How are businesses and consumers going to trust us with their data?

Moving forward, let's address the questions brought up in the article specifically:

Where does the online provider store the data?
150ft underground in Lenexa, Kansas. Come tour the facility if you like.

Which Jurisdiction Controls Stored Data at the CSP?
The United States Government and the State of Kansas

What security controls are in place at the online backup provider?

Physical Access Control - Perimeter secured by 150ft of limestone, manually verified sign-in process with biometric suite-level access controls.

Network Design - VLAN-based access controlled by Cisco hardware devices. Principle of least-privilege used when configuring network devices

Server Configuration - Servers using hardened Linux kernels, host-based intrusion detection on all servers configured to notify operators of unexpected system changes or network traffic, change management policies in force, principles of least-privilege.

Monitoring - all systems monitored using local and remote monitors

Vulnerability Scanning - Internal and External vulnerability scans executed on a determined schedule; findings addressed immediately

Secure Protocols - only secure protocols and authentication in use for all systems

What encryption is used?

User has a choice of encryption algorithms. Recommend using AES-256.

Who has access to the Recovery Key?

Only the user. Recovery key must be entered whether restoring from the web or the backup client. All restores are logged and auditable.

Is everything needed for recovery available?

This is dependent on how the user sets up the backup plans. Data Knoxx is available to assist with backup and recovery planning.

Is there sufficient bandwidth?

This is also dependent on the backup plan and the client should consider this when designing their plan. Again, Data Knoxx is available to assist.

How is Recovery Access Controlled?

Recovery is controlled by the user-defined key. This key must be stored in a secure location that is available in the event of disaster (i.e. don't store it on the server that's being backed up)

Is CSP Compliant with Regulatory Frameworks?

Data Knoxx is compliant with requirements outlined in HIPAA (the other spells this wrong) and SOX. If additional compliance is required, we will certainly work with clients to ensure that compliance is met and will work with the auditors to complete the successful audit.

Does the Provider have a Liability Agreement?

These agreements can be agreed upon at the time of signing (hence the term 'agreement').

Does the Provider have a Service Level Agreement?

Rather than having a boiler-plate SLA, Data Knoxx prefers to negotiate a mutually-agreeable SLA with any client that requires one. Our SLA to this point: we have never missed a backup because our servers were unavailable.

Conclusion

While many may read the article and come away thinking that it raises many questions about whether online backups are safe or not, it reassures us at Data Knoxx that our business plan was the correct one; be open and transparent about our systems and our security.

I encourage all businesses to ask these hard questions to their online backup provider. After all, it's your data and without it, you're not in business.

Security Week

Last week was a bit of a "security week" for me. I attended "SANS546 Detecting Hackers for System Administrators", listened in on the SANS webcast on the Advanced Persistent Threat (APT), and started work on my GSEC certification.

A few notes to start out with: I highly recommend the SANS546 course for any Systems Administrator, Network Administrator, IT Manager, or anyone else that needs to know details on how to maintain security in a network. This course gets beyond the basics of setting up a firewall, making sure your systems are patched, and virus scanning installed. It demonstrates first hand why you have to go beyond these basic steps and gets into Defense in Depth, host-based and network-based IDS, network sniffing, baselining, and detecting malware. The best thing I took away from this course: You can't identify the bad stuff if you don't know what the good stuff looks like.

Second, the webcast on the Advanced Persistent Threat scared the bejesus out of me. For those not familiar with the APT, it is essentially a well-coordinated, continuous effort by professional crackers located in China to break into government and corporate networks in the US. These people are VERY GOOD at what they do! My biggest take-away from this webcast: Treat your network like a garden instead of a fortress. You can't just put up the walls and assume the bad guys will stay out. You need to be continuously looking for the weeds in your garden and removing them promptly.

The two bold statements above are so important because it does not matter how strong your fortress is, a persistent and knowledgeable "bad guy" will get in. Consider this scenario: through reconnaissance, I determine that your CFO likes to play Farmville on Facebook (cringe). So I send him an email "from Facebook" saying that he has qualified for 500 free points and all he has to do is watch a video. A link is included, which actually goes to my malicious site. When he clicks on the video, a popup comes up saying "You must install this codec to watch the video". He clicks it and my malicious program is installed.

The malicious program is custom-built, so no AV signatures exist for it yet (i.e. Anti-Virus doesn't have a chance of recognizing it). My program now starts collecting the CFO's email messages and sending them off to my server. No firewall will block this because outbound traffic, especially web traffic, is generally allowed.

The only way of catching this program is to "know the good stuff" so that your IDS system or log reviews will catch the bad process, files, or network traffic. Even at that, it's very hard. So you have to be diligent. Is one workstation connecting out to other workstations? That's not normal.

Now I know what you're thinking: Just train your users not to click on stupid stuff.

Doesn't work. Yes, you should include security awareness training as part of your security plan, but it's not sufficient. People will click on stupid stuff.

I will definitely be increasing the intrusion detection capabilities of Data Knoxx as a result of my Security Week.

I would be very interested to hear people's response to these points and discuss them further. Feel free to comment or email me directly.

Online Backups as a Service

This post is related to a question that people often ask me and therefore I've spent a lot of time thinking about.

What makes online backup service x better than y?

To get the answer to this question, people often Google "Online Backup Reviews" or "Online Backups" and read articles that compare the 5 or so most popular online backup offerings. These reviews compare features like encryption, speed, ease of use, features like Continuous Data Protection, ability to backup network drives etc. Close to the end somewhere is a little blurb about support and if one support desk is better than another or something like that.

I think most reviews mislead the reader and sometimes miss the mark completely. Yes features such as speed and ease of use are important, and for a service to be considered seriously, it should meet certain criteria in these categories. But as a business person, think about the problem you want to solve with backups: You are protecting your most critical asset against loss. That's what it all comes down to. The rest is semantics.

When considering different solutions is the difference between 5 and 7 clicks to set up a backup your biggest concern or do you want to know that when you are in your time of greatest need; like when a disaster strikes, that the service you are purchasing is there to help you through it?

Online Backups are a SERVICE not just a piece of software.

If you read a few of those reviews and scroll down to the bottom to the paragraph where the reviewing contacted big box provider X, the rating is generally meets expectations down to non-existent. Often you will have to navigate past the front-line support person who is reading to a script to the next level to get any meaningful response. Is this what you want in time of disaster? Was it worth the extra pretty interface or the few dollars less a month to be left out in the cold when disaster strikes?

When shopping for an online backup service, remember that word: service

If you are in the market for someone to perform your IT management or even just manage your printers, the first item on the checklist is service. Why is it that online backups have been relegated to a set of features and upload/download speed? Backups are as much or more about service than any other part of your IT environment.

Here is a checklist that I use when shopping for an online backup service:

• Will the company help me design a backup solution that is the best for my particular business like a backup solution that ensure all critical data is backed up, and optimize use of bandwidth; taking into consideration usage patterns and current bandwidth usage?


• Will the company notify me if my backups fail and help me figure out why (as opposed to just sending automated email messages)?


• Will the company not only provide me with the option of receiving my data on hard drive or DVD in the event of disaster, but also work with me until I'm back in business?


• Where is my data stored and how long does it take to get it back?


• When I call support, am I talking to 1-800-INDIA or do I immediately connect to someone who is knowledgeable about the product and isn't reading off of a script?

By considering these items, you can begin to understand the value of spending a few dollars more on a provider that provides these services than on a provider that may be more well-known but only delivers the most basic services.

Remember that you are protecting the most critical asset that your business has. Do you really want to base that decision on the lowest price and prettiest bells and whistles?





http://www.dataknoxx.com/

The turn of the decade in security

Perhaps this post was more appropriate around Halloween and I don't mean to scare everyone right before the holidays, but this article really hits the spot on the current state of network and data security.

http://digg.com/u1H0ll

For those who don't want to read the whole article, the basic points are:

1. Security is and will continue to fall behind current technology
2. Very early in the next decade, online identity theft and banking fraud will replace drug trafficking as the dominant criminal problem worldwide
3. Mobile devices will become the largest target of exploits
4. As we move more of our data and identifies online, the face of data security will change

So, as we look to the future, do we find a hole and hide in it?

Gosh no!

The moral of the story is, as with any new technology, tread carefully, ask lots of questions, and understand what you are doing.

As you make the move to storing more data online, ask the following questions:

1. Where does my data physically reside?
2. Is my data encrypted for its lifetime? (i.e. Not just as it resides on the disk, but is it encrypted over the wire, on the disk, and are backup copies of it encrypted)
3. Even if it is encrypted, what type of encryption is used, who holds the keys, and where are the keys stored?
4. What is my liability if data is compromised?

Again, as with any new technology or shift in the way that we do things, there are those that will hold fast to the "old way". There is merit in that. But for most of us, we must eventually embrace it. That's ok, too. In fact, I encourage it. Especially speaking as a business owner in the technology space, some of us MUST not only embrace it, but try to understand it and stay on the fore-front.

Just be careful and ask lots of questions.

Happy Thanksgiving
Adam

A Must Read for Small Business Owners

Here is an excellent article from the New York Times that is a must-read for Small Business Owners. The discussion is important not only from a perspective of making sure that your data is backed up, but rather your Disaster Recovery Plan in general.

http://www.nytimes.com/2009/09/10/business/smallbusiness/10disaster.html?_r=1

To Tape or Not to Tape

I'm probably preaching to the choir, but here's a decent article on the pros and cons of online backups vs. tape backups. Really, it's like having to prove why DVD is better than VHS or CDs are better that cassette tapes in that it should be self-evident (that's right Mom!). In the event that it's not self-evident to you, maybe you'll read the article and then it will be.

http://news.idg.no/cw/art.cfm?id=C6DA99CB-1A64-6A71-CE30F519A7B18019

After reading the article, proceed promptly to: www.dataknoxx.com

Facebook security

I've heard from a number of people that they stay away from Facebook because they don't want "Everyone knowing everything about them" (thanks for the quote Mom). Also, I've heard from people who use Facebook, but don't want their work colleagues to see that incriminating picture from Friday night.

Well, it turns out that there are ways to address both concerns. In the interest of not reinventing the wheel, I'll refer you to this excellent article that gives some excellent Facebook security tips:

http://www.allfacebook.com/2009/02/facebook-privacy/

Enjoy!

Reminder to sanitize your data inputs

This always makes me chuckle and it's a good reminder:

Backup Software as a thief-catching device?

This is kind of random, but here's an article about how the backup software on a laptop led to the capture of the bloke who stole it: http://perens.com/works/articles/Burglar/

Make sure you automatically backup those pictures!

www.dataknoxx.com

Cloud File Storage Solution

As a follow-up to my last post, I have been looking at what solution would provide the most secure, extensible, and easy-to-use solution to storing documents online for small businesses. Here is what I have come up with to this point.

Most solutions that I have seen or read about involve either implementing WebDAV, custom web service-based API's, or a combination of the two. They both have their advantages and disadvantages:

WebDAV
Advantages are that no custom development is required on the protocol side, it's a widely-used standard, so it would be interoperable with many systems and clients, and it is easily secured.

It is an interesting solution because, as it's named Web-based Distributed Authoring and Versioning, it was intended for content-management systems but appears to have been extended to general file-storage. Therefore, it may not have the complete feature-set that is required by users when storing and sharing their files.

Custom APIs
Custom APIs definitely have the advantage that you can program them to do anything you want without breaking a standard like WebDAV. However, the upfront and maintenance costs may be prohibitive and anything you develop would not be interoperable with other systems.

The Solution
So, looking at these two options, I would opt for WebDAV. For a proper solution, it would have the following requirements:
1. Be Secure

• SSL-based transport
• Strong Authentication
• Encrypted on disk

2. Integrate with daily usage

• Be mountable as a drive in Windows
• Synchronize automatically (assuming local file cache)
• Automatically mount without user interaction

3. Be Searchable

• Search is where it's at. Perhaps a local searchable index would be a solution to this requirement.

The authentication is a large requirement and from what I can tell, most providers are simply using password-based authentication. I think that to be truly secure, the authentication must be certificate-based. That would help make it more seamless, too because the user would not have to necessarily enter a password. The simple presence of the certificate would provide strong evidence that the user (or the user's machine) has access to the files. Obviously, certificate plus password would provide the strongest level of authentication being that it is two-factor.

So, what I am thinking is this:

• WebDAV-based solution with Apache, mod_ssl (for secure transport and authentication), mod_dav (for WebDAV support)
• Client-based certificate for machine-based authentication
• Ability to mount the system as a drive
• Local Index for search
• Optionally, a web-based console for remote file access

Other "wish list" items may include:

• Ability to share documents, or a subset of documents with partners. They could access the system web-based using short-term certificates.
• Local file cache to optimize speed.
• A device that plugs into a local network that handles all of the above functionality and presents a file share. This is where the rubber hits the road!

I would be interested to hear what others think on this topic. Be it requirements, possible solutions, or experience with these solutions.

Initial Thoughts on Online Document Storage

This represents my currents thoughts on the topic of online document storage.  It's Friday night and I've got Ted Turner on CNN, so perhaps my thoughts are not the most coherent.  

Nonetheless, here goes:

When I talk to many small business owners about online services, they want to talk about their documents.  The common requirements tend to include:

1. Be able to have quick and reliable access to their documents

2. Access the documents from everywhere

3. Share documents with business partners 

4. Do all of this in a very secure manner.

So basically they want to have their cake and eat it too.

The discussion inevitably guides itself towards online document storage.  Google Docs, Windows Live, etc.  It seems perfect: Your documents are available from anywhere, you can share them with others, and it's relatively easy.

So I ask: Why don't you sign up then?

The answer varies from: "Well, you know Google is indexing my documents." to "I don't want Microsoft holding all of my docs." to "I don't trust those sons of a *gun*!"

So, the short answer: TRUST

My question for providers of online document storage: How do you convince your clients that 

a) Their data is safe from intruders? 

b) Their data is safe from you? 

c) Their data is safe from system failure?

Further thoughts that I may write about later include providing a service to your clients that's seamless, flexible, and secure.

In the mean time, any thoughts are welcome.

Cloud Computing Follow up

Here is a follow up article to yesterday's post that talks about the popularity of cloud computing due to recession.

The themes are the same:
1. Low cost of entry
2. Scale up and down ability
3. Trusting your provider

http://www.vnunet.com/vnunet/news/2241326/cloud-converters-showing-big

Let me know what you think!

What Cloud Computing Means for Small Businesses

So you've heard this term "cloud computing" and you're thinking: Just a buzzword for something that has no impact on my life. Well, that may or may not be true.

Buzzword? Yes

Impactful? Potentially

What I will do here is describe to you what cloud computing is (or at least my take on it) and how it may be relevant to small businesses. For those that want the short answer, feel free to scroll down to Give me the SHORT ANSWER!!!.

What is Cloud Computing?
Interestingly, people are still arguing over what cloud computing is, what qualifies as cloud computing and what doesn't, and what the future of it will look like.

Here is what Wikipedia has to say: Cloud computing is a style of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure "in the cloud" that supports them.

Alright, I'm not sure that could be any more vague. But here is my $0.10 version of the definition: Cloud computing is a pay-per-use model of using services on the Internet.

This definition includes services such as Gmail, Google Docs, Google Maps, Payment gateways, and online backups.

Hey! That's just another word for ASP, Software as a Service, or whatever the current buzzword is!

Pretty much. In fact, if you use the Wikipedia definition, "cloud computing" has been around since the 60s where you would purchase time slices on a mainframe.

So what's different now?

What's different is that we can now merge all of these technologies including the Internet, virtualization, web services, and higher available bandwidth to produce offerings that make business sense.

Additionally, groups such as the open cloud manifesto are working to develop standards that allow cloud services to work together!

Now you're losing me. Give me an example!

Fine. I just launched a "virtual" company called Data Knoxx. Here is the approach that I took: Invest in critical infrastructure, and go "pay per use" on everything else.

So in my case, my critical infrastructure is my backup system. I'm not going to trust someone else with that. However, the phone system, web hosting, site monitoring, document storage, and email are all items that are peripheral, but important. The cost of entry is too high for me to invest in all of these systems, but with cloud computing (or Software as a Service), I am able to enable these systems on a pay-per-use model.

Now, what would differentiate these services as cloud computing would be interoperability. Suppose my phone system, web hosting, site monitoring, document storage, and email platforms would all talk to each other on a standard protocol without custom programming? That would be POWER!

This is where it gets interesting!
Some purists will further refine the definition of cloud computing to only include data storage and computing power. So back to the main frame model, I pay for time slices on a shared server and pay by the Gig for storage used on a shared system. That's fine. I'll let the purists argue that one out.


Give me the SHORT ANSWER!!!
However you define cloud computing, what it means to the Small Business CIO is simple: LOW COST OF ENTRY for a PAY PER USE model.

You do not have to invest thousands of dollars up front for you IT infrastructure. Instead, you pay a low monthly fee that increases as your usage (and hopfeully revenue) increases.

One more example
Data Backups. Here is the traditional model of entry into data backups:

Tape Solution
- Purchase a tape drive (or multiple tape drives) - $1,000
- Purchase tapes - $350 for a 10-pack
- Purchase tape backup software - $150 (and that's low)
- Design a tape rotation system - 20hrs effort @ $20/hr = $400

So that's close to $2,000 before you even call Iron Mountain to start picking up your tapes!

USB Solution
- USB drive - $500
- Backup Software - $150
- Design and implement backup system - 20hrs effort @ $20/hr = $400

So that's a $1,000 dollar cost of entry, but make sure that your IT guy takes that drive somewhere safe every night!

Disk to Disk Solution
I won't go into details on this, suffice to say that the cost of purchasing and implementing a server and disk array is over $5,000.

Cloud Computing
- Software licensing - $0
- Set up costs - Figure 10 hrs at $20/hr = $200.
- Data storage - Depends on how much data. Most business plans start around $35/mo.

So that's $235 to get in the door and the majority of that is your person setting up and configuring the software. As your data grows, the running cost will increase, but hopefully by then your revenues are increasing accordingly.

Also, consider the effect of scaling back! Your operational costs instantly decrease as you scale back. You can't give tape drives back when you don't need them anymore!

Conclusion
So that's my take on cloud computing. I'm interested to hear other's thoughts on this new-fangled buzzword.

In the mean time, try out this model for yourself: www.dataknoxx.com

The Modern Method of Organizing Email - Part 2

Last week I described how to organize email and more importantly, how to get Outlook to do it for you. Now comes the fun part: reaping the fruits of Outlook's labour.

The next two under-used features I am about to describe are: groups and search.

** Disclaimer **
I will not describe click-by-click how to do this. That is what those boring blogs with numbered lists and screenshot-itis are for. Actually, help files do this well, too and while I enjoy reading help files, heaven forbid I should actually write one. I am going to assume that you are smart enough to figure out where to click, right-click, and scroll.

What I am going to do here is actually provide some value and describe the high-level "what" and "why" and then you can follow the links at the bottom or use Google for the "how".

** End Disclaimer **

If you followed my instructions last week, you created a folder called "@All Mail" and put all of your email in that folder. You also categorized all of your email using Rules.

Now go to the @All Mail folder and group by category (See Grouping Email below).

Pretty. Isn't it?

If you've done things right, you should see all of your categories in pretty colours as group headers and the email related to those categories beneath the header. Almost like folders but so much better!

You can now browse all of your email by category. If you have emails assigned to multiple categories, they will actually show up under both headings. DO THAT WITH YOUR FANCY FOLDERS!!!

Using last week's examples, this means you will have:

- All email related to a given project together
- All invoices together and also broken out by project
- All email from "The Boss" together

"But don't I have to scroll through hundreds of email for a single project to find what I'm looking for? That's what I had subfolders for!"

Answer: That's what search is for!

"Now I know you don't know what you're talking about. Outlook search SUCKS!"

Almost right. Outlook search USED TO SUCK. Since Outlook XP and Outlook 2007, you can use Windows Desktop Search to provide a fully-integrated, fully indexed search for Outlook. WDS does support older versions, but it's not as seemless.

For versions of Outlook prior to XP/2007, your best options are really LookOut, and Google Desktop. (See here for a good comparision of Google and WDS).

Alright, so I lied to you a little bit last week when I said these tools are "built right into Outlook". But you're still reading, so maybe you'll forgive me this one minor indiscretion.

Now that you have a fully indexed search in Outlook, instead of waiting 20 minutes just to get mediocre search results back, email is automatically indexed and the search has become more powerful.

The Result: It is faster to search than to browse.

Let me repeat that in big letters, because it is very important:

It is faster to search than to browse.

It's true. I would say that I now search 80% of the time and browse 20%. I use browse when I want to view a set of emails in a category. Otherwise, it's almost always search.

Remember how you stopped creating individual folders for every person that sent you email (the thought makes me cringe)?

Try this: Go to "@All Mail" and type in the search bar "from:dave" (no quotes). This assumes you know someone named dave. If you don't, I'll assume you are smart enough to figure out how to search for email from someone named Algernon or Betsy.

If it takes more than 2 seconds to populate the results with all email received from Dave, something went wrong. I hope that at this point, you are asking yourself "Why did I spend all of that time creating folders with people's names?" Good. That means you are paying attention.

"Great. Now I have to learn some intricate search language with monikers, escape sequences, and regular expressions."

Ummmm, no. I didn't. Here are the few searches that I memorized and it gets my 95% of the email I ever need to search for:

• from:
• to:
• date:yesterday or date:today or date:last week
  
• subject:
• category:
• hasattachment:true(this returns all email with attachments)
  
• Or most of the time, I just start typing the keywords that I'm looking for

So if you want to find an email from Bert that had an attachment, you can type: "from:bert hasattachment:true". See here if you want to know more.

That's it!!! If you remember those few keywords, you will never spend more than 30 seconds searching for an email again.

DO THAT WITH YOUR PRETTY FOLDER HIERARCHIES!!!

"But Adam! I hate typing! I just want to click on something and have my email appear."

I can tell you are suffering some separation anxiety from your folders. Fine. Have you heard of "Search Folders"? They rock. Newer versions of Outlook have actually created some for you. They're called things like:

• Categorized Mail
  
• Unread Mail
  
• Large Mail

You can also create your own based on any attribute you can name:

• Sender
• Category
• Email size
• Has attachment
  

Learn more about search folders here: http://office.microsoft.com/en-us/outlook/HA100389111033.aspx

Here are a few other links that tell you specifically how to do the tasks that I describe in this article:

Creating Rules: http://office.microsoft.com/en-us/outlook/HA011366291033.aspx
Grouping Email: http://office.microsoft.com/en-us/outlook/HP052433881033.aspx
Categories: http://office.microsoft.com/en-us/outlook/CH010045671033.aspx

So that's how I handle the overwhelming amount of email that I receive; categories, rules, and search. If you decide that I might now what I'm talking about and give it a try, let me know how it works out for you, what challenges you come up against, or any other random thoughts you might have.

After that, you must think about how you are protecting your email from accidental deletion or system failure.

www.dataknoxx.com

The Modern Method of Organizing Email

Every small business owner, IT Professional, account manager, or really anyone in the business world these days gets email; a LOT of email! This is not news to you. What may be news to you is that there are easy and effective ways to manage your email without installing fancy addons like Xobni or Google Desktop. They're built right into Outlook.

Many people take one of two approaches to handling the deluge of email:

The Architects

You create an intricate structure of folders with hierarchy organized by sender, date, project or some other logical grouping. Then you spend anywhere from 5 to 30 minutes a day creating folders, moving emails, and arranging them. When it's all done, you sit back and enjoy the aesthetically pleasing structure that you have architected.

Just hope that when you're looking for a given email, the property that you chose for your structure is the one that you're using to search with.

Hey Architects! I have news for you:

FOLDERS ARE A WASTE OF TIME!!!

STOP USING THEM!!!

The Ostriches

The other popular method of dealing with email is to leave it all in your Inbox and hope that you can find that needle in the haystack when you need it. Let's call this method the ostrich method because you're really just sticking your head in the sand.

Actually, you may find this surprising, but I find that the ostriches are actually somewhat more evolved than the architects. The ostriches tend to find the "search" capabilities of Outlook rather quickly and train themselves to start typing in the search bar before then even think to reach over to the right for the scrollbar. So if architects are in the 1700s, then the ostriches have discovered the industrial revolution. Progress, but they still haven't reached the 20th century, nevermind current technology.

So what should you do: Organize or Search?

Answer: BOTH!!!

There are two features in Outlook going back to Outlook 97 that not enough people have found: Categories and Rules. That's 12 YEARS people! Grow up! Live a little! Try out the "new" features.

Categories

For those using Gmail, you know everything I'm about to say because categories are really just "Labels" in Google-speak. Categories can be applied to emails to indicate the grouping that they belong in. For example, you can create categories for:

• Projects


• Clients


• Vendors


• Document Types (like invoices, status updates, e-Newsletters)


• Personal vs. Business

Assuming each email is assigned a category (or two, or three), you can easily group them and browse for them. All emails already have a sender/receiver and date/time associated with them, so creating categories for those attributes is redundant.

"But Adam, doesn't that mean that categories are really just folders except without the pretty hierarchy?"

NOT EVEN CLOSE!!!

What categories offer that folders don't are:

1. An email can have multiple categories assigned to it. So if you have an "invoice" from a certain "vendor", you can group it by both properties instead of having to pick one.

2. Your email can stay in the Inbox but already be categorized with pretty colours (that's right, "ou". I'm Canadian).

3. Did I mention the pretty colours?

Suppose I architect a folder hierarchy organized by project. Maybe I even have a subfolder for invoices. I put all invoices from the vendors in the "vendor name"/invoices folder. Now, every time I need to see invoices for that vendor, I just look in that folder. Great.

But now I want to see the invoices from all vendors over the past month. Uh oh. My aesthetically pleasing folder hierarchy just failed me. All that time I spent building folders has actually cost me time because now I have to go through 1 folder per vendor to find all of the invoices. That's an O(n) operation for the Computer Scientists. For the non-computer scientists, it's a waste of time.

Now if I had categories for vendors and "invoices" with all of my email in one big folder, I just change the grouping depending on what type of email I'm looking for.

"But Adam, doesn't it take just as long to assign all of those categories as it does to create folders and drop the emails into them?"

ABSOLUTELY!!!

And that is why we need that second "new" feature called Rules.

Don't run away! You're not going to have to spend two weeks learning an advanced programming language and setting up complicated scenarios and conditions.

RULES ARE EASY!

And you don't have to jump into the deep end. Try this: next time you start a project or start communicating with a new client, take the first email you get, right-click on it, and select "Create Rule".

This next part depends a bit on your situation, but think about the commonalities between the emails you expect to receive from this client or new project; remembering that sender and date/time are already done for you.

Some examples are:

• All emails from this domain (client.com)


• All emails with a given word or acronym (or either) in the subject


• All emails with a given word in the email text

On the next screen, assign a category; create a new one if you have to.

Activate the rule and away you go! Now every time you get an email related to that big project, it is automatically categorized for you.

You have just saved yourself HUNDREDS OF HOURS of categorizing emails as they come in. And for you ostriches, you have added zero work, but are just as organized as the architects. Now every time you receive an email that isn't automatically categorized, create a rule for it. Try to be as inclusive as possible with your rules.

"But Adam, that will take FOREVER!"

No it won't. I was receiving hundreds of emails a day and one week after I started this method, 90% of my email was auto-categorized. If you invest 30 seconds upfront, it will literally save you hours of manual organization and search later.

That's ONE HECK of an ROI!

"But do I just leave everything in my Inbox?"

Not even close

Here are the rules:

1. The Inbox is for email requiring action
2. No email stays in your Inbox more than 7 days.

"So where do all the emails go?"

Fine. You architects get to create one glorious folder. This is the last folder you will ever create, so enjoy it! Your folder is called "@All Mail". It starts with '@' so that it will always appear at the top of the list.

ATTENTION: Stop here if you are in "Inbox camper"
Inbox camping: Process of repeatedly checking your email to see if there is something new to check up on. Especially common as a task-avoidance behavior, and enabled by Outlooks “new post” popup. (http://blogs.msdn.com/ericgu/archive/2004/04/06/108498.aspx)

Now for those disciplined individuals who check your email less than once and hour (see just about every time management book out there), pick one of the following options every time you go through your email or at the end of the day:

1. Grab all emails not requiring action and drag them into the "@All Mail" folder

2. If you like flags (I do), flag the emails requiring action and drag all email from your Inbox into "@All Mail" leaving a beautiful, empty, Inbox.

"But won't Outlook puke with thousands of emails in one folder?"

Maybe. But I've never found that limit. One reason is that I archive any email older than 6 months. For all you pack rats out there who just had a heart attack after reading that last sentence, rest assured I don't delete them. But I do set Outlook to get them out of my working area and out of the way until that odd time when I need to mount the archive.pst folder and search it.

I recommend you do the same or Outlook will eventually slow down to a crawl and you'll post nasty comments on my blog saying that I killed your computer.

"OK smart guy, I did what you said, now I have no folder structure and I need to find my email. What now?"

Now you practice for a week and then check in on Part II: Email Browsing and Searching.

In the mean time, you might also want to think about what you're doing to protect your email from system failure or accidental deletion.

www.dataknoxx.com

Small Business CIO First Post

Welcome to my Blog. Before we get started, let me help you decide if this blog is going to be worth following for you.

This blog is for you if:

• You make IT decisions for a small or medium sized business. As a general rule, that's anywhere from 1 to 100 employees.
• You are the IT lead for a company and make recommendations or design solutions that you bring to the CIO.
• You aren't the IT lead or decision-maker, but want to be.
• You think I'm cool and you want to read what I have to say.

OK, if you're still reading, that means that you fit one of the above criteria (hopefully the last). Now that I have told you about you, how about I tell you about me? That's what the style guides say I should do in order to build that little thing called "credibility".

Why Should I Believe anything Adam Kehler has to say?
Well, you don't have to listen to anything I say, but I do believe that I bring some pretty good experience to my writing. You see, I've been making IT decisions for small businesses for a while now. My first implementation ever was in 1993 and it was called Novell Netware 3.12 implemented on Windows for Workgroups 3.11. You youngsters may not recognize the names, but it was the prize of its time. And boy did I not know a THING! Fortunately, I kept at it, did some more system administration, then after graduating with my Bachelor of Computer Science, moved into software development for a few years.

It's when I became a consultant at one of the "BIG 5" consulting firms that I really got to see what companies were doing in IT and how they could do it better and more cost-effectively. More recently I've spent 4 years implementing and supporting data center solutions for everyone from the mom and pop shop to large credit card companies (I shouldn't say the name, but it starts with V, ends with A, and the middle is...).

Now I have launched an online backup provider which I will probably plug in some of my writings, but I'll try not to be too overt about it. www.dataknoxx.com

OK, So What?
So I have seen a lot of different solutions to a lot of different problems; some good, some bad, some terrible. All that I'm trying to do here is share my thoughts on specific IT topics that may help some of you small business IT professionals make those decisions that you have to make every day.

I hope you find what I have to say entertaining and at least somewhat informative. Please give me feedback and I would love to hear about the types of topics that you want to hear about!

My first word of advice: Have fun!

Adam