Retention benefits your business by mitigating risk, raising the awareness of corporate governance and internal controls, and can improve an organization’s ability to respond to changing business circumstances.  For example, a strong business analytics solution can reduce costs by exposing problems much earlier. Moreover, creating an indexed and searchable email or communications storage system creates a unique company knowledgebase.  Secure archiving stores intellectual property and acts as your business blue print — creating an undeletable record of how your company operates, interacts with customers, etc.

Before discussing with a client about how to implement a customized email archiving plan, it’s first critical to establish an email retention policy, as a retention policy is the basis for most of the technological decisions on a project. An email retention policy keeps archiving projects on track and helps inform most technological decisions along the way.  Additionally, it is also intended to help employees determine what information sent or received by email should be retained and for how long.  For instance, the chosen storage media will depend largely on whether the archiving project is meant solely to reduce the strain on existing storage units, or whether the client also requires it for potential lawsuits or regulatory compliance audits.  Retention policies differ from company to company, and often depend on factors like the regulatory laws that govern each company’s industry, so it’s important to make sure businesses data lifecycle management policies don’t short-circuit its email retention policy.

IM Retention

Equipment choices are changing.  Forecasts of federal IT markets purport mobile Internet and email use will surpass desktop Internet and email use by 2014. Hardware investments will gradually decline as we move toward consolidation, cloud computing, and the move toward less expensive end-user hardware – such as smartphones and tablets.

As we move into 2012, more of the data we access will be hosted.  It has been reported that kids coming out of school don’t have email accounts, but rather live on social networks and messaging products.  And, as files become too large to send via email, downloading services that allow you to share links are vastly quicker and often more smartphone/tablet friendly.

As employees use instant messaging and text messaging on handheld devices more, the risk of an IM or text containing legally significant information is rising. Therefore, companies are starting to look at archiving other forms of communication. Federal compliance includes all records, and that means any material that contains information about a company’s plans, results, policies or performance — anything about a company that can be represented with words or numbers can be considered a business record.

Compliance requirements, security considerations and business needs can all be addressed in a formal, written policy for IM use.  Limiting IM to authorized users, logging and archiving IM conversations covered by regulations, integrating with email archiving, can be accomplished with relevant IT tools.

That said, one of the most important focuses moving into this election year is Privacy.  Yes, unfortunately, it’s likely that an individual or company will be hacked and as a result, will go on the warpath regarding privacy regulation.  Retention and security policies can be managed by auditing any outside firms who have access to your proprietary business data to confirm information is secure. The best offense is having a strong defense.  And, that means executing any additional security measures to protect your most confidential information when and if you need to.

Representatives from all departments in a business should be involved in the development of a plan to ensure all critical systems and processes can recover from any possible data loss activity.

Here are tips on what is needed in a DR “tool kit” to help minimize a disaster’s impact on a business’ IT assets:

1. Inventory all IT assets – Know all the business’ hardware, software and data.
2. Consider server virtualization – By outsourcing hardware dependencies, virtualization minimizes potential lost revenue associated with downtime, outages and failures. It also minimizes upfront capital and operational expenses and provides immediate, tangible and quantifiable cost savings.
3. Offsite data backups are critical – Archives and backups should be stored at an offsite location to ensure that data can be recovered in case of a physical disaster. Businesses already utilizing Cloud technologies should ask important questions about data recovery – is there a service level agreement/are there uptime guarantees, are there protocols in the event of an outage, and is there a backup protocol/scheme? Have an option to switch cloud providers and a plan to recover the company’s information if necessary.
4. Establish processes so backups occur regularly –Businesses need to perform nightly and weekly backups. IT systems can be brought down for a variety of reasons — hardware failure, human error, natural disaster or improper security processes. It is critical to back up data regularly, store extra copies of this data offsite and audit these processes frequently.
5. Create a disaster recovery committee – A committee should include the IT department, IT executives, HR and any other appropriate business managers. The plan should be reviewed at executive meetings to ensure all parties understand the process.
6. Draft the plan – Formally document the DR plan in writing and keep printed copies of the recovery plan in several secure locations, and at the recovery site. If the plan is unknown to those affected, it will be useless when the time comes to initiate recovery operations.
7. Test the solution. Regularly test the Recovery Plan to ensure it is practicable. Testing the plan will also act as a training tool; those representatives who performed the recovery procedures during regular testing will be familiar with the plan and able to perform the required actions, if/when necessary.

An October 2009 study conducted by Radicati Group estimated that the global market for archiving will grow from nearly $2.1 billion in 2009 to more than $5.1 billion in 2013. As a result of this growth, there are options for archiving emails including on a user’s machine, in hard copy or in a cloud environment.

With the cloud, organizations can now access email archiving tools over the Internet for a small, affordable fee. SMBs already on a cloud or entering cloud computing should look at cloud archiving solutions through SaaS for lower entry costs and a nominal monthly subscription. Cloud-based email archiving is budget-friendly with a per mailbox, per month pricing structure. There is no need for expensive hardware or software.

Getting the Inbox Under Control:

1. It is important for businesses to comply with relevant federal regulations including Sarbanes-Oxley Act (SOX), Health Insurance Portability Accountability Act (HIPPA), the December 2006 amendments to the Federal Rules of Civil Procedure, among others. The SOX Act states that all public companies must have a method for storing and managing records. The Federal Rules of Civil Procedure states that businesses that have the potential to be involved in lawsuits must be prepared to turn over email communications, if requested.
2. Email archiving ensures that all information including client communications, documents, records, contracts and invoices are stored, backed-up and protected in a central location on an ongoing basis. This provides easy access to files by all employees, especially those who telecommute or are traveling on business.
3. Archiving solutions have search and discovery tools built into them to ensure that companies can obtain specific information whenever they need to access it, quickly and accurately.
4. Emails can contain important business information that may not be documented in a specific file; email archiving will preserve the knowledge contained in email communication. It is important to work with the HR department to make sure users are complying with company policies.
5. Consult with your Legal department to be certain the archiving method meets any contractual requirements or legal orders. In the future, your business may need to produce historical email records.

Advancements in technology, such as remote access, mobile platforms, and virtual private network (VPN), allow employees to work from virtually anywhere. Whether a business allows employees to work remotely once-a-week or several days per week, it is essential that a business sets up a comprehensive telecommuting plan.

The VPN provides encryption between the employee working on their home/remote connection and the office’s network. To gain access to the VPN, some systems use one-factor authentication which requires a user name and password. Other services use two-factor authentication for added security.

It is also important to consider implementing a network access control (NAC) device. This device queries each PC before granting it network access; it will check if an antivirus tool is installed. The NAC can also check if the PC has a firewall and current security patches.

For businesses that retain credit card information or other confidential data, consider installing a third-party application on company PCs that can disable external USB devices when a user is logged in to an office network via VPN. By doing this, sensitive data prevents a remote employee from downloading client data. If the software detects the presence of an external USB device, it will terminate the connection.

Many small- and medium-sized businesses should utilize cloud-based productivity and collaboration platforms such as Box.net, Dropbox, SugarSync, Google Docs, Microsoft’s Office 365 and Syncplicity as they provide a means of sharing information between remote co-workers. These services are plentiful; they also support green initiatives by essentially allowing telecommuters to share resources.

To ensure a secure telecommuting program is in place, it is important that a business works with a knowledgeable partner who will map out the best strategy and offer the most effective recommendations. The number of telecommuters is only going to continue to grow.

Here are 10 ways a business can best protect its computers, the data and its networks:

1. Create strong passwords: A good password is often underestimated.  The stronger a password the harder it will be to crack even with the latest password-cracking software.  Passwords should contain characters that include a combination of uppercase and lowercase letters, numbers and symbols.
2. Follow IT department recommendations: Install all of the recommended patches and updates; these regular installations will keep computers and networks as secure as possible.
3. Don’t enable the Save Password option: It should be mandatory for the user to enter passwords on all operating systems or application settings. Choose no if a dialog box prompts a reminder about the password.
4. Lock computers: Whether a user is away from his/her computer for a few minutes or a few hours lock the screen. Also, set the computer to lock itself after a specified amount of time idle.
5. Questionable emails: Never open an email that appears questionable; rather forward it to the IT administrator to verify before the email is opened.
6. Use VPN: A VPN (Virtual Private Network) lets remote workers log into the network securely.
7. Get a firewall: A firewall acts as the first line of defense on any network.  Without one, your network is exposed to the world.
8. Scan networks: Networks should be scanned to see what ports are open; if there are open ports that should not be open, go to the firewall to make the necessary revisions.
9. Turn on compatible WPA Encryption: All Wi-Fi equipment supports some form of encryption; encryption technology limits connectivity scrambles messages sent over wireless networks so that they cannot be easily read. Pick the strongest form of encryption that works with the business’ wireless network.
10. Use the Junk Email Filter in Outlook: Since some spam can include potentially harmful viruses that can damage company’s computers and networks, set up the Junk Email Filter to reduce the amount of junk email to the In Box.

A combination of hardware and software security practices will help to reduce the risks and lessen the potential attacks to small businesses computers and networks. A business’ network and data are too important to be compromised.

Here are a few of those options:

1. Donate: Support PC recycling programs such as Rockville, Maryland’s Project Reboot, a 501(c)(3) non-profit organization (located in the Dataprise community) that donates old/unneeded computer equipment. Old computers will be given a new life, as they will be wiped clean, repaired and upgraded, and then provided to families, senior centers, religious organization and other local charities that really need them. Donations may be tax-deductible to the fullest extent permitted by law.

   I am proud to mention that our certified network engineers volunteer their time with Project Reboot and pick up unwanted computers, monitors and peripherals, wipe them clean, perform diagnostics, and make repairs and upgrades, preparing them for use.

2. Sell the PCs: To offset the cost of new equipment, consider selling old computers.
3. Upgrade Equipment: A SMB can extend the life of its hardware by investing in a few upgrades. Many computers and desktops are designed to be upgraded and memory, hard drives, graphic adapters, and even system boards and processors may be replaced with newer, more powerful components. Investing in upgrades could significantly enhance the PC’s performance, increasing its usability for years and at a fraction of the cost of a new system. It is recommended to first increase the memory – the amount of RAM—which will produce the biggest improvements in overall system performance for the money.
4. Repurpose Computers: As a computer ages its usefulness as a generator of employee productivity diminishes. However, computers that are not cutting-edge can still work perfectly well in a number of roles. Consider setting up an older PC in the conference room or the lobby for guests and clients check their email or simply browse the Web. Use it for displaying presentations.
5. Be Green and Recycle! Computers contain hazardous materials and plenty of recyclable material; consider recycling and don’t toss them in the trash. Recycling centers are available on the U.S. Environmental Protection Agency website or Earth911. In fact, in our community, a donation to Project Reboot supports green initiatives by reducing the amount of computer equipment tossed into local landfills. It is estimated that each week more than 16 tons of computer equipment is dumped into Montgomery County landfills alone.

Finally one important point to note is that whichever option a SMB chooses, it is imperative that hard drives are wiped of all information. Perform a proper security wipe to sufficiently destroy the data on all computers.

Sony addressed its more than 70 million global PSN customers by posting an update on its blog alerting customers that credit card numbers (excluding security code) and expiration date may have been obtained. At the posting of this blog, their network is still not completely restored.

While my blogs are traditionally focused on small and medium sized businesses, in light of these recent security breaches, I thought it would be important to provide a few tips on avoiding virus attacks, identify theft or other security breaches.  Many Internet security issues are preventable and only require a few computer updates and of course, some common sense.

Tips to protect data from theft and identify fraud before and after a security breach:

1. Change passwords regularly. Users tend to re-use passwords – change all email security passwords for everything – Facebook, online banking, etc. on a regular basis.
2. Never send credit card or personal information in an email.  Email is completely unsecure and easily intercepted.
3. Watch personal and business credit cards. If there is even a possibility a credit card number has been compromised, immediately cancel the card.
4. Revise security questions and answers for everything on a regular basis.
5. Be concerned about suspicious phone calls. Never provide personal information.
6. Delete anything that looks like spam!
7. Rely on the preview window in an email program for protection.
8. Never click on links within emails. Scammers often mask a link in an email to make it look legitimate.   Only open attachments and links in emails from known senders.
9. Consider storing passwords digitally. PC users may consider RoboForm, which offers a free version and a paid one for moderate-to-heavy web users and secures login information, web forms and notes with sensitive data.
10. Put into place strong email security measures – anti-spam, anti-phishing and anti-virus solutions.

Like any business, SMBs want to keep costs under control. They are not looking to purchase additional infrastructure, servers, application programs and operation systems for use at their own premises. That’s where the cloud comes into the picture.  Cloud hosting enables a business to run its websites or any other computing service on one or more virtual servers, making cloud hosting an extremely popular and valuable service.

Cloud computing is an on-demand subscription model, enabling on-demand access to reliable and configurable resources that can be quickly provisioned and released. An SMB pays only for the resources it uses making cloud computing a huge advantage.

Top cloud computing benefits for SMBs include:

1. Reduced costs: Cloud computing reduces an SMB’s costs for computers, software, networking management and overall IT expenses. With cloud computing, a business pays only for what it uses.
2. Automatic Updates: There is no need to worry about future software and hardware updates; since the software and equipment is centrally-located.
3. Remote Access:  Anyone can access and update information wherever they are working.
4. Disaster Recovery Protection: With data safely stored in secure data centers instead of a server room, losing power due to a thunderstorm or a cut power line is no big deal as cloud providers have backups and redundancies in place.
5. An Effective Solution for the SMB: A small business can utilize the same tools that Fortune 100 companies use and can do this because with the cloud a business will only pay for what it needs.
6. Deploy Projects Faster – A standard server installation can take weeks; ordering hardware, installing software, etc. With a cloud, a service provider can have new computing power implemented with a single phone call or support ticket.
7. Green Computing – Being green is key these days; cloud computing uses less energy than traditional data centers.

There are many benefits to cloud computing.  Whether a business selects a public or private cloud, implementation will depend on its application, performance, security and compliance requirements, but with the proper deployment, cloud computing can provide significant savings, effective IT services, and a higher level of reliability.