Back to the future

Eight years ago around this time, I was busy in my secret lab cooking up my latest and greatest geeky tech project. A little scripting here, some hardware and networking there…not unlike the countless other times I’ve done this since my Dad bought my first computer (Commodore 64) when I was twelve. Except this time I was doing a proof of concept for a magazine article while working as the Senior Consultant for a Managed Service Provider. I guess that investment in my first computer paid off. Thanks, Dad!

Hakin9 Extra – Guide to Kali Linux: Kali Scanning for HIPAA

I was asked by Hakin9 Magazine to write an article for their (then) upcoming “Guide to Kali Linux”. But before we get to that, some background first – Linux is a popular free and open source operating system developed by Linus Torvalds. He created the new platform because he did not want to pay the expensive licensing fees for Unix, which was the operating system used in his university computer science courses. Today, Linux is the operating system that runs most of the Internet services we use every day. While many in the community debate whether “free” means “as in beer” or “as in speech”, Linux can be downloaded at no cost which makes it perfect for tech-savvy IT professionals who are seeking to build low-cost systems for niche applications. Windows and Microsoft Office are the business standard so Linux is not a recommended alternative for general business computing.

Kali Linux is what is called a Linux distribution or “distro” for short. Basically, it is a version of Linux with preinstalled applications and tools. Distros run the gamut from general purpose computing to niche applications. Kali, for example, is a security distribution and comes with computer forensic, penetration testing, and vulnerability scanning tools. It is the latter that was the focus of writing the magazine article. Specifically, how a low-cost, distributed system running Kali Linux on top of Raspberry Pi hardware (low cost non-Intel PC) could be used in the Healthcare industry to support HIPAA compliance. I chose OpenVAS as the application for vulnerability scanning.

The results from the proof of concept demonstrated the RPi+(Kali) Linux+OpenVAS combination was viable as an ad-hoc tool and could be further developed into an integrated, distributed reporting system. The gory technical details from the article can be found here: Hakin9 Extra – Guide to Kali Linux: Kali Scanning for HIPAA.

Back to the present

So what’s changed in the last eight years? In some ways, not much. In other ways, everything. Tools like Kali Linux are still useful and part of the solution. What has changed is the ever-evolving threat landscape and the cost of doing business due to the added layers of security needed to maintain business as usual. We have written other articles on defense-in-depth so I won’t get in the weeds on that topic here, but it is no longer the medical and financial industries (or other regulated business), but all businesses large and small that must invest in security to reduce risk and protect their business operations and data. The phrase often attributed to Vince Lombardi comes to mind, “Hope is not a strategy.”

Call to action

Great, we’ve identified a business problem…so now what?! Here’s the high level recipe for building an effective security strategy:

  1. Discuss the need for addressing security with the top levels of the organization. This cannot be a bottom-up initiative. Too much is at stake.
  2. Work with a trusted technology/security partner to explore options.
  3. Invest in educating yourself and your team about the risks and how implementing security tools and best practices help mitigate these risks.
  4. Measure the effectiveness of your security program to understand residual risk.
  5. Rinse and repeat.

With an intentional focus on security and developing a plan to monitor and assess its effectiveness over time, your business can reduce risk of data loss and downtime. Much like how Linux is not for the faint of heart, Information Security can be tough to understand, so IT professionals are happy to work with you to formulate a winning game plan. Be like Lombardi and don’t just hope the problem will go away on its own!

Inside What?

Does the current pandemic have your company turned inside out?  Hopefully not, but maybe some other crisis will.  Why not just go ahead and turn your company inside out on purpose?!  Better on your terms than something external.  Let me explain.  Today I am working from home, productive, but under quarantine (exposed, but so far symptom free, and I thank God for that).  This is not the first time I have had to work like this.  In a prior company, I was the VP of Service for a prominent Middle Georgia Managed Services Provider (MSP).  Like Total Computer Solutions, we provided a full compliment of outsourced IT staff to aid local small businesses.  From Virtual CIO (read: IT Director) to Service Coordinator to Help Desk Technicians and Engineers, the resources in my department were critical to support the strategic mission of a business down to the day-to-day computer problems.  As with that business, there were (and are today) a variety of conditions which made working from home a luxury on some occasions and an absolute necessity in others – ice storms, local flooding, power outages, and today – pandemics.  Who had COVID-19 on their Bingo card for 2020?  Today, I am the COO for TCS which means I am responsible for the operations of Service, Sales, and Finance – Facilities and Human Resources are also shared responsibilities in our core departments.

But this article is not about me or my background…more about YOUR business strategy.  This is an opportunity for me to share how prior planning and enhanced technical capabilities can enable your business and work force to thrive under similar work from home scenarios.  I am going to share with you my secret to business continuity turning your business inside out.  If the concept of Disaster Recovery/Business Continuity is new to you, a little Google-Fu will produce a wealth of information on the topic.  Simply put, DRBC is the planning and development of capabilities to recover full business operations from a disaster while maintaining some level of functionality during the recovery effort.  I can work from home today, with minimal impact to my ability to communicate and coordinate our business operations, due to some advanced planning and the right mix of technologies.  But I am getting ahead of myself.

Company Culture for $200

It really starts with culture.  Company culture is the foundation upon which the rest of the business grows and thrives.  Without the right culture and management structure, keeping team cohesion and productivity during adverse business conditions can be difficult, if not downright impossible.  Fortunately, I have had great mentors in my career and picked up some tools along the way to help build and support a healthy culture around our people, process, and products.  For an MSP, our product is really our people.  True, we do sell stuff, but it is largely commodity goods and not the real differentiator between a good MSP and a bad one – the key is our team and we cannot thrive without a solid culture in place.  Our CEO Michael Collins is the primary champion of our culture here at TCS, so he and I have a Batman and Robin approach to reinforcing our values and team environment from the big picture down to everyday decisions.  This must be baked into the DNA of who you are as an organization.

Business structure must enable and support this culture.  We also use the Entrepreneurial Operating System (EOS) to drive the management of our business.  Rob Betzel, a friend who also happens to be my former boss, is a great local coach for both Company Culture and EOS.  I am forever grateful to him and others who have invested their time and energy into equipping me with the management principles and tools I have today.  Who knew you could make business leaders out of computer geeks?!  With a good management system/tools in place…we have a very high powered engine.  But what good is this high powered, superbly crafted engine without the proper fuel?

Culture is that fuel.  Everyday we fill the business engine with a tank of clean-burning high octane or some concoction of low octane fuel with lead, sulphur, water, and other contaminates.  Your company values, lived out, are the ingredients.  They cannot be merely a sign on the wall or words on your web site.  Integrity, teamwork, professionalism, accountability, and other key traits are the essential ingredients to maintaining workforce productivity, especially when working remote.  Sometimes, as managers, we have to make very tough decisions about who remains on the team when these values are not upheld.  Proper coaching and positive reinforcement can often help a struggling employee, but the best time to get this right is in the hiring process.  Having to micromanage an employee to get them to do their job well in the office simply is not going to work under these new conditions.  If you do not have this right yet, DO NOT PASS GO, DO NOT COLLECT $200 until you have this fixed.  As mentioned here, there is a wealth of local talent who can help you with this.

Communicate and Collaborate

Okay, company culture is good?  Check.  Now to turn your business inside out.  This really centers on communication and collaboration.  Here is what I mean by that (and this is the big secret) – design your business technology around having a mobile workforce who happens to work inside your building at times…cutting the corporate tether so to speak.  Easier said than done, for sure.  The planning and implementation must be a strategic top-down initiative.  On a side note, technology should always be connected to business strategy rather than existing for its own sake, letting the tail wag the dog.  In other words, bend technology around the needs of the users rather than the other way around.  And this strategy is more straightforward for companies primarily with knowledge workers as opposed to skilled labor who perform their work on the job site.  Even for skilled labor, their hub can be moved from the office to home (or an ad-hoc office) and dispatched to work onsite rather than reporting to the office first.  And for organizations who deliver their primary services onsite (i.e.: healthcare), support positions can often be moved off premise for the sake of distancing.  Telemedicine has emerged out of this trend.  There is no one size fits all solution, and these nuances must be considered.

Essentially this means formulating a cloud-centric but locally supported business technology infrastructure.  Consider moving employees to laptops with docking stations versus workstations.  This immediately enables mobility.  Voice communications – hosted phone system with softphones that run on your PC or even using your cell phone to make and receive calls using your business line.  Move QuickBooks online…easy.  You have already moved your email to O365, right?  RIGHT?!  Utilize Microsoft’s 365 suite beyond email to sync your documents to the cloud – no need for a file server or NAS is many cases.  Cloud-to-cloud backup is needed to protect your data no longer on premise.  MS Teams can be used for business chat along with audio/video conferencing.

In fact, yesterday I ran our weekly management meeting using Teams and was able to facilitate the meeting with no loss of productivity while working from home this week.  Management scored me an across the board 9 out of 10 for running the meeting which is pretty good considering the tough audience I serve.  Yes, we are results focused enough to score facilitating meetings (thanks again to EOS).  Shared management scorecard, no problem – click save and the rest of the team automatically gets the updates via cloud sync in the background.  With Microsoft 365 we can even edit Word documents and Excel spreadsheets as a group, live in the document at the same time.

Often critical line of business applications are the toughest nuts to crack.  The best option may be to keep what you have, even if that means on premise servers for now, and see if your application vendor offers a cloud hosted solution (sometimes you will see this advertised as SaaS – Software as a Service).  Cloud is not cheaper, but the benefits often make sense given the flexibility it offers along with a more robust business capability.  If you have already made that move, kudos!  Otherwise, TCS can facilitate a process for you to evaluate and identify a new vendor who offers this critical capability.

A side benefit of moving to a subscription “as a Service” model for consuming IT services is a more predictable and flat operational cost (OpEx) as opposed to large periodic or sometimes unpredictable capital expenditures (CapEx).  This is a main reason why MSPs operate under fixed-fee monthly contracts.  You are paying for an outsourced and fully staffed IT department, not simply an hourly rate to fix your latest application error.  Your technology infrastructure is a very dynamic environment that must be watered and fed to keep it running efficiently.  And moving to the cloud doesn’t mean your support needs magically disappear, it simply moves the management to the other side of the Internet wire.  Be sure you have an experienced technology partner to help you navigate these waters.  Having a handyman for odd jobs is fine, but you wouldn’t build a new house without a qualified architect.

Don’t You…Forget About (Securing) Me!

Culture, communication, and collaboration are in order, great!  My pastor would be proud my 3-point alliteration.  Ah, but we have a 4th point…security (or Cybersecurity gets me to 4 Cs).  We cannot overlook security in all of this.  Believe it or not, this Inside Out approach can improve your business security.  Yes, we have firewalls, encrypted wireless, content filters inside the office, but the most effective security (read: defense in depth) strategy is to assume your corporate network is what security experts refer to it as the “soft gooey middle”.  Simply put, start by assuming your office network is not safe and build defenses around your endpoints and applications.  When those are secure, along with a VPN or other secure remote access technologies, the reach of your information systems can be safely extended and working from Starbucks can be just as safe as the towering defenses of the ubiquitous grey office cube with its mystical, magical, always impervious to outside threats, wired ethernet connection (tongue firmly in cheek).

And all the stuff you have now moved to the cloud, it must be secured as well.  Wrap a security layer around O365 email to protect against phishing attacks, for example  If you are a regulated business (and who isn’t these days?), there are particular requirements for how your security is implemented and this also affects which cloud vendor(s) you choose.  Who owns your data?  Where is it physically stored?  Can you get your data back if needed?  As you guessed, there is no cookie cutter approach and security is best designed and managed by trusted professionals who understand the vulnerabilities and regulatory requirements along with appropriate risk mitigation strategies.

Wrapping It Up

TLDR; In summary, with the right company culture and structure, along with the appropriate mix of secure business technologies, your organization can remain business as usual through events that would cripple lesser equipped companies.  This Inside Out strategy takes what would otherwise be an existential threat and turns into a competitive strength.  Total Computer Solutions can design and support this sort of environment for your business and make “Turning Your Business Inside Out” a positive.  We would love to engage with you whether you are an existing contract client or have questions about how TCS can assess your business technology, partner with you, and help road map a strategy that is right sized for your organization.  We are all neighbors serving neighbors after all and TCS has been in that business for over 33 years.

Want More?  TCS Recommended Reading Includes: