Posts

Partner for Productivity

Partnering for G Suite Productivity

Partner for ProductivityG Suite is more than an email, calendar, and simple file sharing service.  G Suite is a productivity suite that serves as a platform for a range of tools that helps your team, and your business, work more effectively.

9 ways your team can be more productive with G Suite:

  1. Share Files, Not Copies:
    Stop sending attachments. Stop wasting time figuring out of the copy of the file in you inbox, on your local drive, or on a shared folder is the most current. Whether you use Google Docs for creating documents, spreadsheets, and presentations or you continuing using Microsoft Office, Google Drive and Team Drives serves your files rather than just sharing them.  People share via link, so all comments, suggestions, and edits are made within a single copy of the file. Versioning keeps this orderly and gives you the ability to look back and compare.
  2. Serve Files, Not File Servers:
    Use Team Drives and Drive File Stream to provide users with “explorer” access to files from Macs, PCs, and local software. Store files under central ownership and managed permissions; avoid performance and capacity problems with unlimited storage. Allow team members to work remotely and securely on computers, tablets, and mobile devices without VPNs and remote desktop services slowing things down.
  3. Communicate, Don’t Just Text:
    Most laptops now have microphones, speakers, and Bluetooth features similar to your smartphones and tablets. Have face to face conversations using Hangouts Meet instead of long email threads, phone tag, or text messaging. Communication is 55% non-verbal. Let you employees see and hear each other, your vendors, and your customers. You can share screens to live document reviews and discussions. Why pay extra for a conferencing service?
  4. Collaboration, Don’t Just Comment:
    True, Google Docs allow contributors to comment and suggest edits. You can also collaborate in real-time or as each participant is able. Version history lets you look back at who contributed, when, and where. You can name versions to track official revisions or specific working copies of documents.
  5. Schedule Productivity, Not Just Appointments:
    Your personal and shared calendars track your time as well as project or team activities. Resource calendars let you book rooms or any scheduled resource. Integrated with Hangout Meets, automatically include voice and video conferencing for the human touch. Integrated with Chrome for Meetings and you have 1-click video conferencing with screen sharing in your conference rooms.
  6. Manage Customer Relationships, Not Data:
    Integrated CRM applications, automatically pull person and company data into your CRM records and automatically track inbound and outbound emails with your prospects. Side panel gives you “pane of glass” access and context from within your Gmail inbox.
  7. Manage Communications, Not Data:
    Integrated sales and marketing tools, empower you team to better manage marketing, sales, and service communications without leaving your Gmail inbox.  Templates, mail merge, and tracking save time and energy as you drive your sales pipeline forward.
  8. Automate Tasks, Not People:
    Automate workflows and repetitive tasks, and build simple apps to boost productivity with AppMaker. The Low-code/no-code tool means you don’t need a cadre of programmers. Free up task time for more valuable activities.
  9. Protect Your Business; Not Just Data:
    Compliant archiving and e-discovery covers your email communications and your documents. Integrated solutions provide third party backup/recovery protection from accidental or intentional damage and loss. Cloud-to-cloud backup is less costly and requires less admin effort than traditional file server protection services.

Get the most value from your G Suite platform:

  • Verify you are on the right version of G Suite, with the capabilities that best meet your needs
  • Help your team learn how to use the G Suite apps to their fullest
  • Integrate 3rd party solutions for line of business needs, such as marketing, sales, and service

Please contact us for a free Cloud Advisor session to discuss getting the most value from G Suite.


 

Echo of Non-Compliance

Everyday, we hear about new ways we can use our smart speakers. Retailers, radio stations, product companies, and others remind us that we can use our Amazon Echo or Google Home to buy, listen, or learn. The term “smart speaker”, however, is misleading.  These are microphones and they are always listening. They are also likely recording everything they hear.

If you are covered by HIPAA or other privacy regulations, do not talk about protected information within earshot of Alexa.

This warning stems from a 2015 murder case in Arkansas. Believing that the Amazon Echo may have “heard” a murder, the District Attorney subpoenaed any recordings that Amazon may keep from the device. Amazon fought the decision on First Amendment and privacy rights, not by claiming that it was not recording. Amazon did not deny having recordings.

The issue for data privacy compliance is that your smart speaker may be listening to and recording conversations you have about protected information.  Allowing this is a violation of HIPAA and other regulations protecting personal identifying information (PII).

When is your Amazon Echo recording?

The short answer is: we are not sure, but maybe always.

Looking at the Alexa Terms of Use, Amazon tells us “Alexa streams audio to the cloud when you interact with Alexa” and “Alexa uses recordings of your voice to create an acoustic profile of your voice characteristics.” Alexa use is also covered by the Amazon Privacy Notice, which states, “We receive and store any information you enter on our Web site or give us in any other way.”

While Amazon tells us they are recording your “Hey, Alexa” commands, the Terms of Use and Privacy Notice are a bit more ambiguous. Neither document tells us that Amazon records only when listing and processing commands. Nor do the policies limit Amazon’s recording to those commands. We do not know, for sure, when Amazon is not recording what it hears on your Echo.

Better Safe Than Sorry

When speaking about sensitive or protected information, stay away from your “smart speaker” or manually mute the device.


One more thought:  Ever notice how after certain conversations, you see ads on Facebook related to the topic discussed?  Unless you turn off microphone access, Facebook is using your phone to listen to your conversations, analyze what you say, and profile you. Letting Facebook listen is another potential HIPAA and PII breach.


 

Rules and Regulations

Rules, Regulations, and Results

Rules and RegulationsFor Small and Midsize Enterprises (SMEs), the regulatory landscape remains in a perpetual state of flux with changes originating at the Federal, state, and local levels. While some rules and regulations can severely impact your business’ operations, and profitability, many create requirements that you can easily satisfy at a nominal cost.

Three regulations with upcoming deadlines or increased enforcement include:

HIPAA

HIPAA compliance is a requirement for any organization that works with personal health information of individuals — not just medical offices and insurance firms. If you are sharing employee information about benefits, insurance coverage, medical leaves, or other items that involve personal health information (PHI), you have an obligation to protect the PHI. Failure to do so can result in heavy fines and, in a few instances, criminal charges.

Historically, HIPAA compliance has focused on medical practices, insurance, and brokers. We are starting to see audits of non-medical companies, along with fines for those not in compliance. 

Fortunately, you can protect PHI by focusing on the individuals that are authorized or likely to handle sensitive employee information.  By focusing on HR, payroll, and key executive and leadership roles, you can deploy services like message-level email encryption.

What to do:

  • For as little as $5 or $6 per user per month, you can ensure that specific individuals protect PHI and sensitive information while preventing accidental disclosure
  • Contact us for information about encryption, DLP, and other HIPAA solutions.

ELD

Starting December 18, 2017, all interstate trucks in the US must use an Electronic Logging Device (ELD) to track operations and required reporting.  According to the US Department of Transportation (USDOT), fewer than 1/3 of interstate trucks have installed ELDs as of mid-November. Failure to comply can result in heavy fines, impounding of vehicles, and disruption of delivery schedules.

While enforcement is not expected to impact small and midsize trucking firms until late spring or summer of next year, your business can still be at risk.

Here are a few things to note:

  • If you have your own truck(s), they may be classified or registered as Interstate Trucks, even if you only deliver within your state.
  • If you use third parties for shipping, their failure to comply can disrupt your deliveries if trucks are stopped or impounded, or if drivers are pulled off the road.

What to do:

  • Check your own vehicles:
    • Determine if they are properly registered as Interstate Trucks, or if they should be registered as such
    • If you do not have ELDs yet, please contact us for low cost, self-install ELDs with logging software subscriptions
  • Check with your shipper(s):
    • Confirm their trucks, those of their subcontractors, and any owner/operators are properly registered and have ELDs
    • If not, have them contact us for help

GDPR

Effective May 25, 2018, the European Union (EU) General Data Protection Regulation (GDPR) takes effect. While GDPR covers data protection and privacy for citizens of EU member states, treaties allow enforcement in action against US companies operating within the US.

If you have any personal data for citizens of EU member states, you are responsible for GDPR compliance.

GDPR means more than encrypting sensitive data.  GDPR includes processes and procedures for governance, including:

  • A named Data Protection Officer (DPO) responsible for oversight, compliance, and response to individual inquiries. The DPO role can be full time or part time, internal or contracted.
  • You must report suspected breaches within 72 hours of becoming aware of the issue.
  • You need to deploy privacy by design — any new system or change in systems requires primary consideration of privacy and information security.
  • You must be able to demonstrate that you mitigate risk, even in the absence of a privacy breach.

Fortunately for most SME’s the appropriate policy changes and the risk-mitigation technologies need not be expensive of complicated.

What to do:

  • Discuss GDPR with your team, and your legal counsel, to determine your required compliance
  • Provide training, education, and “cultural support” for a data privacy mindset within your organization
  • Review systems storing or processing personal information for security and privacy compliance
  • Select and deploy relevant data loss prevention (risk mitigation) solutions for your environment

Need help? Contact us for more information.


 

News from Cumulus Global

SMBs Benefit from Tech and Policy Mashup

Westborough, MA – Faced with increasing regulations and a changing technology landscape, small and midsize businesses (SMBs) struggle to ensure compliance and maintain data privacy. With the sophistication of rasonmware attacks and advanced persistent threats, employee awareness and behavior is more important than ever. Cloud technology makes it easier to share, even when sharing is not appropriate.

To help SMBs tackle these challenges, Cumulus Global (www.cumulusglobal.com) and Privacy Ref (www.privacyref.com) announced a unique partnership designed to help SMBs assess their needs and risks, plan and implement sound privacy practices, and respond to threats and potential breaches.

“Smaller businesses face the same regulations and requirements of large corporations,” noted Bob Siegel, Founder and President of Privacy Ref. “SMBs generally do not have the internal resources and expertise to create and manage a privacy program. This partnership gives SMBs a place to turn for guidance, expertise, and results.”

In addition to privacy assessments and policy updates, the Privacy Education Programs provides SMBs with the awareness education and training needed to ensure employees understand the risks and their role in preventing attacks and breaches.

“Our role is to ensure businesses can avoid and prevent malware attacks and data breaches,” noted Allen Falcon, CEO and Pragmatic Evangelist at Cumulus Global. “We ensure that the protecting technology, policies and procedures, and people are working together for the greatest level of protection.”

Through the partnership, SMBs also gain access to a range of data protection and recovery services and tools. These tools help prevent attacks and breaches and facilitate response and recovery if needed.

Our First eBook: 7 Policies for Every Company Using Drive

Cover.7 Policies for Every Company Using Drive
We are please to announce the launch of our new eBook series with the publication of 7 Policies for Every Company Using Drive. Based on one of our most popular 3T@3 Webcasts, this eBook discusses information privacy and security issues and policies that should be in place to protect your customers, your information, and your business.

Our new eBook series is part of our growing suite of resources intended to help educate and inform on topics related to Cloud Computing for Small and Mid-Size Businesses.

Click here to access the eBook.

 

 

Define the Role of Your Cloud File Service

Experts Exchange.Standard.200

This blog post is a reprint of an article first published on Experts Exchange as part of a series on cloud strategies and issues for small and mid-size businesses.

 


Cloud file services can fill many different roles for your business. Often, the use of cloud file services begins with employees using consumer products, like Dropbox, to share files with customers and each other. While sync-and-share can be an effective way to manage files, you should always rely on the business editions to ensure that the business is in possession of, and is managing, your data.

That said, this use of sync-and-share tends to be transient in nature. At the other end of the spectrum, many businesses are replacing on-premise servers, NAS, and SANs with cloud file services, which become the primary file service.
To help you plan how to create the best file service for your business, consider these working definitions and considerations with respect to data protection and management.

Transient File Service

  • Transient file services are used occasionally for storage and sharing of files.
  • Often a sync-and-share service (Dropbox, box.net, etc) or a peer-to-peer service (Drive, etc.), files are copied to the file service and shared.
  • In most cases, files sync back, or are manually copied, to their primary location. As the primary location for files is protected by backups and permissions management, transient file service generally don’t need or have backup protection.
  • Permissions management is often the responsibility of the individual users. As such, transient file services should not be used for sensitive or protected (PHI, PCI, etc) information.

Secondary File Service

  • A Secondary File Service will fill the role that the Transient File Service provides, but will also be the home — the system of record — for some information.
  • Companies create Secondary File Services to handle information that is used collaboratively, but wants to keep internally-used data and critical business information in-house. An architecture firm, for example, might have active projects residing in a cloud file service while keeping past project data and internal operations (HR, finance, accounting, strategy) on in-house systems.
  • While sync-and-share can serve the needs of secondary file server, peer-to-peer and managed file services provide better control over your data.
  • As a Secondary File Service will be the system-of-record for important information (i.e., the data is not synced or copied to other storage), these file services should be protected by Backups.
  • Secondary File Services may or may not be used for sensitive or protected information. If they are, then active permissions monitoring and management is advised to prevent inappropriate disclosures, leaks, or breaches.​

Primary File Service

  • A Primary File Service becomes the system of record for most, if not all, of your company’s files and data. As such, the cloud file service will hold sensitive and protected data.  Access, permissions, and protection are as critical in the cloud as they are on-premise.
  • Backup/recovery and active permissions management become critical components for ensuring data reliability, security, and privacy, and may be required for regulatory or industry compliance.
  • While smaller businesses can use the peer-to-peer, larger businesses or those with larger numbers of files find that a managed and structured file service works better.
  • Centralized ownership and control over permissions improves security and efficiency.
  • Sync-and-share services may still be used to support off-line work, but should be managed closely to ensure sensitive and protected data remains secure.
 Hybrid File Service
  • A Hybrid File Service exists when the Primary File Service is split between on-premise servers and cloud-based file services.  A Hybrid File Service differs from the use of a Secondary File Service in that the Hybrid File Service sees both on-premise and in-cloud as equal components of the ecosystem. Data location is based on access needs and usage rather than on the type of data.
  • For some organizations, Hybrid File Services represent a transition period from on-site to cloud file services. For others, Hybrid File Services reflect a broader hybrid cloud strategy that mixes SaaS and IaaS services with on-premise systems.
  • As Hybrid File Services create a cloud-based extension of on-premise servers, a managed file service with central ownership and permissions control is most often the best structure.
  • With a Hybrid File Service, the cloud component requires backup/recovery and permissions protection on-par with your in-house servers.

By understanding and defining the role of your cloud file services, you have a better understanding of the type of service to use — sync-and-share, peer-to-peer, or managed file services. You can also best determined the level of backup/recovery, access, permissions, and encryption you want and need to meet your business’ needs and any regulatory or industry requirements.


To learn more watch our 3T@3 Webcast from May 2015, Designing a Cloud File Service, or contact us with your questions or interest.


 

Case Study: Google Apps Supports Strategic Growth at Merrimack Mortgage Company

 

The Company

Founded in 1983, Merrimack Mortgage Company (MMC) continues to be a leader in residential mortgage lending throughout the Northeast and is one of the region’s largest independent mortgage bankers.

MMC prides itself for being the company that delivers the same products as the big lenders but with the high quality service levels inherent in a small lender. This winning combination of finesse and strength has led Merrimack Mortgage Company to its exceptional growth during the past three decades. The company’s success is attributed to its core strategy of providing a high level of customer satisfaction at a competitive price.

The Challenge

Merrimack Mortgage Company relies on extending its operations by expanding the size of the company’s geographic market area with new satellite branches. The IT department is challenged with bringing these loan officers located in satellite branches into the company’s processes effectively and quickly to allow them to be up and running as fast as possible.

The Solution

With integrated communications and file services, the transition to Google Apps was part of a strategic initiative to put the company in a competitive position to enable it to expand its operations effectively, from a primarily New England-based operation to cover their expansion outside of New England. This expansion included enabling a homogenous environment to all of the company’s loan officers while still complying with SOX, GLBA, ISO and other internal governance and audit requirements.

“The business side of me saw Google Apps as a slam dunk from a ROI and TCO perspective, and the technologist in me also couldn’t argue against introducing variable costs, scalability, availability, and OS and hardware independence. Cumulus Global recommended and helped us deploy CloudLock and Backupify for compliance, policy enforcement, risk mitigation, and data protection. This allowed us to fully embrace Google Apps and made both my Chief Compliance Officer and CFO very happy.”
— Matthew Seaton, CIO Merrimack Mortgage Company

Integrating Google Apps and CloudLock, Merrimack Mortgage Company extends its security perimeter to the cloud. MMC ensures its use of email, calendars, contacts, and files stored and shared via Google Drive comply with regulations like SOX, GLBA, ISO and other internal Acceptable Use Policies.  Backupify protection data across Google Apps accounts against data damage or deletion due to user error.

“I am not sure if I would have felt confident with my decision to move our company’s communication and collaboration needs to Google Apps for Business without the solutions and assistance from Cumulus Global. The integrated solution has relieved my anxiety over having our company data hosted by a third party,” said Seaton.  “Our management team was relieved by the value proposition.  We pay as we grow rather than making large up-front capital investments.”

Since MMC’s initial Google Apps for Business implementation in June of 2011, MMC has increased sales staff by 15% and the number of physical locations by 26%. Operations staff increases have been minimal in comparison. The greatest benefit, in regards to increased sales staffing and locations, is the ability turn-up new team members literally in minutes. In more recent months, MMC has seen back-to-back monthly company record breaking sales numbers.

To learn more about Merrimack Mortgage Company, visit: www.merrimackmortgage.com.