Posts

Work Life Post COVID-19 Will be Different

As reported by the Boston Business Journal, a recent survey conducted by the Massachusetts Competitive Partnership, with help form several regional business groups, found that businesses are projecting that 47% of employees will continue to work completely or partially from home post-Covid. If this is the case, the number of remote workers will jump 2 1/2 times from the pre-Covid rate of 18%.

While this survey’s focus was looking at the potential impact on the commercial real estate market in the metro Boston area, we can expect these results to be somewhat similar for metropolitan areas across the country.

A significant, permanent shift in the percentage of remote workers will impact how businesses operate.

To adapt, you will want to eliminate issues that are “inconveniences” when temporary, but should not be allowed to hurt productivity or efficiency in the long term. Some of the changes we have seen and helped businesses deploy include:

  • Changing your infrastructure (and using cloud services) to provide users with secure, direct access to applications and files, eliminating the need for remote desktop or VPN connections to on-premise networks and systems
  • Expanding your use of social communication tools, like Google Chat and Microsoft Teams, to enable the casual and incidental conversations that occur in office
  • Incrementally automating common tasks and work flows to simplify and monitor processes
  • Giving your staff the ability to manage inbound and outbound calls through the company’s voice service, ensuring
    • Call flows, through ACD and IVR menus, work properly
    • Team members can transfer calls to others
    • Staff do not need to use personal phone numbers and voicemail
  • Ensuring your calling groups, like those for help desks, function well regardless of a person’s location
  • Updating threat protections for users, data, and applications outside your physical offices.
  • Selecting video conferencing services that are secure and that provide your team with useful features and controls, such as:
    • Controlled and secure access
    • Ability to share desktops, windows, and browser tabs
    • Privacy tools, such as alternate backgrounds
    • Captioning and transcription capture

As many of these improvements can be accomplished with the tools and systems you already have in place, the cost to ensure productivity is manageable.


Complete this form for a free, no-obligation assessment, or contact us to schedule an introductory call with one of our Cloud Advisors.

Remote Learning + (Privacy x Access) = New IT Needs

While schools, teachers, and families want schools to safely re-open, the reality is that in most areas of the country, remote learning will be part of the plan this coming school year.  In addition to ensuring student access and adapting teaching methods, the move to remote learning creates new communication and privacy issues.  Working with schools and districts across the US, we see new requirements for voice services, such as:

Full Access

  • Even schools with Voice over IP phone systems may not have a way for staff to receive and make calls remotely.  More than forwarding an extension to a home or cell phone, staff should be able to answer, transfer, and initiate calls.  Additionally, unanswered calls should go to the school, not personal, voice mailbox.

Hotline / Service Desk

  • With staff working remotely, provide the ability for managed call groups with either “ring many” or “round robin” features to ensure staff are able to answer student calls quickly.
  • In addition to IT help lines, these service desks can help librarians assist student with research, enable counselors provide better coverage, and ensure calls to administrative offices are answered or routed when staff are working remotely.

Privacy for Personal Phone Numbers

  • Not all staff have school phone numbers that they can use to call, and receive calls, when out of the office.
  • Special education teachers, aids, liaisons, and coordinators, and other staff that need to communicate one-on-one with families, should not have to make calls from, or disclose, their personal home or cell phone numbers.

Cloud VoIP solutions can augment and fill gaps in your current phone services so you can fully support remote teachers, staff, and learners.

With cloud VoIP services, we can easily tailor incremental and point-solutions to your needs while managing per-user and total costs.  Capabilities include:

  • Individual direct dial numbers or extensions
  • Soft phone apps for mobile devices, laptops, and desktops, providing:
    • Ability to make and receive calls on any device without disclosing personal phone numbers
    • Access to all phone service features
    • Access to system voicemail services
  • Single or multi-level call direction menus
  • Service Desk / Agent Pools that provide:
    • Ring many, round-robin, or prioritized inbound call assignment
    • Ability to mark self available or unavailable
    • After-call work period before receiving next call to allow for documentation/transition

Depending on the features and functionality you need, we can deploy native Microsoft and Google voice services or bring in third party services designed to work with G Suite for Education and Microsoft 365.

Please contact us to discuss your needs and explore your options.

5 Ideas for Successful Remote Shopping and Customer Pickup Services

As more areas of the country move into Phase 1 of re-opening the economy, you may be able to offer remote shopping and curbside (no contact) pickup.  While you may already have a way to hold items for pickup by customers, moving completely to the “take out” model of business requires you to make changes and scale your processes.  Here are 5 ideas to improve your customer experience:

1. Accept Online and Advance Payments

Customers paying online or by phone before coming for their pickup dramatically reduces the in-person interaction needed to complete the sale. This is safe for your employees and your customers.

  • Adding a shopping cart experience to your website is not a simple process; check with your web developer and verify they have the experience to create a secure, easy to use flow for your customers.
  • If adding a shopping cart experience to your website is not feasible in the short term, you have alternatives:
    • Check with your current card processing service; many offer payment portals that can work well in this situation.
    • Spin up a separate online store using a turnkey solution, like Shopify, to which you can upload inventory and product information
    • Create an online payment account via services like PayPal or Venmo (make sure you have or create a company-specific account)
  • Remember that you must still comply with PCI regulations.  Make sure employees know that when taking credit card information, they should not write down or otherwise record the information expect to put it into the POS or card processing systems.

2. Offer Video Shopping Appointments

Allow customers to schedule video shopping appointments, during with a member of your staff can walk the store and help your customers pick out items.

  • Use a secure video meeting tool. If you use Microsoft Office 365 or G Suite, you already have access to video meetings via Microsoft Teams and Google Meet, respectively. Employees should NOT be using personal accounts, email addresses, or phone numbers to setup or run these sessions.
  • Roll out a scheduling tool that lets customers pick from preset, available times.  Bookings is a free tool included with MS Office 365.  Tools like Calendly integrate with both G Suite and Office 365 services.
  • Get a few tripods with phone/tablet holders.  This will allow a single employee to manage the camera while displaying merchandise. It also makes for a “steady” shot and better shopping experience.

3. Live Chat with Customers

Give your customers an easy way to get in touch with you once they are on your website.

  • Live chat is an inexpensive way for customers to communicate with your team.
  • Most live chat solutions allow your staff to answer questions and transfer the conversation.  Staff working from home can cover the live chat service and answer most customer questions. The chat can be transferred to in-store staff as needed.

4. Create a “Service Desk” for Customer Questions

Going beyond live chat, let your customers interact with you however they want, when they want.  At the same time, you can enable staff working from home to support the team working in-store.

  • Setup a cloud-based service desk phone system that allows multiple team members to answer calls, text messages, and voice messages.
    • Employees sign in as ‘agents’ and can indicate when they are available / not available to answer calls.
    • The system will route calls to an available ‘agent’ in a round robin basis or other priority that you configure.
    • Using a “soft phone” application, your employees access the system via computer or mobile device; their personal phone numbers and information remain private.
  • Setup a shared inbox to allow your staff to respond to, and manage, email communications.
    • More than a distribution list, a managed shared inbox lets your team assign emails and discussion threads to employees and track their work and progress.
    • Using the shared inbox, employees’ personal information and individual work emails remain private.
    • Employees can connect/disconnect to the service as needed to cover shifts

5. Measure Customer Satisfaction

Follow up every sale with a thank you email and solicit customer feedback.

  • Cloud-based customer satisfaction (CSAT) tools let you embed one-click feedback questions into your email templates. These often use familiar green, yellow, and red icons to indicate satisfaction levels.
  • CSAT tools can also solicit comments. These comments can be used to identify and resolve customer issues, as well as generate testimonials for your web site and marketing efforts.
  • More advanced CSAT tools can also ask a “Net Promoter Score” question, so you can measure how many of your customers would recommend your business to others.

A Final Note: As you implement these (or other) ideas, procedures, and technologies, remember to take care of your “back office” and employees. Initiating or improving your customer pickup services means new and changed processes. You may also decide to change roles. For example, some stores dedicate one team member per shift to process online payments as a way of managing access to the tools and information.  Take the time to train your staff and make sure they are comfortable with the changes.  Also, solicit their feedback and ideas. They probably have suggestions that will help you impress your customers.


Please contact us for a free Response and Recovery Assessment. We are happy to discuss ideas and solutions, and to assist with getting the technologies and training in place.


 

Protect Yourself from Personal Devices

(Published 4/12/20 – Get our Sample Policy)


For many businesses, employees are working from home for the first time. Given the rush to change how our businesses operate, many of those employees will be using home computers or personal devices.  While enabling companies to continue operating, doing so can place your business, data, customers, and employees at risk.

If you do not already have a policy in place, we have published a sample policy covering employee use of personal computers and devices. The policy, intended to augment your existing company policies (such as appropriate use), covers Company and Employee responsibilities.  Since you may need to install software and utilities on the device to ensure compatibility, secure access to your systems, and compliance with your data privacy and protection requirements, the policy strives to create a balance that ensure employees will not lose personal data or use of the device for personal reasons.

You can access the Sample Policy here, free of charge. Please review the policy with your HR and IT resources and modify it as necessary for your business.

As noted in the policy, you should expect to provision current versions of software and the necessary data protection tools. For example:

  • Most Office 365 licenses allow you to install the desktop software on up to 5 computers and 5 tablets/smartphones for each user.  These rights mean that you can provide employees with the same software on their home computers as they use in the office. Doing so improves productivity.
  • Employees may have antivirus protection software installed, which may or may not be current or sufficient for your needs.  You may want, or need to layer on advanced threat endpoint protection software that will not interfere with existing tools, such as Webroot.
  • Employees likely do not have dns/web protection services installed.  As the computer is used for personal activities, adding web protections can prevent web-based malware from impacting your data and business.

Please contact us for a complimentary Cloud Advisor session.  Without obligation, we can discuss your needs, discuss how to best protect your data/business, and recommend affordable solutions to consider.

Zoom Privacy Policy is a Risk

Updated 4/05/20

Updates:

  • 4/05/20: Zoom posted an updated Privacy Policy, back dated to 3/29/2020.  This policy clarifies Zoom’s actions and intents and changes some terms and conditions, indicating that Zoom is now doing the right thing with your personal data.  Zoom has also expanded users’ ability to use passwords and waiting rooms to control meeting access.  We still recommend reviewing the policy and using the “do not sell” process.  We also recommend using conferencing systems within your productivity suite, Office 365 or G Suite, as these are secure and integrate with your email, calendar, and file services.
  • 4/01/20: MIT Tech Review summarizes the security issues with Zoom, including information about a Class Action Lawsuit.
  • 3/31/20: Vice.com reports that Zoom is leaking personal emails and photos to strangers.
  • 3/31/20: The Intercept reports that Zoom is not using End to End Encryption as claimed in their marketing materials and user interface. 
  • 3/31/20: New York Times reports that Zoom, the videoconferencing app whose traffic has surged, is under scrutiny by the New York attorney general’s office for its data privacy and security practices.
  • 3/30/20: FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic

On March 18, 2020, the Zoom.us posted changes to its privacy policy that impact all users, even those without accounts attending meetings as guests.  This change follows a dramatic increase in Zoom users (and stock price), as Zoom has been offering its services for free to many businesses and schools.

Under this version of the Zoom’s privacy policy, Zoom is collecting more information, in our assessment, than is necessary to provide users with the service. Zoom also acknowledges providing this information to third parties. The information Zoom is collecting includes, but is not limited to:

  • Name, physical address, and other similar personally identifying information
  • Information about your job, such as your title and employer
  • Your Facebook profile information (when you use Facebook to log-in to Zoom or to create a Zoom)
  • General information about your product and service preferences (including software installed and/or in use on your computer)
  • Information about your device

Per Zoom’s policy, downloading and using the Zoom app provides Zoom with consent to share any personal information they collect with third parties.

In reference to the use of third party services, the policy states

“We use these tools to help us improve your advertising experience (such as serving advertisements on our behalf across the Internet, serving personalized ads on our website, and providing analytics services).”

In other words, Zoom may use the personal information of any person using their services to market to that person across their use of the Internet.

Additionally, we do not see any effort by Zoom to determine the age of individuals using the service, so they are likely collecting and using the personal information of children.

Vice.com is reporting that Zoom’s iOS app sends data to Facebook even if you do not have a Facebook account.

Impact

Our current assessment of the impact is as follows:

  • Data collection is based on the way each meeting participant enters the meeting.  Even if the organizer is on a paid and secure business or education edition, meeting attendees using the free client or entering as a guest are subject to dating mining and sharing.
  • For businesses and schools, some of the data Zoom collects and shares is prohibited under the Children’s Online Privacy Protection Act (COPPA).
  • For schools and libraries, not using the K12 version of Zoom for faculty and students may result in violations of the Children’s Internet Protection Act (CIPA)
  • Zoom does provide a means for users to instruct Zoom to “Do not Sell” their personal information. This help with California Consumer Privacy Act (“CCPA”) and  EU’s General Data Protection Regulation (“GDPR”) compliance.  It may not be practical to advise all meeting attendees of this option.

In short, Zoom’s privacy policy may conflict with your business’ privacy policy and how you manage and respect your customers and their data. The policy may also create regulatory and legal issues.

Recommendations

If you organization uses G Suite or Microsoft Office 365, you already have the ability to securely conduct audio and video conferencing with services that do not mine and share attendee data.

  • G Suite
    • Hangouts Meet (the new service) is secure and HIPAA compliant.  Individuals outside your organization can join via shared URL, without providing personal information. Through June 2020, Google has enabled all G Suite users to conduct meetings with up to 250 participants and provided organizers with the ability to record meetings. Participants can mute their own audio/video and can present to the meeting. Meeting include dial-in numbers and pins to allow access from phones.
    • Participants can join via web browser or use the free iOS and Adroid Apps.
    • Traditional Hangouts and Chat, while not HIPAA compliant, are still secure and work within organizations and with guests.
  • Office 365
    • Teams (and formerly Skype for Business) is a secure video/audio conferencing service with screen sharing, waiting rooms, and other helpful features.  As with all of Office 365, Teams can be deployed to meet HIPAA compliance. Teams does not collect and share personal information.
    • Teams, by default is device-to-device conferencing.  You can add the ability for individuals to connect by phone for a small monthly fee for each meeting organizer that needs this function.
    • Participants can join via web browser, or use the free apps for Windows, Mac, iOS, and Android.

Before adding another service or tool for audio/video conferencing, take full advantage of the services you have. Contact us if you need help with user training and support.

If you are not using G Suite or Office 365, several communications and conferencing services are offering secure, free access for up to 90 days.  These include, but are not limited to, Dialpad, UberConference, Ring Central, and Cisco WebEx. Please contact us for help selecting and deploying the right service for you and your teams.

 

Rules and Regulations

Rules, Regulations, and Results

Rules and RegulationsFor Small and Midsize Enterprises (SMEs), the regulatory landscape remains in a perpetual state of flux with changes originating at the Federal, state, and local levels. While some rules and regulations can severely impact your business’ operations, and profitability, many create requirements that you can easily satisfy at a nominal cost.

Three regulations with upcoming deadlines or increased enforcement include:

HIPAA

HIPAA compliance is a requirement for any organization that works with personal health information of individuals — not just medical offices and insurance firms. If you are sharing employee information about benefits, insurance coverage, medical leaves, or other items that involve personal health information (PHI), you have an obligation to protect the PHI. Failure to do so can result in heavy fines and, in a few instances, criminal charges.

Historically, HIPAA compliance has focused on medical practices, insurance, and brokers. We are starting to see audits of non-medical companies, along with fines for those not in compliance. 

Fortunately, you can protect PHI by focusing on the individuals that are authorized or likely to handle sensitive employee information.  By focusing on HR, payroll, and key executive and leadership roles, you can deploy services like message-level email encryption.

What to do:

  • For as little as $5 or $6 per user per month, you can ensure that specific individuals protect PHI and sensitive information while preventing accidental disclosure
  • Contact us for information about encryption, DLP, and other HIPAA solutions.

ELD

Starting December 18, 2017, all interstate trucks in the US must use an Electronic Logging Device (ELD) to track operations and required reporting.  According to the US Department of Transportation (USDOT), fewer than 1/3 of interstate trucks have installed ELDs as of mid-November. Failure to comply can result in heavy fines, impounding of vehicles, and disruption of delivery schedules.

While enforcement is not expected to impact small and midsize trucking firms until late spring or summer of next year, your business can still be at risk.

Here are a few things to note:

  • If you have your own truck(s), they may be classified or registered as Interstate Trucks, even if you only deliver within your state.
  • If you use third parties for shipping, their failure to comply can disrupt your deliveries if trucks are stopped or impounded, or if drivers are pulled off the road.

What to do:

  • Check your own vehicles:
    • Determine if they are properly registered as Interstate Trucks, or if they should be registered as such
    • If you do not have ELDs yet, please contact us for low cost, self-install ELDs with logging software subscriptions
  • Check with your shipper(s):
    • Confirm their trucks, those of their subcontractors, and any owner/operators are properly registered and have ELDs
    • If not, have them contact us for help

GDPR

Effective May 25, 2018, the European Union (EU) General Data Protection Regulation (GDPR) takes effect. While GDPR covers data protection and privacy for citizens of EU member states, treaties allow enforcement in action against US companies operating within the US.

If you have any personal data for citizens of EU member states, you are responsible for GDPR compliance.

GDPR means more than encrypting sensitive data.  GDPR includes processes and procedures for governance, including:

  • A named Data Protection Officer (DPO) responsible for oversight, compliance, and response to individual inquiries. The DPO role can be full time or part time, internal or contracted.
  • You must report suspected breaches within 72 hours of becoming aware of the issue.
  • You need to deploy privacy by design — any new system or change in systems requires primary consideration of privacy and information security.
  • You must be able to demonstrate that you mitigate risk, even in the absence of a privacy breach.

Fortunately for most SME’s the appropriate policy changes and the risk-mitigation technologies need not be expensive of complicated.

What to do:

  • Discuss GDPR with your team, and your legal counsel, to determine your required compliance
  • Provide training, education, and “cultural support” for a data privacy mindset within your organization
  • Review systems storing or processing personal information for security and privacy compliance
  • Select and deploy relevant data loss prevention (risk mitigation) solutions for your environment

Need help? Contact us for more information.


 

4 Lessons from the Q4 Data Breach Review

Last week, our strategic partner Privacy Ref held their quarterly review of recent data breaches.  In his presentation, Ben Siegel, CIPM, identified 4 lessons learned from recent data breaches, including: Google Android; Hillary Tentler, CPA; Folsom State Prison; and the Internal Revenue Service.

#1: Unauthorized Mobile Apps Create Risk

Issue: Users can download apps from sites other than the Google Play store. These apps are not “vetted” and gain access to tokens used to control users’ accounts.

Lesson: As the threat is outside of Google’s control, you need to put systems in place to prevent unauthorized apps from access your company’s data via mobile devices.

#2: Local Data is At Risk, Too

Issue: In the burglary of an accountant’s home, three hard drives were stolen and only one was recovered during the arrest.

Lesson: Physical devices, when stolen, can result in a serious data breach; While moving 100% cloud is more secure, it may not be a practical option for your business yet. You should ensure any local data is encrypted and subject to regular backup.

#3: Internal Breaches are Still a Breach

Issue: A file including names, social security numbers, and other sensitive data was saved to a shared location accessible to anybody in the organization.

Lesson: You can protect yourself from internal breaches with solutions that use defined business rules to automatically enforce permission restrictions based on the content of your files.

#4: It is Too Easy to Email Protected Information

Issue: Employees were sending emails with personally identifiable information (PII) clearly visible, in violation of regulatory requirements.

Lesson: You should not rely on people to do the right thing all of the time — mistakes happen and can be damaging and costly. System exist that scan and encrypt emails automatically if they contain sensitive or protected information.


Do you need a privacy assessment or a privacy plan review? Are you ready to better protect your data — on premise and/or in the cloud?

Contact us to discuss your needs.


 

Myth Busting

Myth Busting Monday: Cloud Lacks Security

Office365-Logo-and-textSecurity is still the biggest fear across SMBs considering the cloud.  IT leaders and C-level execs worry about spies, cyberthieves, governments, and vendors access their company’s data. This fear is unfounded.

You are the Sole Owner of Your Data; You Manage and Control Privacy and Access.

Like most reputable and trustworthy cloud providers, Microsoft runs the Office 365 based on several key principles:

  • Microsoft never mines your data for any reason other than to provide you with the Office 365 services
  • Microsoft’s staff does not have access to your data
  • If you leave Office 365, you can always take your data with you
  • You control the security and privacy settings; you determine who has access to what
  • Auditing and supervision prevent your admins from unauthorized access to your data

Beyond the core security and privacy capabilities of Microsoft Office 365, we offer additional configuration, tools, and services to ensure compliance with privacy regulations and/or your internal policies.

Fear not the lesser known security of the cloud. Learn, trust, and go.


This is the sixth of a multi-part series designed to help companies better asses the opportunity and value of cloud-based solutions. Contact us to schedule a free, no-obligation Cloud Advisor session to discuss your priorities and plans.


Fast Fact

Fast Fact Friday: Ransomware Cloud Attacks

Fast FactAccording to the Datto’s 2016 Global Ransomware Report, a survey of 1,100 IT service providers …

70% report Dropbox being the target of the ransomware attack

44% of attacks targeted Professional Services

38% of attacks targeted Healthcare


Are you moving to the cloud? Is your roadmap in line with your business goals? Contact us for a no-obligation Cloud Advisor session.


News from Cumulus Global

SMBs Benefit from Tech and Policy Mashup

Westborough, MA – Faced with increasing regulations and a changing technology landscape, small and midsize businesses (SMBs) struggle to ensure compliance and maintain data privacy. With the sophistication of rasonmware attacks and advanced persistent threats, employee awareness and behavior is more important than ever. Cloud technology makes it easier to share, even when sharing is not appropriate.

To help SMBs tackle these challenges, Cumulus Global (www.cumulusglobal.com) and Privacy Ref (www.privacyref.com) announced a unique partnership designed to help SMBs assess their needs and risks, plan and implement sound privacy practices, and respond to threats and potential breaches.

“Smaller businesses face the same regulations and requirements of large corporations,” noted Bob Siegel, Founder and President of Privacy Ref. “SMBs generally do not have the internal resources and expertise to create and manage a privacy program. This partnership gives SMBs a place to turn for guidance, expertise, and results.”

In addition to privacy assessments and policy updates, the Privacy Education Programs provides SMBs with the awareness education and training needed to ensure employees understand the risks and their role in preventing attacks and breaches.

“Our role is to ensure businesses can avoid and prevent malware attacks and data breaches,” noted Allen Falcon, CEO and Pragmatic Evangelist at Cumulus Global. “We ensure that the protecting technology, policies and procedures, and people are working together for the greatest level of protection.”

Through the partnership, SMBs also gain access to a range of data protection and recovery services and tools. These tools help prevent attacks and breaches and facilitate response and recovery if needed.