Secure Value

Secure Value by Keeping an Eye on RedFlags ... some small businesses may be exempt!

Image via Wikipedia

Trying to manage the incoming waves of regulations is bad enough ... but keeping track of what is on and what is not on anymore is a tough job when you really just want to run and grow your business!

Short one this week.  You want to keep an eye on this news.  According to an article in SCmagazine.com there is a bill working its way through Congress that may exempt some small business from the RedFlags rules.

Related articles by Zemanta

• U.S. House Says Most Dental Offices Are Exempt From Red-Flag Rules (implantblog.wordpress.com)

Do Business in Nevada? Secure Value by Complying with New Security Act

Image via Wikipedia

Does your company transmit, process or store payment card data about any individual who lives in the State of Nevada?

If so you need to be aware of the new Security of Personal Information Act passed into law in Nevada.  In a nutshell, data collectors or merchants who collect card data to do business will be required to be compliant with PCI DSS in order to legally conduct business in Nevada.

I'm not going to spend time writing something up if I find something insightful already available.  Read the write up on the Nevada Security of Personal Information Act at InfoSecCompliance.

Secure Value by Understanding Common Threats

Image by zenonline via Flickr

Understand the common threats to your business and think about how to prevent them, detect them and respond to them before they occur

Threat models are commonly used in information security analysis to illustrate the potential for risks to impact an organization. The threat model is used to describe the characteristics of a given threat and the harm it could to do a vulnerable system. 

 If we do a project where we identify threats scenarios we’ll go into detail.  At a simple level we’ll identify the pieces of the threat scenarios including the actor (WHO), the action (HOW), the motivation (WHY), the vulnerability exploited (think WEAKNESS) and the potential impact (think DAMAGE). 

We do not address the probability of these events occurring which in most cases is impossible to predict accurately.

Over your morning coffee run through these common scenarios and ask yourself if you how they would impact you:

 A trusted employee decides to:

 ·         Download unauthorized software from the Internet which contains a Trojan horse or other malicious software. 

·         Disable antivirus scanning prior to the download of an emailed MS Office document.

·         Transfer information from a third-party computer to their work computer bringing in a virus or other malicious software into the company. 

·         With any number of portable memory devices data is copied from the network and is stolen undetected.

A disgruntled employee decides to retaliate against your company:

 ·         With knowledge of the backup tape courier routine the tape drop off is intercepted and the information contained on the tapes are used to attack your company’s reputation or are used for material gain.

·         With any number of portable memory devices data is copied from the network and is stolen undetected.

 A former employee decides to retaliate against your company:

 ·         With a haphazard termination process the former employee uses his/her still active network access and credentials to damage or steal information from an outside location.

·         With a haphazard termination process the former employee gains access to a company facility and uses his/her still active network credentials to damage or steal information from an outside location.

An authorized visitor or an unauthorized visitor or intruder penetrates one of your company’s facilities and:

 ·         Unchallenged as they walk the floors of the facility they exploit targets of opportunity such as unlocked, unattended systems, backup tapes set unsecured waiting for courier pickup, etc.

 A third party caretaker of your company information has a security incident.  While that incident may not impact your company network, your company has no controls to prevent that incident from impacting your company at a business level.

Related articles by Zemanta

• Security Controls and Principles (deurainfosec.com)

Secure Value by Planning Ahead for Bad Things

Bad Things DO Happen ... Or We All Die Sometime ...

Securing your business value isn't just about keeping the hackers out.  It is also about managing other kinds of risks including the very real prospect, given that we all die sometime, that a senior resource might die.  Without thoughtful planning the business might die, too.  My business, Jacadis, recently committed to Sequent, a Professional Employers Organization (PEO), to help us manage our human resources risk.  Part of their services include succession planning.  What follows is an excellent write up by Pat Carpenter, CLU, CHFC of Sequent's Retirement & Benefits Group.

Do you expect your business to die when you do?

Do you expect your business to die when you do?  If your goal is for your business to thrive, how do you intend to harvest the investment you’ve made? If you want your business to provide a continuous income stream after you’re ready to move on, think out and plan the transfer of ownership. Whether the business is sold to a partner, a competitor, a group of employees or to family member(s), there are four elements necessary for a smooth transition. These four elements include:

• A business that has value independent of the founder
• A realistic market valuation of the business
• Willing buyers, and
• An agreement that compels the sale and the purchase at the agreed-upon amount

As your business has grown, you have developed products and services that your clients need. Vendors count on you for part of their business growth. Your management team helps determine, and employees execute, the business plan.  As the business’s life cycle matures, your role has evolved from technician to visionary.  Clients, vendors and employees have deepening relationships. You can move on now.

Setting a realistic market price for the business should be determined by a CPA certified in valuation. He or she will analyze the books, economic conditions, market segment and growth potential. There will be questions about anticipated revenue, and new niche markets. The CPA will select which valuation method is most appropriate for your business and set a purchase price and a formula for determining any future purchase fluctuations.

Evaluating a potential buyer is the next logical step in your succession plan. Often, key employees or family members will have already indicated interest in purchasing the business. Do they have all the skills, vision and drive necessary to be successful? To thrive in a competitive marketplace takes more than being a good technician. In addition to figuring out ‘How much?’ and ‘Who?, you might want to invest in training for any deficient skill areas.

The agreements that compel the sale usually take two forms.

The first option is an employment agreement that defines the conditions under which stock, or phantom stock, is transferred to the successor owners. This provides the current owner “golden handcuffs” and the key employees an incentive. Usually the transfer is contingent on reaching certain productivity goals.

The second option is the Buy-Sell document. This describes the transfer of stock upon the death, disability or retirement of the owner. It delivers assets to the owner’s family while removing them from the business. These documents should be prepared by attorneys who specialize in closely held corporations.

In addition, both agreements need to be funded in order to complete the final transfer. This is usually accomplished by purchasing life insurance and disability insurance on the owner, payable to the business or the successor owners. Insurance provides the funds to purchase the stock. In this way, non-participating family members are gracefully moved away from day-to-day operations and dividend expectations.

Good planning pays off for everyone:  your clients, your employees, your family, vendors and creditors. They all want to work with a company that will thrive, even through a key transition. With proper tax planning, the business will provide an annuity for the owner for the next five to ten years. Your investment in the succession planning process could pay dividends for years to come.

Patricia Carpenter, CLU, CHFC

Vice President, Business Development

Pat Carpenter has more than thirty years’ experience working for and with emerging businesses. A veteran of three start-ups, she has spent more than thirty years of her career working in the life and health insurance industries as a field underwriter, group representative, broker and consultant. Pat has worked closely with business owners to create custom-tailored succession plans and wealth accumulation programs. She has analyzed financial strategies, plan designs, and employee incentives. In addition, she has educated people from line workers to Board members about how to optimize their employee benefits. Pat has earned the Chartered Life Underwriter and Chartered Financial Consultant designations from the American College.

Related articles by Zemanta

• Why Entrepreneurs Sabotage the Succession Process (blogs.harvardbusiness.org)

Secure Value by using Strong Passwords

Image by Bohman via Flickr

Other more complex security and privacy protections don't work if you are not using passwords correctly ... they are your key to security!

I have read more than my fair share of "how to protect yourself in social media" type articles lately (see a good one with links to other good ones at http://www.nateriggs.com/2009/10/how-to-protect-yourself-from-the-social-web/ ) from none security professionals.  These posts discuss protecting your location, creating a family password (like the you say Thunder then I say Flash challenge response) and other very commonsensical kinds of actions to protect your online self.  Most of them forget the basic fundamental password.

So without any more preamble.  Use strong passwords.  They work.  And when you don't use them you can be attacked (See a story on Twitter's corporate accounts being hacked all becwith a loss of tremendous confidential data all because of poor password use).

Use passwords that are at least eight characters long and include a mix of at least 3 of the following character types:  uppercase letters, lowercase letters, numbers and special characters.  (WHY?: Following this practice means that guessing your password means working through more choices making guessing both practically and mathematically  more difficult.)

But doing that makes it harder to remember, too, right?  And most people don't use good strong passwords because they are hard to remember and so because of convenience (or laziness) prefer to type "1234" or "GOBUCKS!".  What to do?

Be thoughtful about how you use and mix these characters (##Pa$$W0rd!! is easier to remember than d$a#aabe and because it is longer mathematically harder to guess):

• Substitute numbers for letters and vice versa (0 instead of O, 4 instead of A, 1 instead of L, 3 instead of E, $ instead of S and so on).
• Substitute words for numbers (one for 1, two for 2, and son on).
• Use capitalization haphazardly (passWord is stronger than password or PASSWORD).
• Use special characters in front of (##password), to end (password$$) or to punctuate or separate words (password!! or pass#word).

Have some fun.  Use these combinations to create words of phrases that are easier to remember:

• ##LuckyDuck$!!
• $$Give8100dPlayRug8y

And then use your passwords like you do your house, car and office keys:

• Never communicate them over the phone, in an email or over IM (or twitter for that matter!).
• Log off (lock the door) when you are done with a site or stepping away from your computer.
• Change your password if you suspect suspicious behavior (it is good to be a little paranoid, no?).
• Do not allow your Internet browser to save your password (if you lose control of your laptop, netbook or PDA whoever gains controls has control of your entire digital world).
• Do not share your passwords with anyone.
• Don't use password hint functions (where you select a challenge like mother's maiden name and you provide an answer) or if you are forced to don't use real data (select mother's maiden name and you provide an unrelated answer like Guinness, but honestly you are liable to fake yourself out on that one so tread lightly).

If you still have trouble remembering you have 2 choices:

• Don't be shy about hitting the "forgot password" button. (It is more secure to have a password reset sent to your email address than it is to use a simple, easy to use password).
• Use a password manager like KeePass Password Safe which is a "free, open source, light-weight and easy-to-use password manager".

This sounds so simple.  Yet, it is such a serious topic.  It isn't the only line of defense, but it is an important one and because of human nature (entering passwords does feel like such a waste of our time) an underused line of defense. 

As an executive and online citizen, don't be a victim because you didn't want to invest a small amount of time to do something simple and highly effective.  As a business owner, make sure you have policies in place to expect the proper use of passwords by all of your employees across all of your systems and applications. 

Related articles by Zemanta

• Stolen Hotmail data reveals widespread use of weak passwords (infoworld.com)
• Gmail Blog - Choosing A Smart Password (lockergnome.com)
• More On the E-Mail Hijackings (pindebit.blogspot.com)
• The art of creating strong passwords (macworld.com)
• Hackers are Everywhere (myventurepad.com)

Secure Value by Planning Now for H1N1 to Hit Your Business

Image via Wikipedia

I have to confess I have had that same "it can't happen to me" attitude about the H1N1 pandemic.  I've scoffed at the sterilizers my wife Jodi put around the house, at being taught how to cough and at all of the concerns people have. 

But I've learned that if you think "It can't happen" it just might.

I've alluded to the fact that I coach football.  I run the defense for the Patriots, a team of 16 fantastic 9 and 10 year old boys, just learning the tackle game.  Tuesday night we were down to 9 kids.  About two weeks ago, one of our players was diagnosed with H1Ni and we lost his services for a game.  The abscenes steam rolled since then. Tuesday night we had 9 boys at practice with the other 6 at home sick.  Not all of them had H1N1, but the resulting impact got me to thinking.  What if 50% of our company was out sick or quaranteened because of fever?

Great question.  And this week we have begun to plan for it.  Over the next week or so our management team is going to ask soem questions:

• How bad could it get?
• Can we function in that environment?
• Can we service clients? Generate revenues? Shift risks?
• Depend on our critical service providers?
• Are there any effective prevention measures we can implement at a company level? Require of our employees?

As we go I'll through my thoughts and findings up here to help you along .. because as I have found out it can happen to anyone.

Some links of interest I've already discovered (and which I'll update as I find new ones):

• Flu.gov which has lots of information for businesses and indiviauals
• Center for Disease Control

Related articles by Zemanta

• How is the flu transmitted? (fitnesstipsforlife.com)
• Areas Hit Hard by Swine Flu in Spring See Little Now (nytimes.com)
• Swine Flu (H1N1): It's Popping up Everywhere (chilmarkresearch.com)
• A Look Inside the CDC's Battle Against the Swine Flu (abcnews.go.com)
• Your resource for tracking the swine flu (news.cnet.com)
• Small Businesses Prepare for a Hit from the H1N1 Flu (time.com)