Social Networking

Apparently employee behaviour is key to improving a company’s information security.

A little birdie - who did a survey - told me that UK companies have become increasingly aware of the need to have information security policies in place, with seven out of eight large businesses now claiming to have one. However, the high priority given to information security by companies does not necessarily translate into improved security awareness among employees. Increasingly, companies are realising that to tighten up further on information security, they have to change their people’s behaviour.

I asked if this requires neural implants - you know, those technological devices that connect directly to a biological subject’s brain - but it seems a little talking to is all that is needed. Darn!

Companies are said to be placing greater trust in their staff and they want their staff to use technology to improve their effectiveness. For example, more than half of the UK companies questioned now allow staff to access their systems remotely (up from 36% in 2006), and even very large businesses give remote access to at least some privileged staff. The proportion of businesses restricting Internet access to some staff only has nearly halved (from 42% to 24%), and only 9% who operate in the public sector the Dark Ages give no staff access to the Internet.

At the same time, staff are increasingly 'targeted' by social engineering attacks (where outsiders try to obtain confidential information from employees). In addition, businesses are becoming increasingly concerned about what is being said about them on social networking sites (such as MySpace, Facebook and Bebo), especially as disgruntled staff are increasingly posting confidential information on these sites to get one back on their employees.

Against this background, companies can harden their technical controls by use of strong (i.e. multi-factor) authentication for some of their systems, as well as allowing staff to access their systems remotely using additional authentication. Virtual Private Network (VPN) should be universal, and you should definitely block access to inappropriate Web sites. Heavy-handed IT staff who trust absolutely no-one should also log and monitor staff access to the Internet.

However, technology controls alone are not enough. Apparently, key to making sure that staff remain your company’s greatest asset is to ensure they behave in a security-conscious way. Is this where neural implants come in? No! I was told again. Increasingly, it seems companies are focused on setting clear policies, making staff aware of the policies and then monitoring behaviour to ensure that it is in line with those policies. Sounds pretty fair to me.

Unfortunately there is little correlation between how clearly senior management understands security issues and whether a security policy is in place. The biggest correlation is between security policy and risk assessment; companies that carry out risk assessment are nearly twice as likely to have a security policy in place as those that do not.

Remember kids. Having a security policy alone does not magically improve security awareness among staff - you should take steps to raise awareness. The priority given by senior management makes a difference in the extent to which security awareness is drilled into all areas of the organisation. Why not use a combination of computer-based training and face-to-face presentations to get security messages across? But these methods are somewhat transient - much more collaborative and longer-lasting programmes are needed. Genuine behaviour change is essential, and this takes time and effort. If that doesn’t work, there’s always neural implants ...

Sorry for rather dramatic headline, but a certain e-mail landed in my inbox this morning and made me want to pack up my laptop, grab some bottle water (oh, and some baked beans) and run for the hills. Scaremongers in suits who have nothing better to do with their time are now claiming that climate change will be considered a major threat to business in the next ten years. What a load of crock!

According to a survey out today on ‘emerging risks’ conducted by Business Continuity Expo 2008, a staggering 87% of businesses see climate change as the single biggest threat in terms of risk assessment and the effect it could have on their businesses’ future growth, with many at a loss as to what can be done in order to prepare or plan for this eventuality. Err, have you never heard of backup? What about outsourcing? And I guess some sort of continuity planning just hadn’t crossed your mind? A mac (not you fanboys) and wellies should always be at hand too...

Let’s put it into perspective. Men with clipboards reckon climate change and energy risk consistently rank among the biggest challenges facing global businesses this year. It would appear that the potential underperformance or failure of suppliers now represents as big a threat to business as an internal failure or disruption as 61% of companies are concerned about the failure of suppliers not performing, with a third admitting they are unprepared for this risk. Allegedly which demonstrates that supply chain risks are underestimated and businesses lack the necessary understanding to deal with them.

Also of great concern to a staggering 83% of paranoid businesses is the risk that traditional sources of energy will reduce and the cost of oil and gas will rise so significantly over the next 5 years that it will have an adverse effect on the smooth running of their business. Forget the potential energy crisis, floods, and storms, I’m more concerned with subprime lending and the credit crunch. And if I’m feeling really down, throw in a little paranoia about terrorist attacks on UK soil. Get a grip people ...

E-mail is officially the UK’s worst channel for customer service - at least according to men in white coats at ‘eService’ provider Transversal. For e-business owners - and customers I suppose - this is bad news.

Transversal’s third annual ‘Multi-channel Customer Service Study’ has uncovered a growing crisis in e-mail response: e-mailing customer service staff is markedly less effective at yielding a satisfactory answer than using an automated online system or phoning a contact centre. OMG, we're all doomed!

Less than half (46%) of the routine customer service questions e-mailed to 100 leading organisations (in the banking, telecoms, insurance, travel, consumer electronics, grocery retail, fashion retail, CD/DVD retail, consumer electronics retail and utilities sectors) were answered adequately.

Additionally, the average time to respond to e-mail was nearly 2 days (46 hours), with 28% of organisations not even replying at all. What are these people being paid for? However, proving that fast, accurate responses by e-mail are possible, some companies responded with useful answers within 10 minutes. Overall these figures show a major deterioration since 2006, when e-mail successfully answered 60% of queries and kept customers waiting less time (on average 33 hours) for a reply.

The usefulness of e-mail replies has deteriorated year on year in 80% of sectors. Even though many have improved response times, this appears to be through sacrificing effectiveness of replies. For example, in 2006, utilities companies took an average of 102 hours to reply to e-mail with 70% of replies answering the question. While 2007 e-mail response times improved to 53 hours, only 15% of replies answered the question. The picture is even worse in telecoms. From 2005 to 2007, average reply time fell from 32 to 26 hours but successful answers fell from 70% to 20%. The pattern of improving response times at the expense of deteriorating answers is clearly evident.

Insurance companies came bottom of the survey: only one e-mail reply successfully answered the question and 50% of companies didn’t respond at all. The slowest response took 27 hours - and then asked the customer to call them! Utilities were nearly as bad, with only one answering the question successfully and one partially answering it. One utility even advised customers to visit third-party comparison sites to get information on current pricing. How funny is that!

Proving that fast, accurate responses are possible, in contrast 80% of CD/DVD retailers provided correct answers, with the quickest received within one hour. Fashion, grocery and electronics retailers as well as consumer electronics manufacturers also scored relatively highly - but still only around 50% of those surveyed responded satisfactorily. The fastest successful response was from a consumer electronics company which answered the question within 10 minutes. Showing the wide range of e-mail handling skills a rival company in the same sector took 13 days to respond to an identical query.

What lessons can we learn from this survey? First and foremost, don't sledgehammer your computer, it's obvious there are general failings in the customer service e-mail channel. Companies are playing ping pong with e-mail enquiries, pushing them back to the Web or forcing consumers to call contact centres. Tell me, what is the point in paying staff to respond to customers’ questions badly? With spend-thrifty consumers increasingly demanding personalised service, e-mail should be at the forefront of delivering tailored responses that help convert browsers into customers and bring in the reddies. Some organisations are doing this extremely well but the general picture is of lazy, generic replies - if companies even bother to respond ...

Too many companies simply use e-mail to push customers to other channels rather than even attempting to provide a useful answer. Inadequate replies direct customers to call a contact centre, while others push customers back to the Web site - where they started! Not only does this increase customer dissatisfaction but multiplies the number of contacts consumers need to make, with many having to telephone to resolve their enquiry.

If you run an e-business and are struggling to cope with e-mails, aim to reduce the sheer volume of e-mail you receive. A key way to accomplish this is to allow customers to first ask their questions through a customer service knowledgebase on your Web site. If customers then go on to e-mail from the knowledgebase, the agent will be able to see what they have searched for - there is then no excuse for sending customers back to the same Web site pages.

Also try to monitor the quality of responses, with a narrow focus on agents answering questions to hit service level targets rather than spending the time to properly resolve customer queries. With many contact centres outsourced this also has a financial aspect - companies that are paid a set amount for every e-mail answered have no incentive to ensure agents are providing detailed, useful responses. Equally, contact centre managers targeted purely on numbers don’t have a remit in their jobs to monitor content. Take a step back and overhaul your processes to ensure that the e-mail channel is providing what your customers want and need.

The last day or two got me thinking, and the stack of outstanding invoices on my desk had nothing to do with it! There are not many women working in IT (marketing luvvies excluded), let alone running businesses in the sector. Why is that I wonder? Well, it’s a pretty boring industry full of geeks I guess. But there has to be more to it than that - doesn’t there?

There are actually around 620,000 majority women-owned businesses in the UK - that’s more than ever before but the number of such businesses winning corporate and public sector contracts is still shockingly low.

It’s pretty difficult for women to climb the ranks in IT, let alone run a business in the sector, as there just aren’t enough of them. As such, it can be quite hard as a woman, however talented, to win contracts. Put yourself in the place of a women for a moment. How would you like to walk through the door and there’s you and nine men after the same contract? The odds are often stacked against you...

I don’t think it’s totally dire, and the situation will change. If more women in the IT industry win contracts - and do a good job of it - then public awareness will eventually change and a virtuous circle will be created: more women will be attracted to the industry and, in turn, more women will win contracts.

One initiative that could help change this situation is WEConnect (or Women in Enterprise Connecting to Contracts), a Women’s Enterprise Task Force (WETF) scheme launched to critical acclaim at the House of Commons last month (February) - and which received strong endorsement in the Government’s recent Enterprise Strategy.

The scheme hopes to break down the barriers faced by women-owned businesses in securing corporate contracts (although 16% of UK businesses are currently women owned, only 3- to 5% of corporate and public sector contracts go to women-owned businesses).

The new initiative will put certified women business enterprises in touch with key procurement contacts in multi-national companies. This should encourage supplier diversity by giving large corporates the confidence to purchase from women-owned businesses which have achieved the WEConnect certification. Based on a successful U.S. prototype, the scheme has already signed up major corporates including Accenture, Microsoft, Bank of America and Pfizer.

I really do hope WEConnect gives women the chance to build relationships with large organisations that want to work with women-owned businesses by getting access to corporates at a level that they perhaps wouldn’t otherwise be able to. If it at least opens the right doors it’s a step in the right direction.


Interesting facts about women-owned businesses:

- There are approximately 1,013,000 self-employed women (7.6% of women in employment) and 2,706,000 self-employed men (17.4% of men in employment) in the UK. (Women’s Business Ownership, Professor Sara Carter, 2006)

- In the UK, women-owned businesses comprise approximately 16% of the business stock (1 in 5 businesses) and women comprise approximately 27% of the self-employed population. (Women's Business Ownership, Professor Sara Carter, 2006).

- In the U.S., the Women's Business Act 1988 put in place long-term infrastructure to support women's enterprise development. Since then women's business ownership has increased significantly. The growth in women’s enterprise in the U.S. has been aided by Federal recognition of its importance and a sustained commitment to its development over a 30-year period. Although there have been remarkable policy developments in the UK over the past five years, it will take sustained commitment to ensure an equivalent level of development in women’s enterprise within the UK. (Women's Business Ownership, Professor Sara Carter, 2006).

- If the UK could achieve the same levels of female entrepreneurship as the U.S., Britain would gain three quarters of a million more businesses (Gordon Brown as Chancellor of the Exchequer, Advancing Enterprise Conference, 04.02.05).

- If women started businesses at the same rate as men, we would have 150,000 extra start-ups each year (Rt Hon Jacqui Smith, Minister for Women and Equality speaking at 2nd Prowess conference, 2005).

- The most entrepreneurial age group for females is 35 - 44 (Global Entrepreneurship Monitor, London Business School, February 2006).

It’s this time of year when the winds and rain hurl their best at us. So here’s a practical guide on how your business can avoid becoming a victim of the floods (relocating abroad isn't an option...)

1. Make sure you have all relevant contact details for members of staff. The main lesson that came out of the flooding conference, that most staff lists were out of date and defunct in many cases.

2. Make sure you are aware of any medical requirements which people may have.

3. Ascertain the impact of both a potential loss of water and a loss of electricity on your business activities and respond accordingly. Should I stockpile water? Should I purchase an electricity backup generator?

4. Accept the fact that your company will not be high up the priority list of the emergency services and consider any measures which should be taken in light of this.

5. Stockpile key items on site (in a safe location not on the ground floor). These might include water, food, bedding, torches, medical equipment, soap etc.

6. If I have set up an emergency hotline facility in advance make sure that all staff are aware of this and carry the number on them (either put into their mobile telephone or carried on a separate card).

7. Provide all staff with a brief summary of the main points of the BCM plan that will affect them e.g., who is in control, what are the key contact numbers, details of rallying points etc.

8. Consider setting up a series of mobile telephones on different networks which are stored permanently in the office. If one network goes down you may be able to communicate on another network.

9. Make sure that you are aware of and, where necessary, signed up to all relevant information channels.

10. If key documents or IT servers are stored in the basement consider moving them to a higher floor to avoid damage from flooding.


It is worth noting that most companies impacted by floods tend to agree that communicating with staff off-site during a crisis was the biggest problem they faced. Floods can expose the inadequacies of communication channels used during an emergency. Most companies affected by floods rely on mobile phone networks to contact off-site staff and this over-reliance can lead to network failure.

Difficulties can also be experienced when staff members sought to contact family members and are unable to do so. In such circumstances, some can be unsure whether to let staff return home to confirm that their families were safe given the risks the floods posed.

On a cross-company level, communications with head office are also likely to be disrupted, making it difficult to either update senior figures on the current status of a particular location and also to receive direction/guidance on what to do. This lack of communication can result in different divisions within the company communicating different messages to staff leading to much confusion.