Thursday, April 7, 2011

Major Security Breach at Epsilon Interactive

By now, many of you may have received emails alerting you to a security breach at Epsilon Interactive, an on-line company used by many major corporations to send marketing emails to customers. An outside hacker broke into the Epsilon network and gained access to numerous names and email addresses of their clients’ customers. Major corporations affected include Barclays Bank, Best Buy, Citibank, JP Morgan Chase, Marriott International, Target, Walgreens, Hilton Worldwide, and Disney Destinations, as well as a host of others. If you’ve received one of these emails, you might be wondering how it will affect you. I’ll try to answer that question here.

What Happened
Epsilon specializes in sending bulk marketing emails in the name of their client companies. It takes a certain amount of skill to craft personalized emails in a way that spam filters don’t block them, and this is Epsilon’s claim to fame. They send more than 40 billion emails on behalf of their clients annually to people who have provided an email address to the client company. Although Epsilon isn’t saying exactly what happened, it is clear that someone was able to hack into their network and obtain customer names and email addresses. Epsilon has stated that “approximately 2 percent of total clients” were hit, which would be about 50 companies. To date, Epsilon has not provided a detailed list of those companies, but the ones named above have notified their customers of the breach. Epsilon has made it very clear that the hackers only got names and email addresses, not any financial information. This means the information can’t immediately be used to do anything harmful, other than to send out more spam.

The Risk

Email addresses on their own aren’t all that valuable, but if you can tie a customer’s name and email account to a company they do business with, the problem becomes more serious. A hacker can create a customized email that appears to come from the client company to trick the customer into revealing sensitive information. Suppose, for example, you got an email from your bank encouraging you to sign up for a special offer. All you have to do is click on the link in the email, log into your account, and you’re all signed up. Of course the offer isn’t really from your bank, and the link takes you to a rogue website that captures your login information. Before you know it, the hacker uses it to break into your account and drain it dry.

How to Protect Yourself
The good news is that the stolen information by itself won’t let a hacker do anything harmful. As long as you practice due diligence in opening and reading emails, you should be safe. The first thing to remember is to never provide sensitive information—account names, passwords, social security numbers, etc., in response to an email request. Legitimate companies will never make such a request by email. Also be very cautious about clicking links in emails, and never enter any sensitive information onto a website you arrived at from an email link. Whenever you must enter sensitive information go to the company’s website by manually typing their web address into your browser (once you’ve done this, you can bookmark it for future use).

You may also want to consider investing in a strong spam filter for your email network, even beyond the anti-virus/anti-malware software you should all be using. There are two ways to do this, either by using a Cloud-based service or by using a hardware filter you add to your own network. Cloud-service companies such as AppRiver can filter almost all spam before it even gets into your network, or you can use a hardware email security appliance such as those offered by Barracuda Networks. Either option can significantly reduce the amount of unwanted spam clogging up your network.

Finally, make sure that access to your network is protected by strong passwords. Although we don’t know how the hacker got into the Epsilon network, we do know some of the techniques commonly used. One approach is to use a program that tries to brute-force its way into your network by automatically trying common usernames and passwords. Passwords like “1234” or the word “password” are easily hacked. At TeamLogic IT a new client recently asked us to repair damage to their network caused by a hacker. When we investigated, we discovered the break-in probably occurred because their server password was one of the most common and least secure passwords out there. Don’t let this happen to you.

To learn more about how to protect your network, including how to create strong passwords, read my previous blog entry, Protecting Your Business Against Cyber-Criminals.  And if you’d like TeamLogic IT to help improve the security of your network, just visit www.teamlogicit.com.

Sunday, March 27, 2011

News of Garmin's Demise is Highly Overrated

Garmin recently announced its FY2010 results, and even though they generated well over half a billion dollars in operating income, Wall Street made it sound like they were on death’s door. With the automotive market moving away from standalone GPS navigation devices to smartphones like the iPhone and Android, the pundits on the Street don’t see much of a future for Garmin. One “expert” who should know better went so far as to say, “Garmin is toast.”

This kind of myopic oversimplification from so-called “experts” is one reason we still haven’t recovered from the recent financial industry meltdown. Garmin’s future doesn’t depend exclusively on the automotive market. Sure, it’s a big part of their current revenues, but it’s not the lion’s share of their profits. According to their annual report, the Outdoor/Fitness market accounted for $237 million of income before taxes while the Automotive/Mobile market accounted for only $205 million. Add another $134 million from the Marine and Aviation markets and you’ll conclude that even if the automotive market went entirely away, Garmin would still survive. And everyone agrees there is little threat to the growth and profitability of the non-automotive markets.

Let me caution you that this doesn’t mean I recommend you buy Garmin stock. The vagaries of the stock market are not something I can predict. I’m more interested in assessing the future of Garmin as a company. And here, I agree with one pronouncement from the pundits. Garmin needs to reinvent itself. The question is how?

Garmin already tried one approach—introducing their own version of a smartphone. Unfortunately they went about it all wrong. Rather than capitalizing on the unique capabilities they could bring to the smartphone market, they tried to introduce a “me too” product far too late in the game to be successful. The world didn’t need one more smartphone like all the others, no matter how well known the Garmin brand. The pundits cheered when Garmin finally pulled the plug, for good reason. No need to sink another dollar down a hopeless rat hole.

So what should Garmin have done? For one thing, they should have read Marketing Warfare, a book written 25 years ago that predicts exactly the debacle they encountered. (This book should still be required reading for every marketing department on the planet.) Instead of making a frontal attack on an entrenched competitor—Apple—they should have taken advantage of their unique strengths to do an end run around them. In fact, they could still do so.

What are these unique strengths? I know of at least two, drawn from their expertise in the Outdoor market. The first is waterproofness. Every GPS in Garmin’s outdoor line is waterproof to an industry standard called IPX7. This means they can withstand immersion in up to a meter of water for 30 minutes. Smartphones not only aren’t waterproof, you’ll void their warranty if you get them wet.

Garmin’s second strength is the quality of its GPS receivers—you can find your position anywhere in the world with a Garmin receiver. A typical smartphone won’t reliably find its position unless it is in contact with a cell phone network.

So what would be the target markets for a waterproof smartphone that can reliably find its position anywhere in the world? Not just hikers and backpackers. Think police and fire departments, search-and-rescue teams, telephone and power companies, harbor pilots, and any business that sends personnel outside in inclement weather—construction companies, pool services, ambulance services, and a multitude of others. It’s a market poorly served by existing smartphones, and one that could be a significant opportunity for a targeted solution. Sure it’s not the next billion-dollar-a-year business, but that just means Apple won’t be going after it anytime soon. Garmin could have it to themselves, and it would certainly be much more profitable than their previous foray into this market. And if they were smart, they could leverage this success into broader markets later on. Don’t forget that Hewlett-Packard was once a bit player in personal computers, selling almost all of their products into a small niche called test and measurement. Now look where they are. Garmin could follow a similar path.

Will they do it? Probably not. Being a niche player is a tough pill to swallow for someone used to being out front. But whether or not they choose this particular path for future growth, they need to pick one that builds on their unique competitive advantages and not just blindly follow the leader.

Disclaimer: I have no formal relationship with Garmin, although they were nice enough to loan me GPS receivers while I was writing Outdoor Navigation with GPS. All receivers they loaned me were returned promptly when I was finished using them.

Tuesday, December 7, 2010

Russian GPS Satellite Launch Fails

According to the Russian Federal Space Agency, the December 5th launch of 3 GLONASS satellites (their equivalent of GPS) failed when the Proton-M rocket carrying them failed to achieve proper orbit.  The satellites ended up crashing into the Pacific Ocean, apparently due to a software programming error.  Here's a link to the GPS World article: GLONASS Launch Fails.  It includes an interesting YouTube video of the ill-fated rocket being moved into position prior to the launch.

Saturday, October 2, 2010

Cybercrime in the Headlines

In last week's blog I talked about the danger of small businesses being victims of cyber-crime. Unlike your personal bank account, if cyber-criminals steal money out of your business bank account your bank is under no obligation to reimburse the loss.  In my blog, I listed six steps every business should take to protect themselves against cyber-criminals.

Today's headlines underscore the need for this kind of protection. In an article titled FBI says cyber-thieves stole $70 million, the Associated Press reports that a gang based in Russia and Ukraine used a virus attached to emails and web links to tap into the computer systems of small businesses.  Once an unsuspecting person clicked on the link, the virus captured account numbers and passwords the criminals could use to access the accounts.

One sentence in the article was particularly telling:  "Many of the victims were small- and medium-sized businesses that don't have the money to invest in high-level computer security."  This incident underscores the fact that for a business, computer security is not optional.  If you're a business owner you owe it to yourself to make sure you are protected.  Last week's blog describes six important steps every business should take.  How well are you doing?  If you need help to find out, consider working with a professional IT company like TeamLogic IT to do an assessment.

Saturday, September 18, 2010

Protecting Your Business from Cyber-Criminals

I was recently invited to talk to a group of local business people about computer security for businesses.  It's an important topic because if your business is using computers for things like email, web browsing, accounting, online banking, inventory management, or payroll, you are almost certain to be a target of cyber-criminals. One recent study showed that an unprotected Windows computer taken right out of the box and connected to the Internet was typically hacked within 20 minutes.

Many business owners don't realize that as a business, you don't have the same legal protection as a consumer.  If hackers break into your business network and drain your bank account because you didn’t implement adequate security, your bank is under no obligation to reimburse you.  There are numerous stories of banks refusing to reimburse businesses who lost hundreds of thousands of dollars to cyber-criminals because they didn't take sufficient security precautions to prevent the thefts. 

The small business owner who recognizes the threat of computer crime and takes steps to prevent hackers from breaking in is less likely to become a victim. Here are six things every business should do to protect its computer network:
  1. Use a firewall. This is the first line of defense for your system. Firewalls scan all traffic into and out of your network to block unauthorized access. There are two kinds of firewalls: software and hardware. Software firewalls such as Windows Firewall run directly on your computer. Hardware firewalls are separate boxes that sit at the junction between the Internet and your local network. While hardware firewalls might offer slightly better security, either is much better than the alternative of doing nothing. Your Internet Service Provider might include a firewall as part of their DSL or cable modem.
  2. Use anti-virus and anti-spyware software and keep it updated. A firewall won’t block every threat.  Anti-spyware software looks for programs that secretly enter your computer and collect bits of information about you. This could include such things as the websites you visit or the keys you type to enter a password.  Anti-virus software scans all your files, looking for known or suspected malicious code—viruses, worms, or Trojans. Although each differs in its details, all can be serious threats. The anti-virus software scans for them all. Files considered threats are identified, where you can quarantine or delete them. If you think the suspect file isn’t truly a virus, put it into quarantine. Otherwise delete it.  In order to be effective, you need to keep anti-virus and anti-spyware software up to date.  New threats are constantly being released by hackers, and the best AV and AS vendors issue updates to detect the latest threats at least daily.
  3. Use highly secure passwords. What are the worst passwords? Here are a few of the most common: 123456, password, qwerty, letmein, abc123, and a few obscene words I won’t repeat here. Do a Google search on “worst passwords” and you’ll see a complete list. The best passwords are at least 14 characters long, don’t include any words found in the dictionary (including spelled backwards) and use a combination of uppercase and lowercase letters, numbers, and punctuation marks. Some sources advocate using a different password for every account and changing it regularly. At the very least you should use several different passwords for different kinds of business and personal accounts, and never share your passwords with anyone else. If anyone else learns your password, change it immediately.
  4. Keep your operating system updated with the latest security patches. If you use a Windows computer, turn on automatic updates or go to www.update.microsoft.com/microsoftupdate to install the latest updates. If you use a Mac, don’t assume you are automatically protected. Accept all new security patches when they are issued.
  5. Be cautious opening email attachments and clicking embedded links. Most viruses infect your computer because you opened an email attachment. Don’t think an attachment is automatically safe just because it came from someone you know. Scan it with an anti-virus software program before opening. For the ultimate in security, use a third-party provider to scan all your emails and block any viruses before they ever get into your network.  Also be careful about clicking on a Web link in an email. Rather than clicking the link, manually type the URL into your browser.
  6. Back up your data regularly. You never know when a hard drive will crash or your laptop will get stolen. Don’t wait for disaster to strike before you think about backing up your data. You can purchase a hard drive specifically for backing up your data or you can use an online service.  Just make sure you do it regularly—at least daily for business data.
While there can never be a 100% guarantee that you won’t be hacked, following all six of these steps will dramatically reduce the probability you will be a victim of a cyber-crime. If you’re not sure how to do all this yourself, consider contracting with an expert like TeamLogic IT (www.TeamLogicIT.com) to assess your vulnerabilities and take appropriate steps to correct them.

Friday, July 9, 2010

Is There Money in iPhone Apps?

If you read the trade press, you’ll come away with the impression that there’s big business in creating applications for smartphones. The iPhone now has over 300,000 apps, and Android apps are growing exponentially. Stories of software developers getting rich overnight from iPhone apps they wrote in their spare time are enough to make anyone who has ever heard of Objective C to think about quitting their day job to write apps for a living. Think twice before doing so.

I speak from experience. For six months, I led a small team of entrepreneurs in a startup venture with the intention of creating a successful business developing smartphone apps—initially for the iPhone and later the Android. We had a good idea, a reasonable marketing plan, and interest from outside investors. But I finally decided to shut it down because our chances of success were infinitesimally small. In this blog entry I’ll share some of the lessons I learned along the way in the hope they could be instructive for others thinking about following a similar path.

The Idea. Our starting premise was that the market for traditional printed books is in rapid decline. Amazon’s Kindle, Apple’s iPad, and countless other eReaders threaten to make the printed book obsolete. (That’s a gross exaggeration, but many otherwise intelligent people believe it.) It turns out, though, that all the focus so far has been on the simple transition of printed words into an electronic display. EBook pages look just like printed pages, they’re just electronic, not paper.

One part of the eBook industry that’s still in its infancy is the market for travel guides. If you want a guidebook that tells you about the sights to see in San Francisco, Paris, or Yosemite Valley, you’ll most likely pick up a printed guidebook from the likes of Frommer’s or Lonely Planet. Even if you choose an eBook tour guide like those available for the iPhone, you’ll usually find it’s little more than a digital transcription of a printed book.

It doesn’t have to be that way, though. Today’s smartphones invariably have built-in GPS capability. Imagine an iPhone app that uses GPS to guide you along a tour, automatically presenting audio and visual information about each sight as you get there. No need to juggle a book as you walk, and there’s never any question as to exactly which feature is the true point of interest. Such a tour guide would not only be useful for walking tours, it would be especially valuable for driving tours.

That was our basic concept. We had a good team with the experience to pull it off. I’d written a popular book on GPS navigation as well as several travel guidebooks; one of our team members was the former publisher of a guidebook company. Other team members had experience with software programming and marketing. But even with this experience, we weren’t able to pull it off. Why?

The Economic Challenge. We quickly discovered you can’t build a successful business if your only income derives from sales of the iPhone app. At a typical selling price of $0.99 to $2.99 (with 30% of that revenue going to Apple), you’d have to sell hundreds a day to generate any significant revenue. That might be possible for some of the gaming apps written by a one-person company, but even there it’s hit or miss. For a multi-person company, you won’t have enough money to pay your salaries unless you come up with other ways to generate revenue. We came up with several ideas.  Here are the two we felt were most promising:

In-App Advertising. Our first objective was to generate significant revenue from in-app advertising. Since ours was a GPS-based location-aware app, it would be easy to deliver only those ads from businesses in the immediate vicinity of the user. As you walked by San Francisco’s Union Square, for instance, you would see ads for restaurants or coffee shops nearby.  Advertisers could perhaps even offer a discount coupon if the customer came in today. These are fairly high value ads—one recent study reported that nearly 10% of the viewers of such ads took advantage of them. As a result, advertisers are willing to pay premium prices for such ads and we could generate significant revenue. We planned to broker our ads through one of the big mobile advertising engines, either AdMob or iAd. But we weren’t convinced the incremental ad revenues alone would be enough to make us successful. So we pursued one more path.

Software as a Tool. We knew our growth would depend on how quickly we could generate a large number of tours. If we had to develop each tour ourselves, it would be years before we had enough tours to break even. But if we could recruit existing guidebook publishers do the work for us, we would reach breakeven much sooner. There are dozens of guidebook publishers who want to offer electronic versions of their printed guidebooks, but these publishers don’t typically have technical people on staff; they are all English majors. Our idea was to offer a tool that would allow them to drop their existing guidebook content into a simple template. Our software would then automatically create the iPhone app for them. For example, an editor could load the content of a tourist guidebook for the city of San Francisco into our template, push a button, and out would come the iPhone app. We would handle the placement and marketing with Apple and take a cut of the revenues. Add location-aware advertising to this concept and it could be a winning business.

Cold Hard Reality. Reality is never as simple as you imagine. We quickly discovered that most guidebook publishers are small concerns that are barely getting by. (The book publishing industry is a terribly low margin business.) While the publishers we talked to liked the concept, they didn’t have any money to invest in it. It would be up to us, not one of their editors, to load the content into the template and create the app. Once again, our growth would be limited by the size of our own staff.

More importantly, although some of our team were software engineers, none of us had experience writing iPhone apps. Apps that use the GPS function are the most difficult to write, and iPhone developers with GPS skills are in high demand. They can easily get high-paying jobs at established companies, so they have little interest in joining an unknown startup. By the time we cold hire one, there was a real risk we would be impossibly far behind the competition.

Even with these obstacles, we had investors ready to make investments. In the final analysis, though, I didn’t want to take investor money when I wasn’t confident we could be successful. Perhaps that’s not the mark of a true entrepreneur—someone who doesn’t lose sleep if their idea fails and their investors lose everything. But that’s not me.

If you’re thinking about making your fortune writing iPhone apps, be sure you’ve thought it through. While you’re not likely to get rich enough to retire, it’s possible to build a successful business. You need to pull together the right people, come up with a credible business plan, and execute the plan flawlessly. Not a lot different than what it takes to be successful in any other venture.

Wednesday, May 26, 2010

When Innovation Goes Awry

Not every innovation turns out as expected. Regardless of what you learn from focus groups or test marketing, the real-world experience may be different. The question is, how well do you respond when it’s obvious you’ve made a mistake? Those of us old enough to remember Coca Cola Company’s disastrous rollout of New Coke back in 1985 know firsthand what happens when a company doesn’t aggressively deal with a problem. I won’t recount that fiasco here. Just type “New Coke Disaster” into your search engine and you can read all about it.

What I will do in today’s blog is describe three innovation blunders I’ve personally come across in the last three weeks. In each case, I wrote to the company to voice my concern and ask that they fix the problem. In each case I got a reply. The differences in these replies illustrate the difference between companies that are in touch with their customers and those that aren’t.

My first example is that of Bull’s Eye Original Barbecue Sauce. A product of Kraft Foods, it was introduced in 1985 with a slogan, “The Big, Bold Taste of Bull's Eye.” It does fairly well in reviews (see here for example), and I’ve been slathering it over barbecued ribs, burgers, and chicken since its introduction. I recently opened a new bottle and rather than finding the familiar thick brown syrupy paste, I found a watery, tan substitute. It didn’t stick to the meat, didn’t end up slightly caramelized when cooked, and had a weak flavor. I double-checked the label, and while it had a different design, it still said “Original.” So I fired off an email to Kraft with my complaint.

I got a quick response from Kim McMiller, Associate Director of Consumer Relations. She apologized for my disappointment and explained that they have eliminated the use of High Fructose Corn Syrup in the product’s recipe (no explanation for why—cost savings, health reasons?). She promised to share my complaint with the product development staff and promised to send a check for a full reimbursement to me. The quick promise of a refund suggested I wasn’t the first to complain. I sent a note of thanks and expressed hope that they would revert to the true “Original” formula. I’ll keep my fingers crossed.

Barbecues need charcoal (I refuse to switch to gas), and my next example comes from Kingsford, the source of my charcoal for the last 30 years. I usually buy the 20-lb bags, which shrank to 18 lbs a few years ago. At the time, Kingsford claimed the new briquets lasted the same as the old ones. The most recent bags I bought were only 16.6 lbs, but were still claimed to last the same as the old ones (which raises the question, "How low can you go?"). My experience was not pleasant. The new briquets took much longer to light and never got as hot as the old ones. My Weber has a built-in thermometer so it was easy for me to tell. The old briquets could easily get up to 400-450 F, while the new ones had a hard time getting over 300 F.  They might last as long, but only because they aren't burning as hot.

So I wrote a letter of complaint to Kingsford. Again I got a rapid reply. Patti Cooper, a Consumer Response Representative, apologized for my experience, said it was unusual, and promised to send a coupon for a replacement bag. Unlike Kraft, she didn’t acknowledge any change in formulation, but at least she understood my problem and offered to do something about it.

My final example is Comcast. As a Comcast customer, I like to use the Comcast.net home page to see the latest news, sports, and entertainment stories. Up until recently, I could access the same page from either my personal computer or my iPhone. But a couple of weeks ago, Comcast launched a new mobile site so that when I try to access Comcast.net from my iPhone, I get redirected to the mobile site, m.comcast.net, instead.

I hate the mobile site. Where previously I could scan all the news and decide what I want to read from a single screen, now it takes multiple clicks just to get to where I can see one article. I don’t want the mobile site, I want the main Comcast.net site on my iPhone. But I can’t find any way to get it. I know it must be possible because when Amazon made a similar change awhile back, they sensibly gave me the option to retain the classic view.

So I wrote Comcast explaining my problem. I got a reply from Angelo. He obviously didn’t understand my question, thought I was having problems accessing Comcast.net from a PC, and gave me a list of instructions for making sure I was using a compatible browser. I wrote back further clarifying my problem and got a second response from Ann. She apologized for me not being able to access Comcast.net from my iPhone and proceeded to give me instructions for how to access the mobile site—the exact thing I didn’t want to do. Exasperated, I thought I’d try one more time, reiterating that I didn’t want to access the mobile site, I wanted to access the main site. This time I got a response from Ernesto (apparently no one at Comcast has a last name), who again apologized and proceeded to once again tell me how to access the mobile site from my iPhone. Both of these last two responses were obviously canned paragraphs. No one at Comcast apparently reads emails, they must do a word search and send out a canned answer based on the number of times a certain word appears in the email. At this point I’ve about given up, although I will try one more time, asking to talk to a supervisor, before I finally surrender.

With Kraft, I felt my complaint was heard and understood. There’s a good chance my feedback will actually get to the product development team. Whether they change back to their old formula is another question, but at least I'm being heard.

With Kingsford, I felt my complaint was being heard, although I wasn’t as confident it was understood. I’m not sure whether any feedback will make it to the product development team, but if enough people complain, it probably will.

With Comcast, my complaint was neither heard nor understood. I’m quite sure the developers of the Comcast mobile site will never hear my request for an option to get to the main site. Perhaps they feel it isn’t necessary to pay attention to one lone consumer, but here’s the fallout from that attitude. I’m just about to select a new phone and high-speed Internet provider for my business, a much more lucrative proposition than my home service. Although I haven’t finally selected a provider, you can bet that Comcast won’t make the final cut.