CUTTING THROUGH THE HYPE

Customer Experience – all talk?

These days, we hear a lot about organisations ‘getting’ what a good customer experience is all about, and pulling out all stops to provide it via all kinds of means from context-aware communications to rich, interactive web experiences. We read a lot about lead management and nourishment, where every potential prospect is as precious as a small diamond.

And then reality smacks you in the face and shows you that some companies still don’t get it, despite all the talk on Twitter and Facebook. Worse, companies who once got it, can lose it in a big way. We buy quite a bit of PC gear for Technoledge, and the time had come to buy a new laptop. Dell had the most attractive deal on a Vostro 3400, which I configured online and ordered by phone from a sales rep in Malaysia because I also wanted to order a 24” screen which sat in different silo on the website. 

That was the first glitch: If you’re in the small business silo, you can’t add a product from Dell’s consumer line. The next problem was that no order acknowledgement arrived, even though the sales rep had my address. My pleas late that day and the following day (by email and phone) went unanswered, and this got to me after 24 hours.

Anything you order online these days from anywhere produces an instant acknowledgement by email, but not Dell. They have our credit card details, and we have nothing, not even an order number. So when I called Dell to try and track down what is going on, I’m shunted from one phone ‘reception’ to another like an unwelcome visitor. Eventually I end up being pointed back to the same sales rep who refuses to talk to me. Needless to say, she’s on the phone.

There’s no way that I can see of getting through to Dell Australia who claims to have an office at French’s Forest in Sydney, not on the company website and not in the white pages. Every phone number lands you in the far east, where Dell’s agents are very polite but very useless.

In desperation, I find a place on the Dell website where I can report a problem with my order. I do that, and just to add insult to injury, there is no acknowledgement that the submission of my problem report was successful. The screen twitches but doesn’t change.

We have developed conventions after many years of internet use, but it seems Dell has forgotten them along with customer care in the true sense. 

Kim

Ads that don’t work any more

Innocence Lost or Political Correctness gone too far?

I've made an attempt to track donw the source of these old ads sent to me by a friend. Here's a likely source: http://jpmens.posterous.com/ads-that-just-dont-work-anymore-2 .

Anyway, it's fascinating to see what advertisers used to get away with, isn't it?

Kim

 

IT Security – the crooks are still winning

Is it time to make users part of your defence strategy?

The latest weapons: Targeted Persistent Attacks

At Technoledge, we have several security software evendors among our clients and we've seen the security landscape change in the last 5 years. We thought it was time for an update.

 

Highly organised syndicates have replaced the nuisance hackers and virus writers of old. The new gangs are white collar criminals out to steal information, either on contract or to sell it to the highest bidder.

 

In the last 5 years, we’ve seen highly organised syndicates replace the nuisance hackers and virus writers of old. The new gangs are white collar criminals out to steal information, either on contract or to sell it to the highest bidder.

 

They’ve developed sophisticated forms of attacks targetting individual organisations, known as Advanced Persistent Threats, which in most cases succeed and result in proprietary and confidential data being stolen. The White House, Google and security vendor Kaspersky are among recent victims. Experts estimate the cost of industrial espionage to the USA at about $200 billion a year, and to Germany at 50 billion euros.

 

APT attacks tend to follow these steps 

1. Reconnaissance - identifying individuals of interest
2. Intrusion – social engineering combined with spear-phishing emails
3. Establishing a backdoor - and obtaining domain administrative credentials
4. Obtaining user credentials – to broaden access to information
5. Installing stealth utility software to perform system tasks
6. Privilege escalation – to exfiltrate data out of the compromised network
7. Maintain Persistence and access to the network while avoiding detection

Users in the Firing Line

The entry point is a user (one of many targeted) who responds to a carefully crafted spear-phishing emails that appears to be genuine and to offer something of relevance to his interests. Once the door is opened, a custom-built Trojan enters that defies detection by traditional scanners (because it’s zero-day malware) and, from here on, the attack is covertly extended into fully-fledged electronic espionage. Most of the steps outlined above can remain undetected for weeks or even months.

However, organisations LOSE twice as much data as is stolen from them, through carelessness. In the USA, 10,000 laptops are left behind at airports every year, and US drycleaners have picked 9,000 USB sticks from trouser pockets. Carelessness is the biggest threat to data security and, for a variety of reasons, the DLP (Data Leakage Prevention) solutions touted by security vendors are nowhere near as effective as their marketing.

Arm the User

Clearly giving users a better understanding of what confronts them, and better tools to defend themselves, makes enormous sense. Despite two decades of developing smarter firewalls and better malware or intrusion protection, Hackers have always found ways to outsmart security systems. Outsmarting well-trained, alert users is a lot harder.

Not surprisingly, security product vendors say it’s a wate of time. ‘Given a choice between dancing pigs and security,’ Microsoft’s Cormack Herley claims, ‘users will pick dancing pigs every time.’[1] That’s pretty funny, and it’s also a sad reflection of the way security experts look down at users. I was on a panel at a recent conference where the three speakers who preceded me all bemoaned the stupidity of computer users.

 

It was so bad that I changed my pitch on the fly and stood up for the users who’ve suffered all kinds of clunky security software knobbling their PCs and constantly getting in the way, along with the arcane security mumbo-jumbo their vendors carry on with. The software has improved in recent years, but the attitudes of security experts, vendors and IT staff have not.

 

User Training – the right kind

Much of the user training on security sounds like exasperated parents berating stubborn children who refuse to listen. If you treat users like that, they’re unlikely to listen let alone cooperate. Even where the tone is more positive, user education on security tends to be convoluted and is almost exclusively delivered via memos from IT, which is the least effective of all the means available.[2]

 

IT guidelines tend to focus on what users should and shouldn't do and tell them

·    not to open emails from people they don't know

·    not to click on links that promise to show them nude photos of film stars

·    not to give personal information out willy-nilly

·    not to download software and so on

 

Good training focuses on helping recipients understand the subject and the issues to the extent that they become engaged. There’s an old proverb that goes:

Tell me and I’ll forget

Show me and I may remember

Involve me and I will learn

 

That’s the secret to effective user education. Most users are committed and loyal employees who will do the right thing if trained and motivated.

 

Bring People with you

The most effective training is face-to-face with manageable groups, taking them through realistic chains of events, from opening the door an inch right down to the very real consequences for the company. The best way is to work through live examples with them, go to real phishing websites, analyse phishing emails (or send them dummy ones) and show them what happens when an attachment is opened.

 

Different groups in organisations need different levels of training – i.e. frontline staff, sales execs and tech support staff probably have laptops and smart phones which need additional security. Office staff, middle management and senior management have different responsibilities and needs. And the training has to be repeated from time to time as the threats and scams change shape, and as the attackers modify their techniques. Simple guides that resemble cheat sheets will help every user remember the threats and the appropriate response.

 

The training will pay for itself many times over but it will take time. ‘You need to change the culture of the organisation over several years,’ Martin Smith of The Security Company told Secure Computing magazine at Infosec. Smith added: ‘Infosec is focusing frantically on technology, but it doesn't matter what you spend on security unless you bring people with you. If staff could just know some basic stuff, it would all go away.’ [3]

 

Smith makes the point that little is achieved by running ‘a boring course once a year that effectively pushes the problem on to [users] so that the security team's arse isn't on the line … ’ He says letting users know the damage breaches in security can do to their company, and creating a common culture of security is far more effective.

Even Cormack Herley of the dancing pigs agrees. ‘Most in our industry agree that user education is critical,’ he concedes. ‘Users are our biggest liability. However, most of us also recognize that it is not very efficient. I hope more research of this nature will be performed and that we will be able to construct better user education programs.’

 

Make it part of your culture

User education on security is an ongoing program in many organisations, from Cisco to Ricoh, with the full support of all the divisions. It must be relevant and entertaining, it must be regular and reinforcing, and it must have the full support of C-level management, and it needs to be adequately funded.

 

A senior manager must have responsibility for the education program, whether she’s in HR or IT or Facilities management, and should be remunerated on achieving measurable targets. However, the education program can be run by external security contractors working closely with the responsible manager and key departments.

 

Valuable resources here:

http://www.securecomputing.net.au/Feature/102774,emloyee-education-key-to-successful-enterprise-security.aspx

---

[1] So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users

http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf

[2] http://www.securecomputing.net.au/Feature/102774,emloyee-education-key-to-successful-enterprise-security.aspx

[3] Ibid

Apple iPAD – Style Let Down by Function

It’s a slick piece of design, with that glossy screen and the touchy-feely-finger-stroking navigation. Brilliant. It’s just gone on sale in Australia starting at around $600 and people are queuing up to buy theirs. 

We suggest you wait. Why? There are half a dozen essentials missing on the current version, that why. Let’s have a closer look at this slick tablet to see if it meets real world needs.

1. There’s no USB port. Not a single one. That means you can’t plug in a keyboard, mouse, digital camera or USB modem. The only peripherals you can use are those which connect through Apple's proprietary dock connector, and that means you’re paying through the nose for everything you attach.
2. MS Office compatibility. Apple made a big deal of their iWork productivity but you can't open Microsoft Office files and that’s just the beginning. Pages can import and export Word's formats but there’s no support for headers and footers, footnotes and other essentials. Spreadsheets using numbers can’t be exported as Microsoft Excel files.
3. Flaky WiFi – problems range from fluctuating signal strength and poor performance to connections dropping out requiring re-entry of WPA credentials to reconnect. The iPad’s download speed is said to be several times slower than that of the iphone.
4. No SD card slot means you can’t just slot in your camera’s flash card to backup photos while travelling. You can of course buy Apple's iPad Camera Connection Kit.
5. No camera for video calling/Skype. Not very slick.
6. No file system access for external storage devices. To copy files to the iPad's Document Manager, the only options are using iTunes or email. You can't even browse network file shares. Not very slick.
7. No printing. The iPad can’t be used on a local network and can't talk to printers. Apple partners have produced printing solutions but they’re another ad-on.
   

What you’re left with is a slick piece of kit that isn’t much more useful than an iPhone. It has a bigger screen but can’t make phone calls. Not very smart really. Not very useful either.

We’re indebted to iTNews for some of this content. Check this link for more details:

http://www.itnews.com.au/News/171557,analysis-a-dozen-reasons-not-to-buy-an-ipad.aspx

Kim

ANZ BANK – WHOSE WORLD DO BANKS LIVE IN?

 

The current ANZ ad campaign has left us scratching our heads. The first ad we saw featured a lot of people with what looked like mobilés on their heads – you know: those things you hang up in nurseries to amuse babies. Eventually the bits fall off people’s heads and the take home message is that ANZ MAKES BANKING SIMPLE.

The next commercial we saw features a revolting woman called Barbara who abuses a poor sod of a customer, then she keys something into her computer, saying she’ll sign him up for something he didn’t even ask for. When he protests feebly, she says: too late, and further protests are answered with: I’m busy, I’m the manager, I’m in a meeting and I’ll put you onto an automated voice system ...’ Finally she tells him to go away.

 

In yet another commercial, she abuses a young woman and tells her to go away. The take home message? BARBARA LIVES IN BANK WORLD. WE LIVE IN YOUR WORLD.

 

 
We were curious and checked the web, where we found that ANZ Bank had paid MC Saatchi $15 million for a new logo, a new tagline and the ad campaign. http://www.news.com.au/business/new-brand-and-logo-to-cost-anz-15-million/story-e6frfm1i-1225790269154

We’ve long suspected that we’re in the wrong end of this business, charging clients a few thousand dollars for a lead generation campaign or a website revision, and a few hundred for a tagline. We really work hard on our taglines, and we know a little about how to craft them http://www.technoledge.com.au/pdfs/branding3.pdf . At the very least, we know enough to know that WE LIVE IN YOUR WORLD doesn’t cut it.

And the logo? Haven’t we seen those style elements somewhere before? Decades ago?

 

 

 

Graham and Friends have a funny take on the logo, so we’ll leave you in his capable hands http://www.youtube.com/watch?v=zfgx5czpeJc

 

Back to Barbara. Writers of novels are familiar with the term verisimilitude, which describes a semblance of truth or reality. The curious thing with this term is that it applies to all stories, from church sermons to jokes to TV commercials. Why? Simple: Unless they relate to some element of your reality, you will not relate to them. The ANZ commercials describe banks which don’t exist, and didn’t even exist in the bad old days. As a result, the commercials don’t speak to anyone.

 

Another rule in our marketing book is that a message must touch on a pain some members of your audience feel and want relief from. The ANZ commercials don’t do that. The pain the poor sod in the commercial feels is not a pain we can relate to, because our banks don’t treat us like that.

 

So the ads miss the mark. A waste of millions. Only a few months before this campaign was launched, Westpac was running the infamous commercial that tried to explain its interest hikes with some fairy tale about a storm hitting a banana plantation. That ad was just as wide of the mark, and just as silly.

 

 

Does it matter? No. Do Mike Smith or Gail Kelly lose sleep over ludicrous advertising campaigns they paid $15 million for? No. Why not? We have four major banks in this country, and they make billions from us, effective marketing or not. Every one of us knows that they’re all the same, and that their attempts to differentiate themselves are as laughable as a decade of BP’s greenwashing, but they have to keep up appearances.

 

Kim