Working at the speed of business – an agile philosophy

A common challenge for IT departments in today’s business environment is keeping up with the demands of the business. How can we ensure that our client’s data is protected and systems are reliable and available? All the while implementing modifications and upgraded environments in a time frame that doesn’t slow the business down.

To help to address this challenge at Datotel, we’ve adopted an agile philosophy called the Scrum methodology. Scrum is an approach defined by set roles, responsibilities and recurring meetings that don’t change. Through an iterative process focused around sprints, which normally last around two weeks, the Scrum team delivers on defined set of project outcomes on a regular basis.

While initially conceived for the software development industry, we’ve found that the agile methodology behind Scrum applies equally as well to both the project and operational aspects of what we do at Datotel. The general principles of the Scrum methodology are:

  1. Customer satisfaction is the highest priority.
  2. Open to changing requirements, at all stages of the project.
  3. Faster turn-around.
  4. Built on a foundation of teamwork
  5. Full leadership support to provide the team with the environment and support they need to get the job done.
  6. Conveying information to and within a development team via face-to-face conversation.
  7. Measuring progress through working environments and deliverable delivery.
  8. Maintaining a constant pace indefinitely, the Scrum process promotes sustainable development.
  9. Around-the-clock attention to technical excellence and good design.
  10. Ease, the art of “working smarter” is essential.
  11. Self-organizing teams, the best solutions, requirements and designs emerge from this structure.
  12. Adjusting behavior at regular intervals. The team can then reflect on how to become more effective, and fine-tune accordingly.

Ultimately, by using Scrum, we are able to provide our clients:

  • Faster implementation
  • More efficient delivery mechanism
  • Flexibility with regards to change requirements
  • Earlier deployment for parts of the solution
  • Finding problems/blockers early so we can tackle them sooner
Posted in Company Info, General, Managed Services, Metrics, Service Level Agreements | Tagged , , , | Leave a comment

SSAE16 SOC2 – What is it and why should you care?

When you outsource elements of your IT support and environment, how do you know the partner you have chosen is operating soundly, efficiently and not exposing your data and systems to unwanted risk? It’s a bit like choosing to go on a trip with someone that has passed their driving test versus someone that just tells you they are a good driver, with no valid license. It sure is comforting to know the driver has demonstrated to an independent 3rd party that they know what they’re doing.

To solve this problem in the IT space, the American Institute of Certified Public Accountants (AICPA) developed an auditing standard SSAE16 (Statement on Standards for Attestation Engagements) SOC2 (Service Organization Control 2) through which organizations such as Datotel could demonstrate through an independent CPA auditing and attesting that not only do they have the necessary controls and processes in place, but that they are adequate, sound and being adhered to. The result is an annual report that you as the client can request that give assurances that you and your IT systems are in good hands.

This level of auditing shows a high level of discipline in the IT organization and means real and tangible positive differences for you and your organization versus working with a vendor that doesn’t subject themselves to these higher standards. It demonstrates the ability to mitigate security, reliability and availability risks, lowers your risk of outages, system performance issues, data loss and leads to an overall improved quality of operation. Armed with this information why would you choose a partner without this level of audit?

As I mentioned earlier an important distinction to look for in the report is to ensure the partner has gone through the Type 2 audit and not stopped after completing the initial Type 1 requirements. The former simply lets you know what controls are in place in the organization whereas the Type 2 audit not only examines what the controls are, but ensures that they are being followed. A big difference. Secondly make sure the report has covered all areas of the business and not been limited to just one service offering such as colocation space.

Datotel’s SSAE16 SOC2 Type 2 certification indicates that processes, procedures and controls adopted by Datotel have been formally evaluated and tested by an independent accounting and auditing firm. Datotel has been SAS70 certified since 2007 and subsequently SSAE16 certified since 2012 across all lines of business from Colocation to Managed Services, Cloud Services and Service Desk.

Posted in Cloud Computing, Colocation, Company Info, General, Managed Services, Metrics | Tagged , , , , | Leave a comment

Keeping up with HIPAA

The fact is, as technology continues to grow and change rapidly, so do rules and regulations that are intended to save us from ourselves.

We’ve heard about the Health Insurance Portability & Accountability Act (HIPAA), the government act put in place to essentially, keep your private information private. HIPAA was put in place in 1996…a long time ago (in technology years), so in 2009 the government had to step up security of Protected Health Information (PHI) under the American Recovery and Reinvestment Act with regulations contained in what is called the Health Information Technology for Economic and Clinical Health (HITECH). I believe they came up with the acronym first because it’s just too perfect.

HITECH essentially means, if you’re using any form of shared technology related to the healthcare industry, you need to comply to strict regulations of security.

Understanding The Web (of involvement)

If you look at the number of hands that touch private medical records, you’ll find it goes way beyond the doctor, the nurse and the receptionist. Almost half of the HIPAA data security breaches in one year trace back to a business associate. That could be 7-10 layers from the actual patient. For instance, the lab tech’s data entry associate’s resident intern. Guess what happens when there’s a breach that’s not even close to the original doctor or medical expert, they, or the lab, are the ones who will be fined tens of thousands to hundreds of thousands of dollars.

Don’t take any chances. If it affects the healthcare industry monetarily, it may trickle down to the patient bills and co-pays to absorb those costs.

If you’re in the healthcare field, or your business has any association to the healthcare industry, then the first order of business is to educate your entire team. If anyone is in and around the healthcare field they should sign off, acknowledge and understand how to keep medical records from being compromised.

Encryption, Encryption, Encryption

One more time…Encryption. You can be saved by encryption. If you have encrypted PHI that’s within the requirements of the HITECH Act, then you’re not liable. That’s because encrypted information is currently the most secure way of handling sensitive, private information.

Since the Bring Your Own Device (BYOD) element is added to the mix it’s even more imperative that everything meets HIPAA compliance standards. An encrypted secure messaging system will be the closest thing you can get to guaranteeing that all PHI is secure and confidential.

Look To The Cloud

Cloud storage for high-resolution medical imaging not only provides a great storage option that’s less time consuming than other means of backups, but it can also be a tremendous money-saver. When looking for a cloud service provider for your storage, there are a few things to consider.

  • Does the provider offer the right back-up system and infrastructure for your needs?
  • Is the provider HIPAA compliant beyond just saying they are?
  • Does the provider offer the security needed for medical imaging storage with protection put in place that deters hackers or leaks in security?
  • Does the provider offer an SLA that still ensures data ownership to the client?

These are tough questions to ask of any cloud service provider, so don’t expect the perfect answer, but DO expect the provider to be willing to share all their information that will make you feel comfortable about putting sensitive medical records in the cloud.

Don’t Put All Your Medical Data in One Basket

Besides cloud storage you need to consider your backup plans and data recovery. The biggest identifier should be, are the backups secure and safe from malware.

There is so much to cover to be HIPAA compliant. But instituting the above practices and making yourself knowledgeable about keeping PHI secure is the greatest thing you can do to protect your company and our information.

Posted in Backup, BYOD, Cloud Computing, Datavaulting, HIPAA, Mobile, Security | Tagged , , , , , , , | Leave a comment

The Reality of BYOD Security

It doesn’t matter if you’re the CEO, CFO, CIO or the CBP (Chief Button Pusher), every one in any business is capable of unintentionally compromising security. Every business now deals with Bring Your Own Device (BYOD) issues at some level and we’re all responsible – from the top on down. So how do you manage all that business data on everyone’s personal device and keep it safe?

You’ve got to walk the walk… It’s important for every employee to respect and be diligently mindful of the policies that are put in place. If you’re the one who dismissively downloads a seemingly harmless, un-authorized application on your phone, then you’re the one who could potentially lose your job if data is compromised. Policies are put in place to protect the company, but inevitably it protects the employee. How can we protect our vital work information while using the same device that we let our children borrow for long car rides?

Think about the other “secure” items in your life. If you have firearms in your home, you (hopefully) have them contained and locked. If you have cleaners, bug sprays or other contaminants, you have them contained in child-proof cabinets. If you have important legal papers, you most likely have them contained in a safe-deposit or firebox. But do you have important digital business documents, business applications or business designs on your device, mobile or other, and let anyone have access to the information that could potentially destroy or leak your work?

Why take the risk? There are various types Mobile Device Management (MDM) programs to compartmentalize, or contain, your work life from your home life. Keep your two lives separate on one device without fear of security issues if your phone is lost or stolen. At that point, all IT needs to do is shut that part off and wipe it clean. And if your 10 year old wants to play some games on your device, you and your work are secure.

MDM, now folded into overall Enterprise Mobility Management (EMM), need not only be developed and policies drawn up, but also needs to be updated annually. Whether you have MDM in place now or not, it should always be considered as part of an ongoing management system. Policies can’t be put in place and left alone. Technology changes rapidly and new malware is produced faster than the products themselves are being produced. Annual upgrades and policy changes are key.

There isn’t one application or one policy that fits all businesses so you need to do some research. The MDM platform that works best for your business to successfully manage BYOD is something that can’t be glossed over. All employees can be helpful in drawing up policies if included in the conversation with the IT department. Every department has a different function and the IT group needs to know what is going to work, all around, so information in separate containers can still be shared. There are some basic core functions to consider in MDM:

  • Define your inventory of devices being used
  • Choose a platform that can encompass all devices with remote capabilities
  • Define the software to be distributed which includes applications
  • Consider what kind of security management is needed
  • Include all levels of data protection
  • Have help and support for your users available

These are general categories to consider with a myriad of sub-categories and options that are determined by whatever MDM will suit your business.

Don’t ignore or dismiss all the dangers in our new Bring Your Own Device world. We’re all held accountable for making sure our devices are secure to protect our work and home. Critically analyze and determine what’s being used, how it’s being used, how it can be potentially be compromised and what’s needed to prevent security leaks and potential loss of data.

Posted in BYOD, Mobile, Security | Tagged , , , , , , | Leave a comment
  • Why Patch Management is so important:

    You’ve seen the news and read the articles. The recent ransomeware attack is being called the largest ransomware attack in internet history. But did you now that the damage could have been avoided if those computers had been properly patched? … Continue reading

  • Admin Terms of Use Contact Us