Enterprise on Much Ado About IT

Presentation: Security and Governance in the Cloud

Julian Knight — Mon, 28 Nov 2016 12:54:25 +0000

Here is a presentation that I did recently for NHS CIO’s and CCIO’s. It is all about how NHS England has followed a journey to cloud services and the IT Security & Information Governance issues we had to deal with along the way. It tries to also show other NHS organisations how they might work towards similar aims.

Open Source vs Proprietary in UK Central Government Organisations

Julian Knight — Mon, 20 Jun 2016 00:00:00 +0000

NB: This article is incomplete - it was converted from a previous blog site. It is included as a draft.

Open source does not necessarily mean that open integration and open data is facilitated

The issue of open source vs proprietary applications for organisations related to the UK government comes up regularly. the UK’s Cabinet Office have issued clear guidance that open source is preferred and should always be considered when procuring new systems.

However, this actually leads to confusion with many people then assuming that choosing proprietary applications will lead to trouble.

The truth is rather more nuanced and it is worth thinking about. For me, the best approach is to deliver open data and open integration rather than focusing on open source per se.

The following notes have been extracted from some internal documentation I did for our organisation. That is why is focuses on Microsoft. I am not advocating a specific vendor nor am I prioritising proprietary over open source. I am simply recommending a balanced and holistic view to get the best possible deal for the public purse.

My view, and the view of quite a number of other people I’ve had the opportunity to talk to across government, is that the focus should be on open integration rather than necessarily open source. Using open source does not necessarily mean that open integration and open data is facilitated. Conversely, some proprietary vendors have made great strides in ensuring that systems can be integrated and data shared.

At present, Microsoft, Google and Amazon all seem to “get” the issues of open integration and open data to one degree or another.

Discussion in the open source debate tends to focus on license costs. OS is license free by definition; however, you will still pay for support. OS software is often also (much) harder to implement and support due to patchy documentation and many individuals contributing different code. Not always true of course but there is certainly a degree of truth in this.

In the case of something like the Microsoft platforms, the implementation and support costs of the core software (such as Office 365) have been driven down massively and the economies of scale we are bringing to bear through greater cross-government collaboration is improving that still further. At the same time, large license scales enable organisations to make use of additional funding that comes out of our EA agreements. This gives us access to additional planning, design and implementation services that all would have to be separately paid for with open source software. These all have a tendency to balance out the books.

User and administrative training is the final element and again, proprietary vendors tend to provide more and better quality training/documentation resources than open source (again, in general). Proprietary software also has a tendency to have better developed user interfaces requiring less training. This further balances the cost equation.

So while I fully support the need to evaluate OS vs proprietary software, we must do so holistically otherwise we will not get the expected benefits and there is plenty of evidence to support this view from the likes of Germany and Brazil both of whom have extensively switched to open source software.

The bottom line is that Microsoft are often currently viewed as the best strategic partner we can have in areas of desktop operating systems, general office applications and general cloud computing facilities. They have already made good progress in opening a lot of previously proprietary code and supporting open interface standards & they currently see the health sector as one of their primary growth areas. We have made good use of this while continuing to keep an eye out for changes in their policies that will happen inevitably. The key things are to ensure that we have strategies for exiting Microsoft platforms should we need to in the future and that we continue to evaluate the value of our investment. We don’t do this blindly though. As a specific example, the use of Microsoft Dynamics Online, their cloud CRM, is relatively expensive. It is a good platform where a full CRM is required but it is expensive when only limited CRM tools are needed and we recommend other tools in those cases.

DSC vs. GPO vs. SCCM vs. MDM (Intune)

Julian Knight — Sat, 18 Jun 2016 17:42:13 +0000

Microsoft Windows administrators now have a number of ways for managing their estates.

Group Policy (GPO)

Allows very fine-grained control over every aspect of Windows. Primarily aimed at Windows desktops. Requires Active Directory (AD) and very careful configuration. Requires well trained specialist staff to get it right.
System Center Configuration Manager (SCCM)

Allows central control over software delivery. Also requires AD. Configuration of delivery packages can be complex and very careful change control is required. Software delivery via SCCM can also be intrusive to users. Requires well trained specialist staff to get it right.
Desired State Configuration (DSC)

Though extended by Microsoft this is actually part of a wider open standard “Open Management Infrastructure” and so applies to other platforms as well including Linux. Mainly aimed at server configurations. Falls into the DevOps camp as it defines server configurations in purely text format and so can be put under source control easily. DSC is typically dynamic and enforces the correct configuration (normally every 15 minutes) which greatly helps ensure secure configurations.
Mobile Device Management (MDM)

Primarily aimed at mobile devices, this style of configuration is increasingly applicable to Windows Desktops with the advent of Windows 10. Microsoft InTune is leading the way with other MDM vendors following on. Not everything on the desktop can yet be controlled this way, even with W10 but many key settings and controls are already available. A much simpler method for enforcing desktop settings than the other methods, it allows fewer administrators and much less specialist knowledge.

The article from FoxDeploy covers the first three of those and lays out the purpose of each. Well worth a read.

What is missing is the 4th method which uses Mobile Device Management tooling. The leading contender for this is Microsoft InTune. However, InTune is really only focussed on Windows 10 (desktop and mobile), it has limited control in other Operating Systems.

Servers only ever exist in a given state. If they deviate or we make changes, we refactor and redeploy. DSC drives it all and the machine will be up and running on a new OS, with data migrated in a matter of minutes.

For all practical purposes, the first true large scale management tool we had for Windows systems in the modern era was Group Policy, or GPO as it is commonly truncated.

Comparatively, SCCM and MDT allow us to we import an image from a Windows install disk and then run dozens of individual steps which are customized based on the target machines platform, model, office location and other factors. The sky is the limit.

Curated from DSC vs. GPO vs. SCCM, the case for each. – FoxDeploy.com

Update 2018-05-04 - Intune and Autopilot

It should be noted that Intune is now much more capable than when this was originally written.

Intune now has mobile device management that easily rivals any of the other MDM tools across all platforms. It is also well able to manage Apple OS X as far as Apple actually allow remote management of this type (they provide only a restricted set of API’s unlike Windows).

It should now be possible to manage and configure Windows desktops (at least Windows 10) just using Intune via the Cloud without any input from the other tools.

Intune coupled with Microsoft Autopilot provides a massively powerful and attractive set of tools for the deployment and configuration of Windows 10 based devices.

Autopilot lets you ship devices straight from the manufacturer to the end user with no build needed. The user only requires a broadband Internet connection. Devices are unboxed by the user and connected to the Internet. The user logs in with their cloud identity. Intune “knows” which organisation the device belongs to and begins configuration. The whole process takes about 10 minutes to give a device that can browse the Internet and 1 to 2 hours at most before all local client applications are installed and configured (in the background) depending on the complexity of your configuration.

No Code Business Solutions in Microsoft SharePoint

Julian Knight — Tue, 02 Jun 2015 22:55:23 +0000

Resources to show you how to create code-free business solutions in Microsoft SharePoint

It used to be that you had to be an expert Microsoft developer to create business solutions in Microsoft SharePoint but that is no longer true. There are many ways for users and power users to create incredible solutions with no coding at all. Here are two resources that show you how:

No-code solutions using SharePoint 2013 Composites

“Let’s not write code, until we have to write code” A handbook showing all of the many different ways of creating no-code business solutions in SharePoint. Includes demos, labs, walkthroughs and tutorials.
Proven Ways to Build Robust, No-Code Solutions in Microsoft SharePoint

An hour long video from Ignite 2015 dedicated to demonstrating no-code business solutions.

Slides

New Laptop: Lenovo ThinkPad Yoga

Julian Knight — Fri, 02 May 2014 16:02:58 +0000

I have the pleasure of trying a new laptop right now as we consider them for work.

The Lenovo ThinkPad Yoga.

We have this configured with an Intel i5, 8GB RAM, 1TB HDD with 16GB SDD speed boost, the touch & pen screen. It is a nice laptop with a screen that folds right over so you can use it as a slightly chunky tablet, the keyboard locks in this mode so you don’t accidentally press keys.

It is great to finally be able to afford a laptop with a proper, pressure sensitive pen interface, it is a joy to use with tools such as Microsoft OneNote.

The touch pad is also the best I’ve ever used. The pad itself is a proper mechanical button and once used, you will never want to go back to a trackpad that doesn’t provide such positive feedback and natural feel.

We have Windows 8.1 Pro on it and the usual ups and downs of that operating system apply. Personally, I find W8.1 less reliable than Windows 7 but I suspect that it comes down to the software you use. I can say categorically that the “Modern UI” apps are a disaster. In particular they do not fully close when you think you’ve closed them (check in the Task Manager) and I’ve often noticed a significant slow-down after having started and “closed” several Modern UI apps.

The laptop is certainly nice to use overall, it isn’t too heavy and can be used on one arm for 5-15 minutes without discomfort, longer than that becomes noticeable though. So not a complete tablet replacement. Great when sat however with it perched on a knee or supported with a table. No more scrappy paper notes for me! It is OneNote all the way.

The Good

Pen and touch with Windows 8.1 and Microsoft Office, a great combination.
Fairly thin considering the features available.
The fold-over screen is easy and natural to use.

The Indifferent

The Windows architecture doesn’t handle very high resolution screens well. I blame this on the development tools and Windows graphical UI libraries mainly. Too many applications do not correctly scale.
Only 2 USB ports. About average for a thin laptop but very limiting when there as so many devices needing USB.
After many years, Lenovo have finally changed their power connectors. Annoying though necessary, all those spare power supplies scattered around aren’t so useful now. Fortunately, you can buy a converter cable if you want to.
Some windows behave oddly, changing font sizes drastically for no apparent reason. Not sure if this is Windows or something to do with the laptop.

The Bad

The power button is in the wrong place, it gets clicked by mistake too often. It is on the right hand side of the base at the front. Right next to the volume buttons.
No drive LED indicator – really?! When using a PC this is essential if you want to know whether a pause in response is due to disk activity or something more serious.
Mini-HDMI interface. This is not good for a business laptop, we already have full and mini Display Link adaptors and now we need to have HDMI as well.
No native LAN interface. You have to give up one of the 2 USB ports and to get a USB-to-LAN cable if you want a wired connection. Again poor for a business laptop.
The usual pointless spamware is pre-installed. However, Lenovo are better than most, not installing too much and their own wares do seem to actually serve a purpose mainly (I probably kept 1/2 of their own tools and removed everything else). Driver and software updates seem regular.
Windows 8.1 Modern UI apps continue to be a very uncertain proposition with poor quality being rife and even the better quality apps seeming to regularly result in ongoing reduced performance on the PC. (Not Lenovo’s fault of course).

Conclusion

A worthy, flexible tool if you need or want both touch and pen interfaces. If not, save some money and go for a Lenovo X240. Possibly the most affordable convertible with pen and touch, at last such devices are in reach of mortals!

Microsoft 64-bit Application Support (lack-of)

Julian Knight — Wed, 12 Sep 2012 13:08:44 +0000

Microsoft's 64-bit support is still sorely fragmented as we find out with a brand new laptop trying to access Microsoft SharePoint.

The joys of working with Microsoft products!

So I have a brand-new, shiny 17″ HP laptop. 64-bit throughout. 6GB of RAM and comes pre-installed with 64-bit Windows. You would think, then, that you would want to use 64-bit applications right? Wrong!!

I automatically use the 64-bit version of Internet Explorer to access some Microsoft specific sites (Outlook Web Access and SharePoint 2007). I install and use the 64-bit version of Microsoft Office. Does this work well with SharePoint (from Microsoft)? No!

For starters, you cannot upload an Excel spreadsheet to a SharePoint list like you should be able to. You get an error:

Next you try to switch a list into a “Datasheet” view – which looks a bit like a spreadsheet. Inevitably, you get another error:

To fix these errors, you then have to download and install “2007 Office System Driver: Data Connectivity Components“. And you have to use the 32-bit version of Internet Explorer 9 (IE9).

Enterprise System Design and Accessibility

Julian Knight — Fri, 11 Nov 2011 17:21:57 +0000

It isn't just web pages that are required to meet accessibility standards and laws. **All** applications have to. This short article is a reminder to application designers and builders regarding the standards and legal obligations they have to meet.

Most web designers are well aware of the need to design with accessibility in mind and that this is a legal requirement in many countries. Not so many IT architects and designers who deal with internal, enterprise systems are aware, though, that these laws and requirements also apply to internal systems.

Recently I’ve yet again seen a number of dreadfully designed user interfaces (UI) for enterprise systems that most certainly don’t meet usability standards let alone accessibility standards!

So here are a few links to information on standards and laws around accessibility – while most of these seem to be focused on web systems, lets remember that they do apply to internal and enterprise systems as well.

Wikipedia: Web Accessibility
W3C Web Accessibility Initiative (WAI) (from the web’s standards body)
UK Central Office of Information (COI): Web Standards and Guidelines for UK government web sites
There is also a British Standard for web accessibility BS8878. However, ridiculously, the British Standards Institute charge £100 for it! SO I won’t link to it but there are some web resources that summarise it, as always Google is your friend.
Accessible Technology A guide for IT professionals (PDF) The key regulations for UK organisations are:
Disability Discrimination Act (DDA) 1995 & 2005
Equality Act 2010 (supersedes the DDA)

One final note about designing to accessibility standards. Plenty has already been written on this subject and I don’t want to repeat that. Just to say that it is normal for web sites to be asked to meet W3C WCAG 2.0 level Double-A (AA) standards. However, you should not try to slavishly follow these standards. There are lots of grey areas. In particular, if you are using the online web validation tools, don’t worry too much if you get some minor failures. You need to test failing pages against accessibility devices rather than blindly following some written rules.

Minor update 2018-04-28 Reformat after move from WordPress to Hugo.