Presentation: Security and Governance in the Cloud

Here is a presentation that I did recently for NHS CIO’s and CCIO’s.

It is all about how NHS England has followed a journey to cloud services and the IT Security & Information Governance issues we had to deal with along the way. It tries to also show other NHS organisations how they might work towards similar aims.

DSC vs. GPO vs. SCCM vs. MDM

Microsoft Windows administrators now have a number of ways for managing their estates.

  • Group Policy (GPO)
    Allows very fine-grained control over every aspect of Windows. Primarily aimed at Windows desktops. Requires Active Directory (AD) and very careful configuration. Requires well trained specialist staff to get it right.
  • System Center Configuration Manager (SCCM)
    Allows central control over software delivery. Also requires AD. Configuration of delivery packages can be complex and very careful change control is required. Software delivery via SCCM can also be intrusive to users. Requires well trained specialist staff to get it right.
  • Desired State Configuration (DSC)
    Though extended by Microsoft this is actually part of a wider open standard “Open Management Infrastructure” and so applies to other platforms as well including Linux. Mainly aimed at server configurations. Falls into the DevOps camp as it defines server configurations in purely text format and so can be put under source control easily. DSC is typically dynamic and enforces the correct configuration (normally every 15 minutes) which greatly helps ensure secure configurations.
  • Mobile Device Management (MDM)
    Primarily aimed at mobile devices, this style of configuration is increasingly applicable to Windows Desktops with the advent of Windows 10. Microsoft InTune is leading the way with other MDM vendors following on. Not everything on the desktop can yet be controlled this way, even with W10 but many key settings and controls are already available. A much simpler method for enforcing desktop settings than the other methods, it allows fewer administrators and much less specialist knowledge.

The article from FoxDeploy covers the first three of those and lays out the purpose of each. Well worth a read.

What is missing is the 4th method which uses Mobile Device Management tooling. The leading contender for this is Microsoft InTune. However, InTune is really only focussed on Windows 10 (desktop and mobile), it has limited control in other Operating Systems.

Servers only ever exist in a given state. If they deviate or we make changes, we refactor and redeploy. DSC drives it all and the machine will be up and running on a new OS, with data migrated in a matter of minutes.

For all practical purposes, the first true large scale management tool we had for Windows systems in the modern era was Group Policy, or GPO as it is commonly truncated.

Comparatively, SCCM and MDT allow us to we import an image from a Windows install disk and then run dozens of individual steps which are customized based on the target machines platform, model, office location and other factors. The sky is the limit.

Curated from DSC vs. GPO vs. SCCM, the case for each. – FoxDeploy.com

Why I Still Don’t Use Bing For Searching

Microsoft continue to reinvent themselves for the 21st Century but Bing lags behind compared to its competition.

Whilst Microsoft seem to continue to reinvent themselves for the 21st Century and are coming out with some excellent products and services that are far more reactive to the views of their customers, there is one product that still lags far behind the competition – at least if you are not in the USA.

The Bing search engine.

With my recent move to a Surface Pro 4 and various recent updates to Windows 10, I thought it a good idea to revisit using Edge as my default browser and to try to stick with Bing as the default search.

But I’m sorry Microsoft, it doesn’t work! Even when not logged in to Google, it consistently returns far more relevant answers as evidenced by the following search for the latest Raspberry Pi flavoured version of the Scratch programming environment “NuScratch”.

Search in Google vs Bing
Search in Google vs Bing

Need to do better!

A simple mail filer for Microsoft Outlook (VBA)

Like many people I receive an unmanageable amount of email each day. Many days I get through only around 1/3 of the email I receive.

However, the role I am in professionally requires me to retain a large proportion of correspondence. Some because it relates to ongoing projects, other because of security, audit or compliance reasons.

In addition, I work across many projects. It isn’t unusual for me to be involved in two dozen projects at any one time on top of my day-to-day management work.

So I have many folders – hundreds in fact – and filing email into the right folder has become a real drag. It can take an appreciable amount of time to hunt down the correct folder and Outlook does not provide any way to search/filter folder names in the UI.

Thankfully, I have access to VBA in Outlook. While the experience of using VBA macro’s to control Outlook is rarely pleasant, it does get the job done – mainly.

My requirements for the utility were as follows:

  • Must let me select multiple emails, if any have already been filed, show me the folder(s) so I can quickly file new email to the same folder as the rest of the conversation.
  • Must give me a list of all my folders with a simple way of filtering the list by typing a few letters.
  • Must also let me open a folder for viewing instead of filing or cancelling.

A couple of hours later, I was able to create a new utility. This has been published to Github and you can find it at:

https://github.com/TotallyInformation/outlook-filer

No Code Business Solutions in Microsoft SharePoint

Resources to show you how to create code-free business solutions in Microsoft SharePoint

It used to be that you had to be an expert Microsoft developer to create business solutions in Microsoft SharePoint but that is no longer true.

There are many ways for users and power users to create incredible solutions with no coding at all.

Here are two resources that show you how:

Outlook 2013 URL Protocol Handler

Outlook has a custom URL protocol that allows interaction with different elements such as folders, mail and calendar items and contacts, Since Outlook 2007, this has been restricted for use only within Outlook itself but there are some tremendous opportunities for use from simple web systems. This post explains how to turn it on, even for Outlook 2013 (Office 365 version). It also gives pointers to other articles on how to use the protocol.

One of the nice features about older versions of Microsoft Outlook was that it had a set of URL Protocol Handlers (like outlook:inbox) defined that could be used system wide to trigger actions in Outlook such as opening a folder, creating or editing an item.

Unfortunately, along the way, these got gradually toned down so that they only worked from within Outlook itself.

This can still be useful. I’m not sure how many people realise that you can create “folders” in your Outlook mailbox. Choose Properties .../Home Page and set a URL – maybe your blog or Intranet. Now when you click on the folder, you will see the web page instead of a set of mail items or whatever.

When using this feature to do some more clever stuff such as creating To Do lists from incoming mail, you might choose to use a dynamic web system to handle the list. CouchDB or Node.JS are lightweight web systems that come to mind.

Then you might find yourself wishing that you could create links in your To Do system back to the original email in Outlook. Well you can! Sort of.

It turns out that, although the external use of the Outlook: protocol hasn’t been available since Outlook 2003, it can still be turned on, even in Outlook 2013. There is a useful article on the TeamScope web site that shows you how to turn on the outlook: protocol system-wide.

One minor wrinkle though if you use Office from an Office 365 subscription – the location for Microsoft Office applications is different! You will find them at: C:\Program Files\Microsoft Office 15\root\office15.

Here then is the registry code that you need to enable the protocol:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\outlook]
"URL Protocol"=""
@="URL:Outlook Folders"

[HKEY_CLASSES_ROOT\outlook\DefaultIcon]
@="\"C:\\Program Files\\Microsoft Office 15\\root\\office15\\OUTLOOK.EXE\""

[HKEY_CLASSES_ROOT\outlook\shell]
@="open"

[HKEY_CLASSES_ROOT\outlook\shell\open]
@=""

[HKEY_CLASSES_ROOT\outlook\shell\open\command]
@="\"C:\\Program Files\\Microsoft Office 15\\root\\office15\\OUTLOOK.EXE\" /select \"%1\""

Simply save this into a .reg file and open it to install the changes.

Now you can use the outlook: protocol anywhere on the system, great for dynamic web systems.

One minor word of warning though – there are dangers! Don’t open links unless you know what they are, where they go and what they do!

To find out how to use the Outlook protocol handler, try one of the following articles:

One final note. I’m now looking to create some tools that link between Outlook and CouchDB. CouchDB provides a very lightweight NOSQL database that uses JSON and JavaScript to great effect. I’m already using it to track statistics on incoming/outgoing emails, linking the web interface back to Outlook via the home page method mentioned at the start. I’m going to have a go at creating a task monitor too if I get the time. I am currently reading only around a quarter of the emails in my work inbox and I really need some tools to improve the situation. Food for some more blog posts hopefully.

Microsoft 64-bit Application Support (lack-of)

Microsoft’s 64-bit support is still sorely fragmented as we find out with a brand new laptop trying to access Microsoft SharePoint.

The joys of working with Microsoft products!

So I have a brand-new, shiny 17″ HP laptop. 64-bit throughout. 6GB of RAM and comes pre-installed with 64-bit Windows.

You would think, then, that you would want to use 64-bit applications right? Wrong!!

I automatically use the 64-bit version of Internet Explorer to access some Microsoft specific sites (Outlook Web Access and SharePoint 2007). I install and use the 64-bit version of Microsoft Office. Does this work well with SharePoint (from Microsoft)? No!

For starters, you cannot upload an Excel spreadsheet to a SharePoint list like you should be able to. You get an error:

This feature requires Microsoft Internet Explorer version 5.0 or later, and Windows 95 or later.

Next you try to switch a list into a “Datasheet” view – which looks a bit like a spreadsheet. Inevitably, you get another error:

The list is displayed in Standard view. It cannot be displayed in Datasheet view for one or more of the following reasons: A datasheet component compatible with Windows SharePoint Services is not installed, your browser does not support ActiveX controls, or support for ActiveX controls is disabled.

To fix these errors, you then have to download and install “2007 Office System Driver: Data Connectivity Components“.

And you have to use the 32-bit version of Internet Explorer 9 (IE9).

Low-cost Information Management, Communications and Collaberation Tools

Although much of the work I do is for very large organisations and extremely costly projects, being an adopted Yorkshire-man, I’ve always an eye open for a bargain! More seriously, there are many small to medium sized businesses and charities that cannot afford big IT budgets but that still are crying out for good information management, communications and collaboration tools. In this article, I’ve tried to highlight a few tools that I think are worth looking at.

I’ve not included anything in this article that requires a monthly or annual cost. All the tools here are available for free at least with limited features. The feature lists given are for the free versions with paid-for key features noted where appropriate. I also note if any of the web sites are blocked by typical enterprise firewalls.

There is a lot more than what I’ve shared here, I’ll try to update this article from time-to-time. Continue reading “Low-cost Information Management, Communications and Collaberation Tools”

Microsoft’s Facebook Docs.com fails at the first hurdle

Had my first test for Microsoft’s new docs.com this week – and it failed badly.

In case you don’t know, Microsoft recently announced a new beta Office Live link-up with Facebook. You can log in using your Facebook login instead of a Microsoft Live Id.

So you would think that it would be possible to use docs.com as a collaborative document editor and I suspect that you are supposed to be able to – as long as your documents don’t contain anything complex – such as comments!

My wife wanted to share a spreadsheet with some friends – very simple – just a few lines to help them schedule some transport for the kids during an upcoming dance show. Docs.com seemed ideal for this as they are all on Facebook so it should be much easier than using Google docs.

  • The first problem is that docs.com doesn’t always pick up your existing Facebook login so you have to log in again.
  • The second problem is that even when you are logged in, there is a large banner asking you to sign up for the Beta programme – very confusing.
  • The third problem is that the interface does not work correctly with Firefox – there is no warning of this but there are some things, such as adding viewers and editors, that fail with no proper explanatory error message.
  • The fourth problem is that only the original creator can add other editors or viewers, there is no way of delegating this.
  • The fifth, and most serious, problem comes from using cell comments to annotate cells. Apparently Microsoft’s shiny new online Office suite cannot cope with this. Not only does it not show them on the web page, it will no longer let you edit the spreadsheet online! To compound the problem, when someone else (who has been given edit rights) then downloads the sheet as instructed – there is no way to get the edited sheet back online!!

OUCH – it is, in fact, much easier to simply email the document back and forth.

Of course, we could have used Google docs for this. In fact, Google docs seems to have much better compatibility with Microsoft Office than Microsoft do!! It had no problem with cell comments. You can also set the document to not require a login, handy as many people don’t have Google logins. But by this time, the audience had lost patience with the technology and done things a different way.

It may only be in Beta but Microsoft seem to be determined to demonstrate that they don’t understand user interactions in a collaborative sense nor do they have any comprehension it seems for the need for simplicity. 1 out of 10 for docs.com then – must try better!

UPDATE 2010-06-18: Tried again, this time with Google docs. I set the document so that anyone can edit it (without needing a Google login), shared the link using Facebook messages and everyone is happy. You can even work on the document together, you actually see other people updating the document. Given that it also supports more useful features than docs.com, Google docs gets the thumbs up – 10/10

PS: Sorry about comments, I’ve updated the Blogger theme and it seems to have broken the old comments. If you are desperate to get in touch, feel free to use my comment form. I’ll put any comments on here manually.