347-878-3837

entrepreneurship

Here are articles on entrepreneurship

What is a Business Model? The anatomy of how a business makes money

Note: This article was written several years ago, when PayPal.com was a humble startup, Eudora Pro was still a leading desktop e-mail client, and cameras still used film.

Q: Many people say that they want to see your business model. What exactly do they mean by that? Do they want to know your target market and strategy, or do they need financial information as well?

A: A business model is quite simple: it is a brief statement of how an idea actually becomes a business that makes money. It tells who pays, how much, and how often. The same product or service may be brought to market with several business models.

Here are several sample real-world scenes, showing how similar products can have very different business models.

Consumer Reports vs. TIME Magazine

Consumer Reports makes money solely from grants and subscribers . It has a subscription-based business model.

TIME makes money both from subscribers and from advertisers. It has more of an advertising-based business model.

The difference in business models tells you a lot about the two businesses. Consumer Reports is going to concentrate on selecting content which will be of high enough value that people are willing to pay a subscription fee. Since it doesn’t depend on ads for income, no one but the editorial staff influences the articles.

TIME Magazine, on the other hand, also must take advertisers into account. TIME needs content for its readers, but it is largely concerned with growing a demographic for the advertising it sells. Since TIME makes most of its money from ads, an advertiser’s threat to pull advertising may put pressure on the magazine to pull or rewrite a story that the advertiser finds objectionable.

Movie Theaters

During the first several weeks of a movie’s run, almost everything in a theater’s box office goes to the film’s distributors and producers. The theater makes its money from the concession stand! The business model: sell tickets at cost, and make profit on refreshments.

This model implies that staffing the refreshment stand should be high priority. When the theater is crowded, bring in extra staff to keep refreshments flowing. Since that’s where the money is made, losing sales from too-long lines is losing the only profitable sales the theater makes.

A theater near my house rents second-run movies that have been out long enough for the theater to be able to keep most of the ticket revenue. They make much more of their money on ticket sales, and put far less emphasis on the refreshment stand.

Razors vs. Shavers

Gillette is happy to sell you their Mach III razor handle at cost, or even below cost. Because they then sell you the profitable razor cartridge refills. Again and again and again… Their business model is virtually giving away the handle and making their money from a stream of razor blade sales.

Electric shavers have a different model. They cost a lot more than the Gillette handle. They cost enough that the manufacturer makes all their money up front, rather than from the stream of blade refill sales (electric shaver blades do wear out, but it takes a much longer time).

Digital vs. Film Cameras

Traditional film cameras cost a bunch of money. And then, you buy roll after roll of film to take pictures. Then you spend even more getting the pictures developed. If you’re using a Kodak camera, Kodak film, and Kodak developing, then Kodak will be very happy. Their business model makes them money from camera sales, film sales, and processing fees.

Digital cameras eliminate film sales and processing fees. Kodak needs to find a new business model before the cameras catch on more widely. And they are working on it. They are establishing digital printing centers, where you can have your digital camera pictures printed on genuine Kodak paper. The business model that was based on film sales and processing is becoming a model based primarily on photograph printing.

paypal.com … who knows?

Sometimes a business’s business model is not obvious. The web site www.paypal.com allows you to send money to a friend via e-mail. The money is either charged to your credit card or taken in cash from your cash account at paypal.com The intriguing twist is that paypal takes no commission on the transfer.

How do they make money? What’s their business model?

I don’t know, yet. From interest, perhaps? If enough users deposit money with paypal before paying it out, they collect interest on that money until the recipient finishes the transfer. If this is their business model, then they should concentrate on increasing float: getting more interest on their money, encouraging people to fund their paypal accounts long before they will send money to friends, and encouraging people to leave the money sent to them in their account just a bit longer.

Other models they could use:

Charge a fixed transaction fee on each transaction. Resulting business goals: encourage lots of small transactions.
Charge a transaction fee that is a percentage of the transfer. Resulting business goals: encourage large transfers, since they make as much as many smaller transactions, but without the overhead of doing many transactions.
Or, since electronic funds transfers are cheaper for banks than processing check, paypal might have banks give them a percentage of the savings from doing transfers by EFT rather than by check.

Brick-and-Mortar Brokers vs. E*Trade

Traditional brokers make money by charging a commission on purchases and sales. The commission is a percentage of the transfer amount, so brokers may be happy with clients who trade infrequently, as long as they buy and sell enough at a time to generate a nice commission.

E*Trade charges a low, fixed amount per trade. Their business model is to attract high-trade-volume customers. The customers are more likely to trade often when commissions are fixed and low, and E*Trade is pushing to make up in volume what the traditional brokers make by charging a percentage.

Adware: take your choice

First pioneered in the late 1990s by Qualcomm’s e-mail program Eudora Pro, some software lets the customer choose the business model! A customer can install and use the software for free, and ads will be shown as they use the program. Or, they can pay full price and install the program without the ads.

For users who elect ads, the business model is that Qualcomm provides software for free to build an audience, and then gets income from advertising. They must spend their time selling ads and distributing their software widely to create the audience.

For users who pay for the program, the business model is the same as for any shrink-wrapped software: Qualcomm gets paid up front for a product which the customer can use forever. Qualcomm then spends their time coming up with later versions which they hope will entice customers to upgrade, sending more money into Qualcomm’s coffers.

Retainer vs. Hourly Consulting

Some freelancers charge by the hour for services delivered. Others charge a flat fee retainer which entitles a client to a certain amount of the freelancer’s time. Once again, they deliver the same service, but the different business models will result in their negotiating businesses, administering their business, and controlling costs in a very different way.

Lessons from Wentworth by the Sea

The power of dreams, community, customer service, and customer retention

Click here to download this article in PDF format.

Come join me at a remarkable hotel. The Wentworth by the Sea was a grand New Hampshire fixture through much of the 20th century. Home to the peace talks that ended the Russo-Japanese War, everyone who was anyone stayed there. Movie stars, politicians, the rich and famous—all could be found summering at the Wentworth. Yet the hotel gradually faded and closed its doors in the early 1980s. By the time I first saw it in 1997, all that was left was a rotted, weathered facade. You could see right through it. It was a protected historical landmark, but no one had the time or money to repair it. We sat in our car and dreamed of how wonderful it would be, fully restored.

Last year, while surfing the Web, I found a story that the Wentworth had been purchased. It was being renovated and would be opened under Marriott’s management in May, 2003. I started calling for reservations a year in advance, and arrived on opening day, May 16, 2003, for the hotel’s first weekend in operation.

The weekend was remarkable. Restored, the hotel was beautiful. But even better than the building and the grounds were the people.

The Wentworth’s service was hands-down the best I’d ever had. We were very challenging guests. We forgot clothes in our car. The valet ran out and got them for us. We ran out of gas, and the concierge arranged a refill from a nearby boat marina. We wanted a special dinner on opening night, opposite a hundred person catered function, and the chef treated us to the best meal of our lives. I had stayed in Marriott hotels before and while the service was good, it wasn’t like this. The staff was going far out of their way to provide a superb experience.

What went right

I had to know why, so I spoke to Kris Francis, Marriott’s on-site training manager. In all the hotels she had ever opened, Kris related, the Wentworth was by far the most exceptional.

The Wentworth was more than a hotel to people. It symbolized an era. It was a national landmark, and for years had been a site where locals would drive past and wish for its restoration. People had invested great emotional pride, longing, and energy into the building over the years.

When Marriott announced the restoration, six years before, the hotel’s draw was so great that Marriott employees requested a transfer years in advance to help bring the building back to life. People from as close as nearby Portsmouth and as far away as Key West asked for a spot at the Wentworth. The staff ended up drawing from people for whom the Wentworth is more than just another hotel; it is part of their personal dreams. They are serving far more than just the guests—they are making their own dreams come true.

Of course, Kris assured us, the guests were just as important. People married there decades before came back to enjoy the hotel’s resurrection. Their stories and reverence for the hotel just reinforced the staff’s dedication to making the hotel experience exceptional.

A devoted staff gives great service. Devoted customers make the staff feel great. The staff gives better service, and the customers have a great time. The interaction becomes self-reinforcing. Once the initial delight shifts to business as usual, the Wentworth will have to continue to be run as an excellent business. But with this kind of energy behind the launch, I have few doubts that the Wentworth can be hugely successful again. Heck, I’m looking for an excuse to hold events there!

This week’s action challenge: unite people with a dream

What does your community long for, just beneath the surface? Find out what it would take to offer the community the dream, and engage both the people who will make it happen and the ones who will enjoy it once it’s done. It may be as huge as re-opening a grand hotel, or something as simple as setting up an old fashioned soda fountain for an evening at the local drugstore, or even just restoring a sign by the corner store. Because sometimes it’s just as important to build community as it is to build business.

Linking Leadership and Management with Powerful Strategic Planning

Linking Leadership and Management with Powerful Strategic Planning

from It Takes a Lot More than Attitude…to Lead a Stellar Organization by Stever Robbins

Click here to download this article in PDF format.

Leaders set direction, decide acceptable behavior (values), and get people moving towards a common dream. Managers design systems, set goals, track progress, and generally make sure things get done. You need both to create a high-performing organization: knowing where to go, and knowing how to get there.

A lot can go wrong. Weak leadership and the organization can stagger in circles, incoherent and directionless. Weak management and an organization wastes time and money, duplicates effort, and produces far too much (or too little) paperwork. But even strong management and strong leadership can dissolve into chaos without a tight connection translating the leadership direction into management systems. A good strategic plan creates that connection and gives your business traction.

Leadership sets the destination

One company’s vision statement lays out the company’s purpose, vision, and values:

“Our Business is the design and manufacture of impenetrable widgets for renewable energy source control plans. We aspire to become a leading worldwide player where customers love our products and service, and that these are provided at consistently good quality and a fair price.”

Sounds like a great vision. It gives direction to new product development, displays values of customer-orientation and quality, and even lets us know the company’s intended markets. And like most leadership documents, it’s timeless. The company could be living this vision right now, or it could be hopelessly mired, years away from making the vision real. Or the vision might be just nice-sounding words on a boardroom wall, with no link to the business whatsoever.

Ideally, the vision drives strategy. Most business goals serve a higher-level goal. The sales goal “land 10 new clients” is part of the higher goal, “increase market share by 5%.” Strategy sets the highest level management goal.Its guidance comes straight from the vision and mission of the company—which is where leadership resides.

Strategy is a map for achieving the vision, but creating a realistic timetable and action plan requires a map and a route. To choose a route, you need both a destination and a starting point. Leadership sets the destination, and strategic assessment lets you know where you’re starting.

Assessment tells where you are

The better you know your starting point, the better you’re able to create an effective route to your destination. An assessment encompasses what you believe is important in navigating to your vision. Sure, market share and profit goals are common metrics, but aligning an organization must include internal and external assessments:

  • what organizational capabilities exist?
  • what’s your competitive positioning?
  • are partnerships in place? the right ones?
  • do you attract and retain the right employees?
  • does your culture support those employees?
  • do your profitable customers stay with you?
  • does your financial strategy deliver funding when it’s needed?
  • are operational systems delivering product and service properly?

Organizational learning boosts impact

A destination and starting point are enough to chart a course, but they aren’t enough to form the most effective plans. As the highest-leverage activity in a company, strategic planning is where organizational learning has the greatest impact.

When Intuit launched the Quicken visa card, the software-only company learned a lot about what it takes to run an operational service business. The business’s infrastructure was revamped multiple times to make use of lessons learned about reliability, security, and customer service.

No one wants to repeat past mistakes and everyone likes to repeat successes. Most organizations learn a lot, but the learning gets lost. If your strategic planning group spends time sharing lessons of prior years, you’ll end up with goals and plans that bring learning forward.

Well-scoped goals drive success

Set yourself up for success in your goals. If people feel chronically overworked, “stretch” goals may be stretching people too far. Be realistic about what’s possible in a year. Get productivity from ruthless focus on goals that make the most difference, not from ruthless overwork on low-value initiatives.

Productivity goes down under too much stress or too little sleep. If 283 initiatives are essential to reaching goals, change the goals, because you can be sure they’re hopeless. People will be too stressed to do a good job, and consider 283 status meetings each week … it’s simply too horrible to think about.

Underpromise and overdeliver—even when promising yourself.

Plans transition you into management

When it’s finally time to make plans, the transition to management is in full swing. It’s time for management to take the ball and run with it. All the standard planning rules apply:

  • have lots of measurable milestones
  • schedule regular re-planning sessions
  • know your critical paths
  • communicate success criteria clearly
  • coordinate between different groups
  • monitor your plan and adjust as necessary

Leadership remains important

Once the strategic plan is in action, the leadership direction is well on its way to becoming reality. But leadership isn’t over by any stretch of imagination. The leadership job becomes keeping a powerful presence, reminding people of the company’s ultimate destination, values, and reason for existing.

People will get demotivated; the leader re-inspires them. Plans will drift or the world will change; the leader calls for re-examining whether the organization is still on course. The leaders provide the stability of direction and values that free everyone else to make it happen.

Even if the world is wildly different than expected, sound strategic planning will provide the map that aligns your organization behind the leaders’ vision. An aligned, energized organization is more likely to reach the vision, and it will be more fun and more motivating along the way. And at the end of the day, aren’t our lives and work are as much about the journey as the destination?

Putting it into action

  • Do the people in your company share a common idea of the business’s direction? If not, choose a direction and start going for it!
  • Look around at the initiatives and projects that are under way. Do all have a clear link to your company’s vision/mission? If not, fix it.
  • Do people seem overworked? Do the research to discover whether goals are poorly scoped, whether the plans to reach those goals are simply bad plans, and whether productivity is suffering from plain old overload. Incorporate that learning into your next planning session.
  • The next time you start planning, ask yourself whether you know your goals and your current situation, measured along all relevant external and internal dimensions.
  • Above all, think, then jump. Planning is important, and so is execution. Most of us prefer one or the other, and we get mired in endless plans or senseless execution. Really think about yourself and your organization and make sure you’re striking the right balance. A week of planning is more valuable than a year of action in the wrong direction.

Take Responsibility as a Leader Before It Takes You!

Click here to download this article in PDF format

We all love to take credit when things go right, and shift the blame when things go wrong. It’s especially tempting as a leader. The leader is perfectly positioned to blame just about anyone and anything when things go wrong. “The market is down.” “That clerk in accounting in incompetent.” “We didn’t count on competition.” “Regulation is unfair.” “The legal department reviewed it before I said it.” Such quotes avoid responsibility, and whether from fear or insecurity, they herald the beginning of the fall from leader to pretender…

This article is continued in “It Takes a Lot More than Attitude … to Lead a Stellar Organization!" Click here to purchase.

Balance Rights with Responsibilities

Creating Your Bill of Responsibility

From my April, 2001 newsletter

Do you have a personal Bill of Responsibility, as a business leader? It’s an intriguing concept. Allow me to explain…

In America, we businesspeople happily ask a lot from our employees. Everyone I know accepts the need for unpaid "crunch time" before a deadline, even though "crunch time" means a project management failure. And does "crunch time" become less common over time? Rarely. And we as business leaders are responsible for the failure to learn. But we expect employees to give from their personal lives to compensate for a company’s poor management.

But we rarely hold ourselves to as high a standard…

This article is continued in “It Takes a Lot More than Attitude … to Lead a Stellar Organization!" Click here to purchase.

Don't Make the Same Old Mistakes—Make New Ones

Failure doesn’t guarantee learning, just the chance to learn!

As the dot-com death spiral continues, a friend said, “it was painful, but I learned a lot.’ Eager to learn without suffering the pain myself, I ask, “What did you learn?” He lists five lessons, all pretty obvious—for just $100 million (none of it his) and four years. There’s gotta be a cheaper way. We say we learn from our mistakes, but few of us really extract quality learning from our experience. If you’re going to make mistakes, make them thoroughly, and learn well from them.

Schedule time for learning. Don’t assume it happens automatically; it usually doesn’t…

This article is continued in “It Takes a Lot More than Attitude … to Lead a Stellar Organization!" Click here to purchase.

Management Skill vs. Leadership Skill

A growing business needs both Leadership and Management to thrive

The best companies have managers with strong leadership skill and superb management skill. But when chaos strikes, you can’t always concentrate on both. (It might even be a luxury to concentrate on either for more than an hour at a time!) But what are you losing when you neglect one or the other? Both are essential for keeping a solid foundation during rapid change. But how?

Processes Must Adapt as Business Grows

Management helps the business grow.

This article is continued in “It Takes a Lot More than Attitude … to Lead a Stellar Organization!" Click here to purchase.

How Junior Programmers May be Setting Your Strategy

Companies spend megabucks on beautiful, well-designed web sites that end up losing customers, thanks to technical decisions made by the designers and programmers. Is some consulting firm’s junior programmer really the one you want making your strategic customer acquisition and retention decisions? With a little understanding of the interplay between technology and customer experience, you can start engaging your web developers in supporting your business with smart technical decisions.

The problem is that the world is diverse.

The web has developed dozens of technologies to help build bigger, more beautiful web sites. You will recognize some of the terms: "layers," "cookies," "javascript," "java," "style sheets," "flash," "shockwave."

Unfortunately, these technologies just don’t work on all versions of all browsers. I use Netscape for Windows and IE on the Mac. Two or three times a day, one of them reports a Javascript error and asks "Do you want to keep running scripts on this page?" C’mon, get real. How in the world does any user know whether to answer YES or NO to that, or what the implications are for my purchase?

Furthermore, some users disable cookies, Javascript or Java. I’ve heard companies pooh-pooh those users and say, "Well, I’ll just require you to enable cookies/Javascript to view my site." Uh, huh. When was the last time you were willing to reconfigure your browser on demand? Hard-core customers will do it. But those sites will lose customers who don’t know how, don’t want to be bothered, or aren’t allowed to change their system. Befuddled users don’t hang around to complete their purchase, they just leave. At best, the site loses one sale but the customer returns. At worst, the customer leaves forever.

So why do these technologies end up in web pages?

Flash sells. Look at any television commercial. When a designer is pitching a site laden with cool stuff, the management reviewers like it. It’s jazzy. It’s cool. It’s like a high-end ad. And that’s the wrong criteria to be using to design your web site.

Customers don’t care much about cool looking sites. They care about sites that get them the information or products they want. Yahoo is the most popular site on the web. It uses no fancy features, and it’s downright ugly. But it gets people what they came for. And that’s a much harder outcome for a graphic designer to pitch.

The programmers push the leading-edge technology, too. Take it from an ex-programmer: web site—even large database driven sites—require very, very basic programming, if any at all. The latest version of Quicken is about 10,000 times more sophisticated than 99% of the commerce sites in existence.

So most competent programmers find web sites kinda, well, mind-numbingly boring. But add in layers and flash, javascript and Java and Lingo, and suddenly the complexity is back to the point where it makes the job fun. Besides, all the advanced technology really *does* make certain things easier to program, and trying to use basic HTML to accomplish those same things just isn’t nearly as engaging.

Specific Problems

Here are some places in your site to dig to find out if you’re using these technologies:

1. Disable Javascript in your browser. This is the biggie. If your site isn’t usable with Javascript turned off, that could be a problem. Especially click on [SUBMIT] and [OK] buttons. Many sites have buttons that, for incomprehensible reasons, only work if Javascript is enabled.

2. Do you have Javascript running that makes sure the user types the right things into fields? If so, you just paid your programmers to do the same thing twice, because the data is almost certainly validated once it gets to your server, as well. You now have the maintenance expense of maintaining both the Javascript checks and the server-side checks. Yowza!

3. If you use Java, you’ll lose everyone who keeps Java disabled for security reasons.

4. Do you use layers or style sheets? Many sites do. They make some aspects of site creation much easier. They also tend to break in various browsers and look awful. Modern tools like Dreamweaver give a designer everything they need to create a consistent look and feel in basic HTML that works in all browsers. If your designers simply must use style sheets or layers, test the site in a wide range of browsers to make sure it looks decent across the board.

(And note that your designers will point out how convenient style sheets are, since you can revamp the whole look of the site by changing just the style sheet. But balance that against the increased testing and QA costs of making sure the style sheet solution works everywhere your customers are.)

The business question to be asking

The decision to include these technologies in a site is simple, when approached in business terms:

Is the expected increase in business from the Javascript/Flash/etc. more than the cost of losing even 1% of your visitors due to incompatibility or security concerns?

For most sites I’ve visited that use these technologies, the site would be equally useful without the technologies. So there’s no incremental gain from using them, while there is a risk of losing a customer. In a dramatic example of this, a site (let’s call them "GenericSTORE.COM") recently lost my $400 purchase when their Javascript consistently crashed in both Netscape and IE browsers. Their order desk was closed, and my special coupon expired the next day. I’ll now buy from a competitor, and if that competitor does a good job, they will probably have a new customer for years.

How much did that flashy bit of Javascript cost GenericSTORE.COM? Quite a lot.

There are certainly times when the extra technology helps. A highly-technical web-delivered product probably requires advanced technology by virtue of the kind of product it is. But most sites simply don’t.

As a businessperson, make sure your programmers understand the business case behind the technology. They’ll fight tooth and nail. They’ll say things like, "But Javascript is so basic, 99% of the browsers are compatible…" Yet if it’s that basic, why did GenericSTORE.COM’s scripts fail? And why do people continue to experience incompatibilities? And can we really expect customers to turn Javascript on, if their system manager requires that they keep it disabled? And more to the point: what is the lifetime value of the customers who have the 1% incompatible browsers, and is the extra Javascript functionality really worth losing that much money?

What’s the solution?

One solution is to test your site in as many browsers and environments as possible. Test in Netscape, all versions 4 and above. Test in AOL. Test in Internet Explorer (4,0, 5, 5,5, 6). Test in Opera. Test in Omniweb. Test test test. Test with Javascript turned on. Test with it off. Ditto for Java. Test.

Another solution is to have a site that uses very minimal technology. The HTML on my site works on every browser in use today. Only Netscape 1 and 2 would have trouble with the pages. The site uses Javascript to highlight menu items, but it still works fine with Javascript disabled. Yes, achieving this degree of accessibility has meant sacrificing some of the neato-cool features I could have added to the site. But look at it this way: no matter what browser you’re reading this on, you made it. It works. And you’re here.

So make your site simple and accessible. If you’re tempted to use technology that might lose even a single customer, ask yourself how much you’re losing with that customer, and whether it’s worth the extra bell and whistle. Amazon.com manages to do a hundred million dollars’ worth of business with a site that uses no Javascript and can almost survive with cookies disabled. When your site is rock-solid, your customers will love it, and at the end of the day, they’re the ones who keep you in business.

Don't let bad IT decisions hold your company hostage

Click here to download this article in PDF format.

Business leadership isn’t just about people. It’s also about process and systems. Your computers are part of your processes, and these days, they’re too critical to be treated as casually as you’d treat a screwdriver. Yet few business leaders know anything about them, and they happily delegate strategic, life-or-death technology decisions to IT folks who haven’t a clue about business.

A few weeks ago saw one of the largest email virus outbreaks ever. Fortunately, it didn’t do nearly the damage it could have done. But ladies and gentlemen, we are all at risk. You may be a non-techie, but if you’re reading this, your organization isn’t. You use computers and they are part of your critical infrastructure.

Bad decisions cost more than you think

If an avoidable virus or IT glitch stalls your company for a day, how much does that cost? Simple. It costs the entire cost of your company for a day. Not just the salaries of the IT folks who have to clean up the mess, but the salaries of everyone who can’t work because their computers are screwed, plus the utility bills, etc. Add on salaries for the time it takes people to get back to where they were before the virus attack. And if your IT infrastructure halted commerce, add on the value of all the lost orders. Now you have the cost of a bad IT decision.

IT costs are rarely allocated wisely

If you’re a senior executive and you make a bad call, you live with the results. In fact, if life throws you a curve ball, you live with the results. Your new distribution channel didn’t reach the market you wanted? Oops. That’s time and money down the drain, it shows up in your bottom line, and it gets factored into your evaluation.

But not true of most IT departments. They get to make lousy decisions at bargain basement rates. You see, few companies charge back the cost of IT failures to the IT department. Let’s think about a virus outbreak. IT folks must run virus removal software over your network and clean up the servers that got screwed. Fine, that gets charged back to IT. But the salaries of the non-IT employees during their downtime, and the cost of the rework they have to do all gets allocated back to their departments. So what incentive does IT have to really take the time to understand the security issues? Very little. Most likely, they’re evaluated and paid for the projects they have to build, but aren’t charged for the business impact of what they don’t build that they should. As a result, the emphasis is on rolling out new stuff, not protecting the business.

To be fair, this isn’t IT’s fault. Most IT organizations are chartered as development organizations, with no emphasis on security or preventing problems. Few engineers have the training or big picture to make good security decisions. But guess what–it’s our fault, too. We who build the organization must make sure IT has enough staff with the security skills and judgment to build a solid IT infrastructure. If computer security isn’t on your hiring radar screen, put it there, or be prepared to pay the costs.

(Speaking of which… A misconfigured web server can expose all kinds of great company documents to the web. See: http://www.securityfocus.com/columnists/224 for a column describing exactly how to get really juicy internal information almost instantly using only Google.)

IT decisions ignore the cost of failure

"If I buy this lottery ticket, I’ll win a million dollars!!!" — Anonymous

We make lots of our decisions because we think they’ll get us what we want. We set our goals that way: "Go build a system that can style my hair, read my email, and coordinate meetings over the internet while singing Broadway showtunes." But every decision is a double-edged sword (even the decision not to decide). We rarely consider the downside of a decision beforehand, unless it’s blindingly obvious and catastrophically unpleasant.

When your IT team is choosing solutions, chances are, they’re asking, "Which solution meets our needs?" Also have them ask, "What is the cost of this solution failing?" Microsoft products have a huge advantage: they’re standard, they allow interoperability, they’re pretty, and, as they used to say about IBM , "nobody ever got fired for buying Microsoft" (though they should have). The downside, however, is products like Outlook are buggy and contain huge security holes. Several of the most destructive viruses have exploited holes in Outlook and Internet Explorer1.

Upgrading can kill your company

Microsoft has certainly endorsed a dangerous trend: software that requires activation to install and run it. More and more, it’s not enough that you purchase software and install it with a serial number they give you; you must also be connected to the internet or call their telephone activation center to activate the software when you run it.

The reason for this is simple: the software publishers basically don’t trust their users, and want to monitor every installation of the software closely. It makes sense from their point of view, as long as you assume your users are out to screw you. But from our point of view, this trend is dangerous.

The first of these activation schemes was Adobe Corporation’s "Type on Call." They would sell you a CD full of fonts, and you would call Adobe to "unlock" fonts you had purchased.

Over the years, I purchased over $2,000 worth of fonts from Adobe. That really isn’t as many as it seems, as some of the nicer faces cost upwards of $500 to purchase all the different weights and styles. My corporate identity was built using the Adobe fonts.

Then a couple of years ago, I bought a new computer. I went to install my Type-on-Call fonts and discovered that the activation servers had been shut down. Adobe had decided to discontinue the service, and suddenly I was no longer able to access fonts I’d paid dearly for. No one at Adobe was able to help, until bombarding the upper management with letters led one marketing manager sent me a CD-ROM of the fonts in question.

Herein lies the danger: in the interests of their fraud protection, you are integrating the business fortunes and decisions of the software vendor into your infrastructure. If they go out of business, get acquired, or just decide to stop supporting their service, the next time you need to install their software, you can’t do it. If that software is critical to your business, you’re just plain out of luck2.

And even if they’re still in business, it’s still a business burden for you. You won’t always have a net connection when setting up a new machine. Sometimes–for security reasons or otherwise–you might want to install your software with your new machine disconnected from the network. Whatever the case, you’ll now have to jump through activation hoops2. Windows already takes way too long to reinstall, thanks to its convoluted architecture. If you have to make activation phone calls and convince the $3.95 /hour clerk on the other end that you own the software you’ve already bought and paid for, you’re spending more of your time and money just to satisfy their paranoia.

Of course, no company would ever use this as a technique for forcing you to upgrade. Microsoft, for example, would never abuse their activation system by dropping activation of old products, forcing you to upgrade to a new version. But if a Microsoft doobie reads this article, watch out, they just may change their mind.

Avoid Outlook like the plague

Most of the windows vulnerabilities and worms have spread through Outlook and its address book. I don’t know why Outlook is so remarkably poorly written, but it really doesn’t matter. Every security-conscious technologists I know uses Eudora or a text-only mail reader of some sort. Most won’t even allow Outlook to be installed on their machine. I’m sure Microsoft is working to resolve all problems in Outlook, but if the development team couldn’t avoid the problems in the first place, I don’t have much faith in their ability to catch all the potential problems in retrospect.

Back up regularly, off-site

It’s amazing how many companies have no regular backup regime in place. Back up regularly to write-once media (e.g. CD-R), so even if a virus invades, it can’t destroy your backups. Make sure to keep an off-site copy of your backups, just in case. I’ve seen companies lose man-months of work because they didn’t do regular backups. IT isn’t pretty.

I used to back up to CD-R until my drive self-destructed a couple of months ago. Now, I back up every night over the Internet, using an encrypted connection to a secure data center that can be accessed from anywhere in the world. It’s a great service that costs about the same as doing my own physical backups. I liked it so much I became a distributor. Check out:

http://www.ezbackup.com/leadership
if you’d like to download a 30-day free trial.

Teach people: don’t open attachments

Yes, the software designers could have made viruses harder to spread, but this week’s attack was an email attachment that requires people click on it to open it. When someone succeeds in getting people to violate their own security, it’s called "social engineering." The latest virus was a masterpiece of social engineering.

It was also a testimony to how little we’ve educated people about computers over the last five years. The rule is simple: never open an attachment you didn’t expect beforehand, even if it’s from someone you know. Period. Never. If the message appears to be an error message, don’t click. Is it a "cool screen saver?" Resist the impulse. How about "The latest version of that document you requested."? Punt. On the other hand, if you asked for a Monday status report from Sue Jenkins, and the attachment is "Sue Jenkins’s Monday status report.doc", you’re probably safe.

Don’t let IT set strategy by default

There have been a number of business failures due to strategic inflexibility caused by inflexible software and/or hardware systems. For further reading, see my essay "Are Your Junior Programmers Determining Corporate Strategy."

Learn how to use IT well

Like it or not, we’re living in a world pervaded by information technology. I’ve outlined a few major gotchas, from business to technical, that you should have some awareness of if you’re leading an organization. But the time is past when we could afford to ignore technology. It’s changing industries, it’s changing businesses, and it’s making us powerful and vulnerable in ways we must master if we’re to succeed in our organizations.


A postscript for the techie reader

Yes, I know perfect security is impossible purely through software. In fact, good security usually has to be built into a system’s design from day one. But most of the viruses we’ve seen over the last four year could have been prevented through better design. Microsoft could have created a sandbox mechanism and launched attachments in a sandbox. They could have created a security model that required downloaded code to request privileges before being able to do anything malicious. They could stop embedding full programming languages in all their products, with security turned off by default. And they could certainly use a separate stack and data space so stack overflows aren’t an invitation to run arbitrary code. They could even code in a post-1980 language that detects attempts to overflow the stack and doesn’t let it happen! They could even have created a firewall that blocks unexpected outgoing connections.

By the way, these aren’t fanciful ideas. All of them have existed in past systems or exist today. Tiny Personal Firewall gives you the sandbox. Zonealarm, the firewall. Java gives you buffer overflow protection. And disabling active scripting, ActiveX, and deinstalling VBScript at least helps with the programming language problem.

1. Microsoft likes to claim, "because we’re ubiquitous, hackers target us especially." That’s true. But I’m an ex-techie. I’ve looked at a lot of the failures. They’re due to bad programming practices and poor design. I would like to think that if they know they’re target #1, that would make them extra vigilant about such practices. back

2. Volume purchasers can often get non-activation-required versions, but smaller businesses are out of luck. back

Creating Your Identity as a Leader

Becoming a Leader is a matter of identity, not position.

Eric was about to scream. His latest plan somehow wasn’t moving forward. Once again, his employees left the planning meeting and went right back to what they were doing, as if his presentation hadn’t even happened. Eric didn’t realize that being “the boss” didn’t make him a leader. You can be a good CEO by mastering the job requirements. Leading people is not so clear cut. Leadership isn’t a job; it’s relationship. Without followers, you can’t lead. Cultivate the relationship beginning with yourself; create an identity of leadership.

Leave Your Follower Mentality Behind

The first step is deceptively simple: choose. You probably said “Yes” to your job as a conscious decision. Now decide you will begin leading…

This article is continued in “It Takes a Lot More than Attitude … to Lead a Stellar Organization!” Click here to purchase.