In today’s ever-expanding world of big data, organizations are not only taking on considerably more responsibility for protecting information assets, but are also facing the likelihood of a continued rise in potential data incidents.

According to Dov Yoran, CEO at New York City-based cyber security company ThreatGRID, security threats have evolved so extensively in recent years that it is inevitable that incidents will occur even at mid-sized businesses. “It’s imperative to have a solid incident response process, which should include data forensics capabilities and recovery methods after the breach,” Yoran says. “Additionally, it is always paramount to have a disaster recovery plan, which normally includes recovery processes, procedures and solutions.”

All tools are not created equal

Fortunately, an array of forensic and recovery tools exists, including data integrity tools provided with the operating system, automated data recovery tools, and specialized forensic data recovery tools. The most advanced tools allow experts to recover significantly corrupted data or structural damage, partially deleted files, and forensically reassemble short fragments of files into their original form. The tools even allow an expert to document the chain of events that led to the data destruction. This all depends on the expert using the tool having an intimate knowledge of how media data structures operate, and good working knowledge of the tool itself.

However, as Yoran explains, not all data recovery tools are created equal. “Some tools are strictly for data recovery, while others have other incident response practical features such as case management,” he says. “The requirements for recovering your data set should be carefully considered. It is often essential to budget for not just data recovery tools but data extraction and analysis tools. These tools can aid the investigator in determining the root cause of breaches. Technologies such as sandboxing [a security tool for separating running programs] and other malware analysis tools, which can reveal compromises, should be considered as crucial as the physical disk recovery.”

Some tools also fail to function in a forensically sound manner, which is necessary for producing defensible electronically stored information (ESI) in legal matters or regulatory investigations, explains Jeff Fehrman, vice president of forensics and consulting for global IT service provider, Integreon. “Defensible collection demonstrates that the appropriate procedures and chain of custody are maintained throughout the process, in order for the ESI to be admissible in court,” he says. “Even the best forensic tools in the hands of untrained users can still present some serious issues for the defensibility.”

Fehrman recommends looking for tools with a track record of successful use in legal and compliance matters and that have respected certification training for users. “There are also expert consultants in the field that have entire toolkits of software available for their use, and the experience to know which ones are best suited for specific types of storage media or environments,” he says. “Some services also allow IT personnel to essentially perform the work under an expert’s remote guidance as a cost-effective approach to ensuring defensibility without the risk of data spoliation.”

Legal must-dos

There are also legal concerns of key consideration as organizations embark on a data forensics project, explains Peter Laberee of Laberee Law Pc. “When confidential information is kept on the cloud, it is crucial to know, where are the servers? This matters because the laws of the locality where the servers are located may control your right to access the data, even to recover lost information,” he says. Laberee notes that people ask where their data is partly because of the inherent diffuseness of the cloud, plus the fact that legal and marketplace remedies vary from country to country. “Despite the global feel of the cloud, some countries’ laws will be involved when it’s time to sue to get back data or to demonstrate compliance with privacy rules.”

The obligation to provide secure data goes beyond just good business. “enterprises have express legal duties relating to data security financial information and protected health information under HIPaa [the Health Insurance Portability and accountability act of 1996], for example. and, we hear much about Sarbanes-Oxley [the Sarbanes-Oxley Act of 2002, or SoX] in the corporate finance world,” Laberee says. “Under  Section 404 [of SoX], reporting companies are required to assess their internal process and controls, and data security and recovery are part of this. Privacy laws are also implicated in data security concerns including Gramm-Leach-Bliley [The Financial Services Modernization Act of 1999, or GlB], the Fair and Accurate Credit Transactions Act [facta], and EU [European Union] rules.”

If the primary goal is to use the results in court, Yoran stresses the significance of forensically sound data recovery software, including sandboxing solutions. “Understanding the fundamentals of the attack and how it affected one’s system is at the core of every investigation,” he says. “Having the  right tools on hand to do a deep analysis can not only aid in this effort, but it’s also a requirement when considering the myriad of potential attacks and large volumes of data each organization owns. clearly these tools are most effective when used by a skilled resource on the project, so in the end a successful investigation is really the marriage between people and technology.”

Seeking professional help

In some instances, it makes more sense for organizations to turn to specialized partners capable of providing an array of professional services including litigation consulting, compliance and risk management, e-discovery, forensic data collection as well as forensic examination and recovery exist to assist with ESI.

One reason to do so is that for digital evidence to be valid—and defensible in court—it must be preserved in either its original form or a forensically defensible representation thereof, explains Gerard Boisclair, senior manager at Providence, RI (u.S.)-based forensic risk alliance. “In accordance with the National Institute of Justice, examination is best conducted on a copy of the original evidence,” he says. “Proper forensic collection involves highly trained and certified professionals using specialized tools such as hardware and software write blockers and forensic imaging tools. They also provide documentation to prove data integrity and security via chain of custody, media acquisition and access control, and a series of detailed collection logs.”

According to Fehrman, data forensic and recovery services often vary based on the type of media or environment involved, including hard drives, backup tapes, uSB pen drives, network file shares, e-mail servers, mobile phones, Web sites, social media networks, and cloud-based environments.“Related services include recovery of password protected, encrypted, corrupted, or deleted information,” he says. “Expert analysis or witness services are also available to ensure the defensibility of the methods used, should they ever be challenged during legal proceedings. This is why training and certification through reputable providers is so important, and when there is doubt, there is always the option to utilize forensic experts that can provide strategic advice and provide recommended best practices and methods.”

Regardless of the preferred route, it’s crucial to select a reputable company that practices and promotes industry standards, explains Boisclair. “Whether recovering data at a logical or physical level, it is likely that the data may be private, sensitive or confidential and may even be subject to jurisdictional requirements governing data protection,” he says. “Using a reputable tool or provider may prevent the media from further, irreparable damage, and may also prevent the data from being exposed to identity theft, unauthorized download or use of confidential files as well as improper storage or disposal of media.”

Is the Data Gone?

Is the data really gone? In most instances, the answer is a resounding no. When a user drags and drops a file or directory into the recycle bin, or right-clicks and selects “Move to Trash” or “Delete,” that data is usually recoverable, explains Forensic Risk Alliance’s Boisclair. “Even if the user empties the trash, it may still be possible to access and view that deleted data.

However, data can be securely deleted without having to physically destroy the device or media so as to render it unusable,” he says. “There are a number of software-based solutions that feature the ability to sanitize or wipe media by erasing the data based on recognized government and industry standards.”

Many data-wiping software applications developed in the U.S. adhere to the standard outlined in Department of Defense (DoD) 5220.22-M. At a high level, secure erasure involves overwriting the location on the disk where the data resided a number of times by filling the media with zeros, random bytes, or a known overwrite pattern. It is then possible to verify that the data has been permanently erased by viewing the data location on the media in an application that enables the user to access and view the ones and zeros on the physical disk—ensuring that the overwrite pattern exists and the original data does not. A primary factor in meeting industry standards is the number of times the data is overwritten.

It’s important to note when using data wiping tools, care must also be taken that any such actions are performed in accordance with a company’s documented data retention/destruction policies and schedule, explains Integreon’s Fehrman. “Failure to do so could pose issues during litigation, even if performed prior to a lawsuit being filed. Enforcing data destruction policies is particularly important if a legal hold has been put in place at the start of an investigation or lawsuit,” he says. “The deliberate destruction of potential evidence can lead to serious legal sanctions.”

In the airline business, a single delayed flight can set off a chain of events that require real-time updates to displays at airport terminals. Any glitch in the system can lead to scores of irate customers. The airline SATA, headquartered in Azores, Portugal, received notice in January 2010 that its airport operational management system was nearing its end date. The vendor offered an alternative—one that was a significant jump in price, required a large up-front investment and had higher operating costs.

The airline’s leadership team quickly dismissed the option. Instead, in March 2010, the organization chose to launch a project to develop a replacement application in-house, primarily to reduce costs and improve operational efficiency. The system receives information from the airline, such as schedules, cancelations, delays or special requirements for extra flights. Also, it allows airport operators to access individual aircraft behaviors to determine if a plane has recovered from a delay. A well-designed operational management system provides an airline with optimal efficiency from its airport-based human resources, in addition to reducing costs incurred from hardware (such as servers), software (including licenses), and the labor to develop, implement, maintain and expand the application.

Such advances are a matter of survival for the airline, according to SATA CEO António Menezes. “Being a small organization facing the same complex challenges that our much larger competitors face, we have to be creative, innovative and agile,” he says.

We Will Not Be Experiencing Delays

SATA knew it needed, at the very least, a minimally operational replacement system before the old one expired in December 2010. Complicating matters was an executive policy against switching tasks between projects, which meant the organization’s small team of developers would not be able to start development until June 2010.

To pick up some of that lost time, the project team embraced agile methodologies and used a software platform to serve as the development framework. At the time, the organization had only about three months of experience working with agile.

“Even having this limited experience, the success of our first agile deployment instilled confidence that both the methodology and the technology would effectively support the project delivery,” says Paulo Ornelas, SATA’s CIO. “The most important factor was the confidence that I had in my team of developers. People are key.” Team members and stakeholders came up with an initial set of requirements (known as a backlog) that was systematically reviewed every 15 days. This, in turn, gave rise to a new backlog.

Mr. Ornelas, as the project owner, along with Fernando Almeida, PMP, ScrumMaster and senior project manager, sat down with the developers and stakeholders to establish requirements. Part of the process was to explain the team’s project management techniques to secure buy-in. Following a description of the Scrum process, Mr. Ornelas distributed blank pieces of paper for everyone to write stories in Scrum format. The project team then grouped stories under the same theme and prioritized them.

“The process included a lot of encouragement to have the stakeholders write, in their own hand, what they actually wanted,” Mr. Ornelas says. “When we reached a level of development that our stakeholders understood well enough to deliver a first release, we took the application into production.” Using Scrum techniques meant a new approach to the role of project manager. “Keeping in line with Scrum methodology, a ScrumMaster with a 50 percent commitment and a product owner with a 15 percent commitment provided oversight and management to the project,” he explains. “Under Scrum, the team follows a self-organizing procedure, and the role of the traditional project manager is shared between the ScrumMaster, the product owner and team members.”

The project was conducted exclusively with internal resources, including a team of 2.5 developers and one functional business member who was tasked with testing script, providing developers with feedback and sharing business knowledge with the rest of the team. The process sped along quicker than planned.

The scope of the project was defined with the concept of minimum marketable features, and it took eight 15-day sprints (about four months) to deliver a first release.“We actually issued the final release a month early, with an even higher than promised level of functionality.” One of the added features was a survival mode to counteract the risk involved with the operational system being a communications-dependent, browser-based application.

When there is no data connectivity between an airport and a data center where servers are operating, it’s referred to as a link-down situation. Most are related to severe weather and/or equipment malfunction, and in a location as remote as the Azores islands, they can last between one to three days. In a link-down situation, the airport staff can now use the local application to manually manage passenger-facing display information (arrivals, departures, delays, cancelations, etc.). When the system goes back online, that data is automatically synchronized with the main server.

“Survival mode is actually a stripped down version of the system operating locally on any PC,” Mr. Ornelas explains.

Minimal Turbulence

“The primary challenge on this project was the quantity of business knowledge that had to be captured and deployed as an application in a short timeframe,” Mr. Almeida says. “Although we had knowledge of the airline processes, this project was the first time the IT department actually interacted with the airport business. Having a functional business member as a part of the project team was instrumental in moving forward and gaining stakeholder acceptance.”

Two-week sprints forced the team and SATA’s airport operations unit to have very short cycles to collect, program and validate data. Team members obtained the knowledge with a minimum amount of interactions, and the company got a feel for the new system after only four interactions, Mr. Almeida says. “We believe that the agile approach, with its short cycles and promotion of face-to-face validation, was the critical success factor in this project,” he says.

Clear Skies

The latest iteration of the software was deployed last June. From a passenger perspective, there are no discernible changes.

“However, SATA’s airport personnel benefit from a reduction of manual actions, including a set of built-in, time-initiated actions,” Mr. Ornelas explains. “For instance, if we know that a flight departs at 14:30, users can automatically open the predefined check-in counters at 12:30. Or they can automatically set information on the display of the baggage belt as they receive the actual time of arrival.” In addition, the system follows the best practices of usability, which he considers a major improvement and enabler of quick adoption. “The new solution will integrate with Portuguese civil aviation authorities, aligning SATA with national policies of interoperability between organizations,” Mr. Ornelas says.

From a project portfolio standpoint, SATA now has confidence that its in-house development team can deliver a functional application to a satisfied customer. “Financially, we were able to realize significant savings in both capital expenditure and operating expense,” Mr. Ornelas says.

The final solution came in at only 15 percent of the total cost proposed by the vendor—with the added bonus of being more tailored to the organization.“Today, the application integrates operational data at a high level with major-volume airlines—about 95 percent—and is also able to enter a survival mode during downtime. This is crucial since our applications are server-client based, and link-down situations are not uncommon.”

With agile, the management of projects is a continual learning experience. “We conduct a review at the end of each sprint to discuss what went well and/or wrong so that we can reinforce or correct future actions and behaviors,” Mr. Ornelas says.

Successful execution of the new system came with positive side effect, Mr. Menezes says. “This project has brought pecuniary benefits and, most importantly, a positive momentum with all internal stakeholders sharing the same feeling of ‘Yes, we can,’” he says. “This momentum has proved highly contagious.”

SIDEBAR: Time to Shift Gears

Since starting the initiative to develop a new operational management system, all of SATA’s development projects now use agile techniques. The company promotes the tenets and practices of the methodology to all stakeholders, business users and team members.

“After being able to deliver a couple of successful projects and having our marketing and sales director see the approach firsthand, it became easier to provide visibility to other managers inside our organization and even to the board of directors,” says Paulo Ornelas, SATA, Azores, Portugal. “We also invest a good amount of time in promoting Scrum via brief workshops to our board, major stakeholders and business users involved in the projects or to anyone who has a project for us.”

SATA launched its project management office in November 2009 and still manages some initiatives by the traditional approach. But for many projects at the organization, agile has proven helpful. “For us, the traditional approach to project management has struggled when managing change as a constant and ensuring commitment from stakeholders,”

Mr. Ornelas says. “Scrum has allowed us to gain commitment from both stakeholders and business users to cope with change as a normal and desirable behavior, as well as improve internal communication and reduce project risk while providing a better time to market.” Because SATA is a relatively small and informal organization, the direct support of the company’s CEO contributed to the overall buy-in of the new way of managing projects, Mr. Ornelas attests.

In fact, CEO António Menezes was a featured speaker at the agile platform’s user conference. “And really, how often do we see a non-IT CEO being invited to be a keynote speaker at an IT event?” Mr. Ornelas asks.

Article appears within PM NETWORK October 2011 WWW.PMI.ORG

Photo credit: Tim Beach http://j.mp/nEeTAk

Since founding Boston Green Building in 2007, Brian Butler has made a name for himself building and retrofitting single- and multi-family homes within Boston’s historic metropolis. In a city dating back to America’s earliest days, there is no shortage of sagging, centuries-old homes crying out for help.

“We are a service-based company, and we focus on providing our clients with projects that are on-time, within budget and with quality as the overarching factor,” he says. “Understandably, having a back office with open billing, an in-house millwork shop, project managers in the field, and excellent subcontractors who understand the green approach are paramount in meeting these pillars.”

Boston Green Building currently has four deep energy retrofit projects under contract.  According to Butler, each retrofit is part of the National Grid Deep Energy Retrofit Pilot Program, which funds energy-based retrofits up to $42,000 for single-family homes and as much as $100,000 for multifamily units. Run in partnership with Building Science Corp., the projects receive the latest guidance on technical approaches for optimal efficiency, health and safety, helping increase building durability and reduce future maintenance costs.

“It’s an excellent program designed to encourage more area homeowners to embrace the energy saving concepts associated with green building standards. Usually any property eligible for the program is in a poor energy performance condition often with Home Energy Rating System (HERS) ratings exceeding 100,” says Butler, who was recently named Best Green Contractor by Boston Home Magazine. “This arbitrary scale allows us to evaluate where a house is at and where it can go. With a HERS of zero, it uses no more than it produces.”

The house Butler is currently working on tested at 130 HERS. “With a goal of hitting a zero on the HERS scale, we are super insulating and changing out all the mechanical systems for state of the art equipment,” he says. “And in this particular retrofit, we will also add renewable energy components (such as photovoltaic and solar-thermal thermal panels on the back of the house). Since this is also my personal residence, it has served as a bit of a laboratory for us to bring new equipment and experiment with end results, while remaining under the watchful eye of Building Science Corp.”

One of Butler’s most recent projects is a 3500 square foot, 7-bedroom multifamily unit located in close proximity to Tufts University – meaning the potential for tenants remains high.  In completing this retrofit, Butler is intently focused on using proven air sealing techniques with the blower door test serving as a primary measuring tool.  “Ultimately, we are aiming at 95 percent reduction in leakage,” he says. “It has been a blast to watch it come down.  If we hit this target it will be a huge accomplishment for a retrofit.”

Boston Green Building’s deep energy retrofit projects are prime examples of how homeowners can achieve noticeable returns on investment, explains Butler. “While the various green technologies garnering all the attention are wonderful additions, what people really need to focus on is insulation, which usually has a three to five year payback. With results like that it is not hard to show the payback,” he says. “Our goal is to pursue the European approach to building a Passive House, with up to 90 percent reduction in consumption when compared to a code built house. As a result, we do our best to educate the client around what we can implement without breaking the budget.  Windows are not always as easy to sell, but are equally important as we work to build tighter houses. The one noticeable benefit with new high efficiency window is that homeowners often have an increased comfort level.”

Looking forward, Butler is bidding, in conjunction with the architects at Zero Energy Design – on the potential development of three parcels within Boston as part of the mayor’s E-Plus program, which is structured to induce developers to build energy positive housing. In addition, Butler hopes to develop a 5 unit net-zero neighborhood in Cambridge, MA as the economy rebounds. As with Boston Green Building’s past projects, insulation will play a huge part when complemented with other sustainable elements.

Blu Homes brings sustainability to the prefab market through its proven, efficient manufacturing platform.

Who: Blu Homes is a specialized eco-friendly builder focused on designing, producing and delivering beautiful prefabricated green homes suitable for a wide range of buyers. Maura McCarthy serves as vice president of sales and marketing and Bill Haney is the company president.  Prior to co-founding Blu, McCarthy was in the venture funding business with ties to both sustainability and modular housing. Haney enters the equation with a seasoned background in environmental technologies.

Blu Home currently has 80 employees, with plans to double its staff in 2011. Blu sold 35 homes in 2010, is on target to sell 80 in 2011, and has a very scalable process to allow it to continue growing.  “The US home building market represents huge opportunities. We are positioned in a way to produce a product that meets a client need,” she says. “The challenge moving forward is not finding clients, it will be filling our talent needs. Within Blu there is understandably a great deal of excitement about how fast we are growing and the great number of geographies we have been able to touch so quickly.”

What: Blu Home’s claim to fame is its truly unique line of prefabricated green homes, which capitalize on the use of a proven, efficient and environmentally-friendly manufacturing platform. “We did a lot of research as to why prefab has traditionally failed, and often it was the result of a narrow vision and the lack of a scalable platform,” says McCarthy.  “With our homes all Americans can have access to a beautifully designed, personalized, cool custom home that is reasonably priced.”

The average unit sale at Blu Homes is $230,000. There is a balance between a number of $150,000-200,000 units as well as a grouping between $300,000-550,000. Square footage ranges from 400-2300 square feet. Green components include ultra light, yet highly durable recycled steel framing system; rigid foam insulation, heat recovery ventilators and element controlled construction processes for exceptional air quality; radiant floor heating standard throughout all designs to save on energy consumption; high ceilings combined with walls of windows for natural lighting; high efficiency appliances; and cabinets with the highest Greenguard^® certification

When: Although incorporated in 2007, Blu Homes took root when its co-founders funded a two-year study at Rhode Island School of Design in 2005-2006. The goal was to look at different ways of building beautiful light filled smaller homes with energy economics. “The feeling was that Americans were overleveraging themselves,” McCarthy says. “We wanted to find a new path to healthy building including indoor air quality. The outcome of the study was to build off-site structures.”

Where: With offices in Boston and San Francisco, Blu Homes has delivered homes to thirteen states, the Virgin Islands, and recently received its first Canadian order. The company has a well-established network of highly trained representatives, and realistic goals to continually expand the operation into new waters.

Why: “We noticed a big opportunity to do something that was more streamlined, thoughtfully designed, more in line with values of indoor-outdoor living,” says McCarthy. “We wanted smaller spaces with higher ceilings, large windows – but not energy sucking houses. There is an interesting dynamic now, where people are going back to basics in parts of their lives yet using high technology to give themselves more time and freedom.”

How: When purchasing a Blu Home, clients are never left to fend for themselves, explains McCarthy. “We take pride in the fact that the client experience is consistent and pleasurable with one company representative staying in contact with the client from beginning to end,” she says. “With Blu Homes, you are never alone. We walk you through each step – purchasing land, selecting the best model, financing, etc.”

The process usually takes six months and includes a 3D representation of the house on the client’s land prior to the client making a final commitment. After all personalization is complete, Blu Homes commits to a final fixed price, and then goes on to handle permitting, fabrication, and delivery using its in-house staff. “We also help coordinate with the local site contractor for foundation, utility connections, driveway and landscape,” says McCarthy.

This article appears in Green Building and Design, October 2011

There is no question that solid experience can foster long-term career success. However, when someone is just getting his or her feet wet, lack of experience can serve as a roadblock to achieving goals.

It was this conundrum that recently prompted (ISC)2 to roll out an industry-focused mentoring program, with plans to expand the pilot throughout the organization in the future. “The idea is to match people who have specific areas of interest with people who have expertise in those areas,” says (ISC)2 Director of Professional Programs Tony Baratta, CISSP-ISSAP, ISSMP, SSCP. “The positive exchange of real-life experience is the key to success. The people seeking this type of assistance are looking to strengthen their positions and go beyond mere book knowledge. The expectation is that someone with experience can offer insight on a regular basis.”

Program Structure

The pilot program has 10 pairs of mentors (primarily CISSPs) and mentees (mostly (ISC)2 associates). The first consideration has been to appropriately match knowledge seekers with experienced and credentialed information security professionals. For instance, if an associate or a newly minted CISSP wants to better understand the intricacies of deploying a new security platform in the financial services industry, Baratta’s team will work to find a mentor within that industry who has that or similar experience.

The next step is to find an amicable platform (e-mail, telephone, videoconferencing, in person, etc.) that encourages regular and productive dialogue. (Time zone is a consideration when matching mentor and mentee as well.) “It is important that there is a true comfort level that encourages ongoing interaction, which will obviously differ with each pairing,” Baratta says. “Also, we realize that this is not just security experience but the full gamut of business experience—dealing with people and situations. Ideally, I would like to see the more experienced CISSPs and other credential holders openly willing to offer their expertise so that others can grow along with them. And this is going to take a solid platform to facilitate communication.”

The interaction between mentor and mentee will remain confidential to encourage open dialogue.

According to Baratta, less experienced CISSPs have often asked where they can go for help, and this arrangement should provide that opportunity. “We know that public forums are one method, but this takes knowledge sharing to a new level,” he says. “One-on-one interaction helps put specific experiences and knowledge sets together in a way we otherwise cannot expect.”

In most instances, Baratta anticipates the mentor-mentee relationship will develop over time, and its formal structure will stay in place as long as the participants’ interests remain in alignment. If for some reason the relationship does not work out, (ISC)2 would work to make a change so that everyone has a positive experience. Still, says Baratta, “I see this as being rare, since people interested in participating in this type of program are not looking for an adversarial arrangement.”

As an initial incentive to participate in the program, (ISC)2 is providing mentors with one CPEper hour they spend engaged with the mentee.

Tempered Expectations

Exactly how much the participants receive from their involvement depends on their willingness to give to the relationship. “Mentoring should be on-point with established growth objectives, requires extra work, and in many instances includes frequent and potentially uncomfortable critiques and challenging questions,” says Francie Dalton, a Columbia, Md.-based behavioral science consultant and executive coach. “Mentors also need to realize the necessary dedication of time. However, most mentors realize the entire experience is fun and more rewarding than anticipated. Obviously, as the relationship develops and the comfort level increases, mentors should anticipate a protégé’s scrutiny of and questioning of their decisions and methods.”

Mutual understanding of expectations is a crucial aspect to achieving a positive outcome, Dalton adds. “Amentee should be prepared to contribute time—probably more than they may initially think—and also demonstrate robust, eager participation, so that the mentor can see their dedication,” she says. While the dynamics differ with each relationship, she recommends that mentees welcome interim assignments from their mentors and take the initiative when it comes to learning objectives.

“At least initially, the goal for the mentor should be to facilitate the discussions while candidly and constructively critiquing the mentee’s work,” she says. “However, the best mentors should also be prepared to grant some degree of transparency into their decision-making processes. Doing so provides the mentee with irreplaceable insight into actual operations.”

Looking Forward

Apilot run enables (ISC)2 to review the program before opening it up to the general population. “This will give us the opportunity to look at the pros and cons and sort out what we need to do to move the program to the next level. When we roll out the full program, we want to be as comprehensive as possible,” Baratta says. “To help us learn, we are asking the participants to rate each other and provide us with as detailed feedback as possible. We want to know that we are doing a good job and making solid matches. This is really an academic concept to garner insight. After all, how does someone know that they are doing a bad job of helping if there is no feedback?”

After (ISC)2 opens the mentoring program to the membership at large, the hope is that positive experiences will draw more people from within the security industry into the group. “We know that, done right, our mentoring program will be a powerful program with exceptional value,” he says. “Participating in a mentoring program is an early introduction into the field for those who are not yet there. It is a vehicle to offer assistance to those who don’t have the corporate experience, even though they may have one or two years of working experience.”

Long term, Baratta hopes that mentees will eventually become mentors. “Quite often when someone receives help, they want to give back,” he says. “And these individuals are usually more than willing to help the institution that has helped them. Obviously, I do not see this ever being a requirement, but the continued participation of people who value their experiences would be a solid way to grow the program.”

Baratta would also like to see the program expand and offer opportunities for mentees. “If you are mentoring, then you probably are managing or directing, and this may be a way to provide people the practical means of garnering the valuable experiences,” he says. “There may be some [mentors] who would have internship opportunities. Knowledge and experience transfer from the day-to-day aspects.”

Error Avoidance

Understanding the potential pitfalls serves as a powerful tool in making a mentor-mentee relationship flourish. Below are some of the most common stumbling blocks:

Having Blind Expectations Both parties must understand the objectives from the onset. Discussing expectations early on helps avoid feelings of frustration. “Knowing what you are getting into makes the process more enjoyable for both parties,” says executive coach Francie Dalton.

Failing to See the End All mentoring relationships reach a point where they no longer bear a serviceable level of utility. “It is far easier to end the relationship when the two parties establish desired outcomes early on, explicitly stating and agreeing to them before the relationship begins,” says Dalton. “Setting deadlines to achieving the outcomes also helps bring a healthy, comfortable end to the mentoring relationship.”

Misjudging the Relationship The mentor-mentee relationship is intended to be a professional pairing designed to transfer and share knowledge and experiences. Since the two individuals tend to communicate frequently, there can be a tendency to become too informal, which can lead to uncomfortable or unwanted situations. Dalton recommends keeping the relationship in perspective so that it is easier to avoid blurred lines.

Case in Point

When South Korea-based Sung Won Hwang heard about the opportunity to participate in (ISC)2’s pilot mentoring program, he immediately volunteered to be one of the first mentees.

“It is a great opportunity to have this kind of guidance from a seasoned wireless sector veteran,” he says. “She graciously shares her experiences in answering my questions, which has helped significantly in my understanding of international security issues.”

His mentor, Sandy Bacik, principal of North Carolina-based Bacik Consulting Service, explains that the process has been equally gratifying for her. “This provides an opportunity to guide new blood with differing skill sets into the security field. Many security professionals focus on the technical aspects of security and forget about the soft skills and dealing with the business side of the enterprise,” she says. “Working with a mentee gives the opportunity to coach them in expanding their communication and business skills, while focusing on their technical skills to gain the experience in the field.”

Bacik hopes the program will allow her to share her enthusiasm for the industry. “This profession is an exciting and challenging field with a promising future,” she says. “I have had many experiences with my skill set and professional travels, and I want others to know about the stumbling blocks and the rewards you can personally achieve within the security profession. I see this as an excellent opportunity to train others in understanding and expanding their knowledge about risk and liability in a day-to-day working environment.”

When Pamela Chambers O’Rourke started her career she was filled with dreams and ambitions – fueled from years of listening to her daddy, the late Jack K. Chambers, Sr.’s encouragement. Since then O’Rourke has accomplished almost all the goals she set out for herself when she started Houston-based ICON Information Consultants.

To start, she was determined to flourish in a predominately male-oriented world (IT) and rather than seeing this as obstacle, she leveraged her inherent strengths and differences as an asset to succeed.  Once she achieved stability she wanted to work with some of the world’s leading companies, and although it took time and persistence, numerous opportunities surfaced including a contract with Chevron (after eight years of persistence) as well as the most recent opportunity to participate in the HP Mentor program.

O’Rourke further dreamed about being able to one day give back and play an instrumental role in paving the way for other women to succeed.  O’Rourke accomplished this through her work with the Houston chapter of AVANCE – a nonprofit group associated with the federal Head Start Program. In donating time and money, she has been instrumental in creating a computer learning center. Now diverse families and children have a facility where they can acquire basic skills to be successful in life.

It’s not hard to see how O’Rourke has been able to systematically achieve the goals she set for herself. However, it was not until she recently received the prestigious Ernst and Young Entrepreneur Of The Year 2009 Award, that she took a few moments to reflect and take it all in. “It was a meaningful experience. This is when I realized that what my dad told me was true,” she said. This moment of reflection also provided O’Rourke an opportunity to determine the path ahead as well.

Staying strategic

For O’Rourke, achieving success has undoubtedly been strategic, so it comes as no surprise that she is now pursuing formal alliances with women owned, veteran and minority owned companies.

Currently O’Rourke has two alliances in place – one with Atlanta-based MDI Group (Ella Koscik) as well as a relationship with the veteran/woman owned, Grayslake, IL-based Tech-11F (Terri E. McNally). In both instances, the alliances have resulted from the principals working together on the WBENC board, and building a mutual respect and appreciation for each other’s talents. “More women need to come together to be the growth of the economy and turn this country around,” she said.

While some have difficulty actually pulling the trigger to make alliances official, O’Rourke said doing so has not been difficult thus far. “Using strategic alliances is another way to expand the organically grown company I have created. The key is that the alliance needs to make sense for everyone involved or it will never work,” said O’Rourke. “We work with different organizations and complement one another rather than compete with each other. We both add value and have strengths where the others have weaknesses.”

MDI is a VMS-MSP organization meaning that it has a different product to offer, yet something that is well aligned with what ICON offers. “They are a true vendor-neutral company. They provide a tool and/or technology and the services to assist a corporation,” said O’Rourke. “It is in MDIs best interest to take the leading IT, accounting, finance, HR, procurement companies with them. If they look good, the customer looks good and everyone looks great.”

Being able to enter into these formal relationships and work on projects together (the first with MDI being at BNSF) without apprehension has been a matter of trust, explained O’Rourke. “I know what Ella stands for, and I respect her philosophies. She is very ethical and only promises what she can deliver,” she said. “We have different contacts and have the opportunity to help one another significantly. How could I ignore that type of opportunity?”

Pursuing growth

In today’s tough economy, O’Rourke refuses to simply “stand still.”  Instead, she embraces the perspective that opportunity is abound – business owners just need to be ready. “By watching what was happening around me – oil pricing, new administration, turmoil from hurricanes, Wall Street’s demise – I could see that 2009 was going to require additional determination as well as preparation to not only hold our ground but ultimately grow,” she said. “To be honest, I don’t see 2010 being any different.”

As a result, ICON has experienced continued growth with new RFP opportunities and new contracts. “Its all about perspective. I know the competitor is always ready to seize any opportunities you leave open,” she said. “Plus, in today’s environment, some corporations have asked for cost reductions, but ICON has remained strong in part because I continue to reinvest in the organization.”

O’Rourke is also determined to continue growing as a leader, especially as she embodies the true role of CEO. For instance, when she attended the WBENC Advanced Tuck program (through an HP sponsorship), she went there intent to learn as much as she could from the best. “After all, continuous learning is a pivotal component in realizing sustainable growth,” she said.

Staying strong

According to O’Rourke, women on forums and boards need to learn to grow together strategically. “If the WBENC women just come together and form strategic relationships they can learn from one another, and contribute significantly to their mutual success,” she said.

This is especially true in today’s environment with companies bidding well below cost simply to obtain business, explained O’Rourke. “It makes you question whether the people can continue to deliver,” she said. “This is where the firms like ICON, MDI, Tech-11f, Mercedes Electric, Tectech Communications, The Roberts Companies and Neutral Posture will be there when the others make promises they cannot deliver upon. We just need to stay strong, stick together and support one another.”

O’Rourke told Women’s Enterprise that she will always hold firm to the belief of never giving up. “If you give up others win. Life is about winning, adding value and doing the right things,” she said.

Charting the future

The never complacent O’Rourke continues to stay focused on taking her business to the next level. Yet, she realizes that she cannot stay at the helm forever. “I want to grow the company as big as I can. I want to document, streamline and prepare for a turnover. Thinking about an exit strategy – even if it is in the distant future –is hard because it is saying that at some point you are stepping away,” she said. “You want to know that the next person has your passion and drive.”

According to O’Rourke, part of her future will include continuing to donate her time to groups like AVANCE as well as spending time assisting MWBEs in streamlining their processes, introducing new systems and documenting standards and procedures. “I also want to advocate telling all the little girls that the future is theirs, especially within the math and science fields,” she said. “They need to realize that there is not going to be any man waiting on them and pampering them. They will need to make their own money and support themselves. You go girls. You are the future of America and never forget it.”

Some businesses go years or even decades struggling to find the one differentiating factor that ultimately defines the organization. Plano, Texas-based Krypton Solutions is unique because of the firm’s exceptional ability to form strong bonds of loyalty with customers and employees alike.

“The relationships we have developed go well beyond typical customer-supplier or employer-employee relationships,” said co-founder and CEO Suresh Patel. “There is a dedication and appreciation for each other on both sides. When you couple a true appreciation for the customer with our dedicated employees who simply operate on excellence, you have the perfect winning combination for success.”

The four brothers who own Krypton Solutions operate the business together every day.

“We have a very deep-rooted bond of respect and appreciation for one another,” Suresh Patel said. “As a result, we are dedicated to the success of the company and are clearly focused on a common goal at all times.”

Krypton Solutions has also internally developed intellectual property, resulting in a unique manufacturing system that allows the firm to produce defect-free boards.

“We are fortunate to have an exceptionally strong technical staff, including five electrical engineers, which is unique in the industry,” he said. “We are a technical asset and partner that the customer can rely on to ensure their new design will meet or exceed their expectations and specifications.”

Embracing opportunities

Krypton Solutions’ recent successes with Texas Instruments are a prime example of the firm’s ability to develop, maintain and foster mutually beneficial relationships. In 2006, TI was faced with an engineering challenge, and they asked Krypton Solutions for assistance — which opened the door to future opportunities.

Today, Krypton Solutions manufactures evaluation modules — printed circuit boards designed to show off TI’s newest devices. TI selected Krypton Solutions as one of three turn-key printed circuit board suppliers of enterprise volume management systems for its High-Performance Analog Group.

“The TI devices that we build the EVMs for are currently the most leading-edge products on the market today, and we are proud and honored to have been selected to partner with TI on this work,” Patel said.

Krypton Solutions’ desire to be a great supplier with a diverse portfolio of offerings sets them apart from others, explained Natasha Singleton, TI procurement manager for WW test hardware.

“TI is dedicated to providing opportunities to ethical suppliers with great quality products and good customer service,” she said. “Essentially, we want the same from our suppliers as our customers expect from us.”

In order for companies to survive and remain viable in any economy, it is important to have more than one revenue stream, Singleton explained. “Krypton Solutions made it through a difficult time in our economy last year because they are insightful and dedicated to a broad customer base,” she said.

Proper perspective

As a young engineering-solutions provider, Krypton Solutions has faced its share of challenges and growing pains. However, as Patel explained, the organization thrives on solving problems and rightfully expects new challenges daily. For instance, as with any fast-growing company, logistic challenges are a reality.

“Since we are in the business of solving problems, these types of challenges become just one more project on the table until resolved,” he said.

In just its second year, Krypton Solutions outgrew its 7,000 sq. ft. facility, prompting the construction of a custom-built 40,000 sq. ft. facility. And, in the firm’s third year, the brothers decided to purchase all new equipment — understandably a tremendous, yet calculated, risk in a down economy.

“The expansion alone was quite an accomplishment, but it must be noted that we did this while maintaining 98 percent customer satisfaction and 95 percent employee retention over the last three years,” Suresh Patel said. “We welcome challenges, each one providing us a new opportunity to rise up and shine.”

The ISO 9000-, ISO 13485- and AS9100-certified Krypton Solutions’ efforts have not gone unnoticed. For instance, Krypton Solutions has earned the Circuits Assembly Customer Service Excellence Award the last two years, in addition to honors within the Collin County Celebration of Enterprise “emerging” category. Krypton Solutions was also selected as one of six local companies to participate in TI’s Minority/Women Business Development Initiative.

Extended family

Patel told Minority Business News that the employees at Krypton Solutions have been the key to the company’s success.

“Our employees go the extra mile for us, knowing we would do the same for them. We are committed to keeping every employee well-trained and up-to-date on the company at all times,” he said.

To accomplish this goal, Krypton Solutions hosts a monthly companywide luncheon for its team to communicate the details of how the company is doing, announce any new plans and share company goals and objectives.

“It is a very interactive forum, allowing everyone an opportunity to put their two cents in. After all, many of our best ideas come from our employees.”

As a prime example, Krypton Solutions has seen real success with its suggestion box program. From the suggestion box, Patel determined that employees would prefer to relax in different ways at break time.

“Because we recently built a new facility, we were able to design special break rooms for our employees that they requested, including a game room with a ping pong table, TVs and other fun items. In addition, an exercise room is in the works and so is a library where books are already materializing,” he said. “They put in long hours for us, and we feel they deserve a nice place to relax. We want our employees to feel like Krypton Solutions is a second home.”

The firm also provides employees with constant feedback, allowing for the free flow of information and fostering continuous improvement.

“Because we are an engineering solutions provider, there is never a dull moment,” Patel said. “This makes for a very enriching, learning environment — a place to thrive and a fun place to work for everyone here.”

According to Patel, the sky is the limit for team members.

“Our team members feel secure and are not limited by titles. We know we have a very talented group of employees with substantial experience,” he said. “This team has the mindset to do whatever it takes. We all operate to a common goal, and that is what drives us.”

People also enjoy working with the solid manufacturing and quality systems that are in place at Krypton Solutions, which has allowed the company to grow in an organized fashion.

“We have doubled the quantity of jobs we had over last year, and yet, if you were to observe production from a distance, you would see everyone just peacefully working along,” Patel said. “You would not see chaos, and I think working in a calm, nonchaotic environment is very important to everyone in general.”

Community development

The Patel brothers have a big picture vision that involves helping the community succeed, as well as the company. After sharing ideas and vision with the Plano Chamber of Commerce and Plano Economic Development Board over the last year, the co-owners successfully launched the Southeast Plano Business Alliance with neighboring companies.

“Plano is our home, and this community is very important to us,” Suresh Patel said. “We are working hard to make a difference here.”

He strongly believes in knowing the neighbors and working together to keep the community strong by keeping business in the community.

“Educating each other on our company’s products and services is step one, so we can help one another as opportunities arise,” he said. “There are a number of technology companies that complement one another in our Alliance. By banding together, we will clearly have an advantage on substantial opportunities with larger companies.”

According to Patel, taking the time to educate the chamber empowers them with the necessary knowledge to go out and market the Alliance companies, brand the community and help bring more customers into the community.

“In order to attract more potential customers to our community, our Alliance is looking at coordinating our landscaping to have a theme,” he said. “We are considering outdoor trails and sharing break areas for our employees and customers to enjoy as well. We are also addressing zoning, permitting and DART transportation, among other things, as a cohesive group of companies.”

The recently formed Youth Inspiration Program is a prime example of what a community can accomplish when it comes together. The goal of the program is to bring high school students into the technology park for a day at a time — showing them what each firm does.

“Our children truly are the future and as a technology park, we feel it is our responsibility to expose them to technology,” Patel said. “We would like to teach them some basic technology concepts on how things work from a broad view — to peak their curiosity.”

The hope is to open young minds to technology and its impact on the world.

“We would like to further the program with contests and events that challenge them,” he said. “This is just the start of the many great things to come from our Alliance for the betterment of the community.”

Staying focused

Especially during a tight economy, staying focused on the big picture and on developing long-term relationships is a key, Patel explained. “When problems arise, you don’t let them slow you down. As with any engineering process, you make adjustments and move on, rather than getting wrapped up in the little bumps along the way,” he said.

Diligence, hard work and attention to detail in every aspect of the business are essential, especially in today’s competitive market.

“We have also learned the significance of staying up-to-date and knowledgeable of our client’s roadmap,” Patel said. “This is critical to ensuring proper tools, equipment and people are in place and ready, as defined by the roadmap — otherwise, the future opportunities may pass you by.”

Cloud services are gaining in popularity thanks to business benefits including cost savings, improved time to market and the ability to speed up innovation. However, few standards exist (the Cloud Security Alliance, a worldwide nonprofit organization that promotes best practices in security assurance in cloud computing, is making strides toward establishing industry-wide standards—but they’re not there yet), and that presents a considerable problem for information security professionals looking to implement and maintain cloud services.

Transparency is a Must

Businesses must take precautions when entering into cloud-based service agreements. They need visibility into cloud providers’ processes and systems to maintain necessary ITgovernance, says Jim Reavis, executive director of the Cloud Security Alliance. “You cannot outsource governance, risk and compliance,” he says. “It is also important to understand that to a large degree, focus must be on the data: where it is located, what regulations are applicable and how it is being protected. Acoherent architecture is also important to achieve portability and interoperability between different cloud providers.”

The key, says Irfan Saif, a principal with Deloitte Consulting LLP, is to gain an understanding of what the provider is doing behind the scenes. “Find out how they are managing their offering, what controls are in place, and how they can provide assurance given there is not a prevailing standard,” he says. When you work with a provider, you typically have a point person managing your organization’s data, “who has access to things that in a traditional world you would have managed internally. In these instances, there needs to be not only the contractual pass-through, but also a way to somehow validate that the provider is following outlined practices and managing the appropriate risks on your behalf. This becomes increasingly important when managing compliance risk.”

Visibility should also include access at a granular level, including the actions of privileged users, says Slavik Markovich, chief technology officer of Sentrigo, a Calif.-based database security software provider. “As a case in point, the recent Google disclosure that an engineer had viewed the private chat and Gmail of a user shows that this not only is possible, but likely occurs regularly,” he says. “The more frightening point is that the privileged user is often able to cover their tracks, deleting or modifying log files to eliminate records of their access. Only with more sophisticated tools that ensure separation of duties can this be prevented.”

Planning for Risks

One way to head off pitfalls is to look at risk across the enterprise, with cloud being one channel. Saif says this enables a company to maximize cloud benefits while gaining broad visibility. It’s important to determine whether to utilize public, private or hybrid cloud environments (see Cloud Definitions on page 9). The approach must fit the organization’s requirements and in-house capabilities while meeting its needs for improved time to market, lower total cost of ownership and a timely return on investment.

Understanding the risks of each option is the key to success. With public clouds, servers are often shared between applications, introducing potential threats not present with dedicated hardware. “Administrators and developers with privileged access to one application may be more easily able to misuse access, affecting a broader range of systems,” says Markovich. “Since you can’t conduct background checks yourself on third-party personnel, you’ll want assurances that the cloud provider meets certain criteria, such as SAS 70,” an in-depth auditing standard.

In theory, private clouds seem to be the safer option because they offer the ability to retain control over physical assets. But many companies lack the resources to manage private clouds cost effectively, and there are some compatibility risks to consider. “The reality is that most organizations will be using services in multiple clouds, and will be managing hybrid cloud environments,” says Reavis.

Establishing Ground Rules

Before entering into a partnership with a cloud provider, get a clear understanding of service-level agreements and functionality. “The procurement and contract negotiation phase may be your best bet to getting the security guarantees you need,” says Reavis.

Confirm whether the provider is maintaining its systems at the latest patch levels, adds Markovich. “It is often difficult to bring down production servers to implement recent patches to the operating systems, databases and other infrastructure software, yet these are very easy targets for hackers,” he says. “Knowing that an application uses a certain piece of software, and that the vendor just issued a patch for a specific vulnerability, the hacker now knows exactly how to break in—at least until the patch is applied.”

Another piece of advice: Understand how the provider handles physical copies of data. For example, if a drive goes bad in their storage farm and it is replaced, what happens to the old drive? How does the vendor ensure it is rendered unreadable? “The big players certainly have policies for this, but when you trust sensitive information with a smaller provider, a single lost drive could cause significant damages,” says Markovich.

Many companies already have sensitive data outside their enterprise, via Software-as-a-Service (SaaS) applications such as salesforce.com or NetSuite. Typically, SaaS vendors have policies in place to prevent even their own privileged insiders from viewing your company’s data, as well as controls to protect multi-tenancy environments. But you should investigate and ask questions.

“For example, can the administrator managing the backend database for your SaaS application make a copy of all the credit card numbers you’ve entered with orders?” Markovich asks. “Also, can the system administrator for that server you’re sharing with an unknown number of other companies in your cloud infrastructure simply make a backup copy of the drive with the Social Security numbers of every employee in your company? Before putting this data on these systems, you should understand how the provider will protect these cases, as your own compliance team will likely want to know.”

Internal Affairs

Don’t overlook the need to tackle cloud compliance issues internally, too. Training and awareness are crucial elements. “Employees cannot just do things in a cloud environment without thought. Alot of security-related challenges are often inadvertent, which is why awareness in the cloud environment is so important,” says Saif. To that end, heighten awareness among employees enterprise-wide about what information can be sent to cloud providers in light of organizational policy and regulatory requirements.

Meanwhile, ITneeds to granularly monitor applications to ensure policies are enforced. “If it is possible to encrypt information before transmitting, by all means [IT] should do so,” Reavis says. “In the long run, interesting developments such as format-preserving encryption have great promise to automate protection and prevent information outside of the enterprise from being compromised.”

Without training and awareness, business units and departments will continue to obtain services without IT’s involvement. “The enterprise compliance requirements need to be crystal-clear so more parts of the enterprise talk to ITdirectly rather than procuring cloud services on their own,” Saif says. “Often, employees will go out and procure services on their own because it helps them achieve faster time to market and they feel like they do not need IT’s permission. Yet this fractured approach creates real challenges and often results in a loss of cost benefit.”

While there are potential pitfalls, cloud services represent a beneficial way for ITleaders help their companies gain new efficiencies. The key to success rests in understanding the compliance issues and talking openly with cloud service providers.

Questions to Ask Cloud Providers

It’s crucial to have a comfortable working relationship with a cloud service provider for ongoing success. Kathy Owen, senior vice president and global CIO at Chattanooga, Tenn.-based Unum, a large insurance company, recommends asking some critical questions before entering into a contract or agreement:

• Who has access to the data?
• How many employees have root, database and infrastructure access?
• What policies are in place to prevent the cloud provider’s employees from getting access to your company’s data?
• Is the data encrypted at rest and in motion?
• Is the environment a multi-tenant one and if so, what controls data segmentation?
• Will data be stored on servers in other countries? If so, how does this impact compliance?
• What controls are in place to prevent data loss (i.e., a vendor insider downloading customer data on a USB drive)?
• What information is captured in audit/security event logs and is it available to the customer?

“When you are charged with the protecting organizational data, there needs to be several security measures in place including: strong authentication controls such as two-factor authentication and IP address restrictions to prevent a user from transmitting data from a non-company network; data encryption for data at rest, data transmission and backups; data segmentation, either physically or logically; and access control logs to show who accessed the data and when,” says Owen. “Always make sure you are comfortable with what the vendor provides.”

Cloud Definitions*

* as defined by the National Institute of Standards and Technology IT Lab

Private cloud: infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise.

Public cloud: infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

Hybrid cloud: infrastructure is a composition of two or more clouds (private, community or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds).

Most entrepreneurs are stubbornly independent by nature – it helps them survive. However great results can come from pursuing strategic alliances with like-minded firms, in terms of both finding exciting ways to serve existing customers and entering new markets.

Doug Burgoyne, Costco member and founder of Vancouver, BC-based Frogbox, knows firsthand how having a strategic partner can open up a world of new opportunities. After finding success renting plastic boxes to movers as an environmentally conscious alternative to cardboard, Burgoyne knew that over time he could repeat his model outside the Vancouver market.

Burgoyne’s expansion plan received a boost after embracing 1-800-GOT-JUNK as a strategic partner.  “It was a matter of thinking big and not being intimidated to present the company to one that is 10, even 100 times bigger,” he says. “After all, big corporations look for added benefits as well.”

Ultimately, Frogbox was able to launch its Seattle operation 50 percent faster than Burgoyne initially planned.  “We’ve been able to leverage our partner’s skills and experience to more quickly ramp up business in Seattle,” he says. “In return our partner is now able to offer his customers an eco friendly service when they are moving. “

Picking partners

Of course, pairings of this nature rarely happen by chance – they take determination, consideration and action.

There has to be a good fit with congruent values, explains Dallas-based Costco member and business coach Ann Ranson. “This requires knowing your own strategy, target market, goals and objectives,” she says. “Followed by doing the research to find other companies that might be a match.  You want to be sure that you also share similar values and ethics.”

Likewise, the individual offerings must pair well. For instance, Frogbox’s alliance works because a noticeable percentage of each firm’s clients can see benefit in what the other offers.  The goal should be finding complementary partners to offer something new to your clientele while also allowing you to serve new audiences.

According to Erin Blaskie, Costco member and founder of Business Services Etc., success comes to those who embrace creativity while taking the initiative to present their case to prospective partners.  “Always put together a plan that outlines the steps and the pieces for them so it was a no-brainer on their end,” says Blaskie, whose Kanata, ON-based firm provides an array of professional services designed to help companies solidify their online presence.

For instance, when Blaskie recognized the potential in partnering with Boise, ID-based help desk software developer Kayako, she established a simple yet effective framework sure to attract COO Ryan Lederman’s attention. “They provide a software that our clients need to help them manage their customer support,” she said. “We showed how forming a relationship would provide more value to our clients, while providing Kayako with an active and targeted potential customer base.”

However, before approaching Kayako, Blaskie tested the software in-house to be sure it would meet the primary issues of her existing clients.  After all, doing the homework in advance helps in forming realistic expectations. “Plus when an alliance is kept simple, it can be very effective and won’t cost you a ton of your time,” says Blaskie.

Open eyes

While forward momentum may spark the desire to act immediately, Ranson stresses the importance of having a very clear agreement in place spelling out the roles for each party.  “Do not even think of engaging a single resource until you do have a signed agreement,” she says. “Having an agreement in place helps eliminate unknowns and provides a level of security for each party.”

Once an agreement is in place, promotion should be one of the benefits of the newfound synergies and the combined resources. “Tight budgets are one of the reasons that an alliance makes sense,” says Ranson. “Maybe one partner has marketing money while the other has manpower to help initiate a grassroots type of campaign.”

Planning out an effective marketing program should be one of the first joint activities, explains Blaskie.  “Be sure to consider casual and structure marketing avenues (social media, new client collateral, etc.),” she says.  “Regardless, the goal should be finding and leverage cross-promotional opportunities that make both parties more attractive to their clients.”

Sidebar: Common pitfalls

Expecting everything– Always temper expectations. “The goal of entering an alliance should be to find sustainable congruencies capable of yielding long-term mutual benefits,” says Ranson.

Holding back – Find a level of comfort in sharing. “Trust is instrumental in making it through the tough times, and establishing a genuine relationship,” says Burgoyne.

Festering feelings – Immediately address issues. “Festering problems or concerns will destroy an alliance quickly,“ says Michael Brooke, Costco member and founder of Thornhill, ON-based Concrete Wave.

Winging it – Demonstrate clear value in making a proposal. “If it’s too lopsided your way, it just turns into another sales pitch,” says Burgoyne.

Part of having the latest and greatest in technology is the ability to enjoy it with your friends, family, and business associates. However, sharing pictures or videos using the traditionally small screens of mobile devices can be a drag. Fortunately, the newest portable projectors present an intriguing solution. As truly powerful pocket-size, standalone units, mini projectors empower you to put on an impressive show with pictures, movies, and other video content — without the huge price tag. Below are a few of the best units available today.

SAMSUNG SP-H03 PICO PROJECTOR

Powerfully Portable

With a fully integrated multimedia player, the 6-ounce SP-H03 from Samsung is a self-contained personal media device designed to appeal to the tech-savvy. The 1GB of internal memory allows you to load content directly to the device without being tethered to a computer. And with seamless, built-in multimedia playback, the SP-H03 is ideal for easily sharing images, videos, music, and documents in a variety of settings. The solid-state LEDs and DLP (digital light processing) technology heighten performance with an ultrabright (30 lumens) picture up to 80 inches wide, ensuring that everyone enjoys the show. The SP-H03 features a 1-watt speaker for audio output, a headphone jack, and built-in document and media viewers, enabling PC-free projection of Microsoft Office documents, PDFs, movies, and images. $299, samsung.com

3M POCKET PROJECTOR MP180

Wireless Wonder

The 3M Pocket Projector MP180 comes equipped with Bluetooth connectivity, allowing you to wirelessly stream movies, photos, PowerPoint presentations, and other content directly to the projector from your laptop or smart phone. The MP180 offers brightness of 30 lumens and SVGA resolution, for a maximum image size of 80 inches wide in an appropriately lit room. You can preload media with the ample 4GB of internal memory, or take advantage of the MicroSD card slot to expand the memory if needed. Other notable features include an embedded touch-screen display, a tripod, and an LED lamp life of 20,000 hours. $395, 3m.com

FAVI E1-LED-PICO

Always Ready

Keeping gadgets charged when you are on the road can be a challenge. But that’s not an issue with the FAVI E1-LED-PICOprojector, with its six-hour battery life and comprehensive international charger pack. The E1 projects images up to 80 inches wide and supports popular audio, video, and photo file formats. The projector connects to almost any video device, including DVD players, iPhones/iPods, media players, and even popular video game consoles. It features built-in speakers, a headphone jack, 1GB internal memory, and the ability to support SD memory cards. $297, favientertainment.com

MICROVISION SHOWWX LASER PICO

Staying Focused

Thanks to its patented display engine technology, Microvision’s SHOWWX requires no focus adjustment, allowing you to maintain crisp picture quality whether you are projecting images at the minimum 6-inch width or the maximum of 100 inches. The combination of laser light sources and Microvision’s tiny MEMS scanning mirror produces vivid, colorful, realistic images, and it weighs in at a mere 4.3 ounces. $499.99, microvision.com/showwx