Wiki Leaks

Introduction:

Wiki Leaks is a non-profit journalistic organization. Its goal is to bring vital news and information to everyone. It gives a creative, secure and anonymous way for sources to leak information to its journalists. The most important activity carried out by them is to publish original source material alongside their news stories so everybody can verify those material by referring evidence of the truth. It has worked to report on and publish important information. They also develop and adapt technologies with the help of software development companies to support these activities. The broader principles on which its work is based on the defense of freedom of speech and media publishing and the cooperation of the rights of all everyone to create new history.

How WikiLeaks work:

Wiki Leaks has combined high-end security technologies of application development companies with journalism and ethical principles. When information comes in, journalists analyze that material, assess and verify it and then write a news piece about it describing its significance to society. They then publish on their website both the news story and the original material so that readers can analyze the story in the context of the original source material themselves. Unlike Wikipedia, random readers cannot edit their source documents.

Wiki Leaks accept leaked material via electronic drop box or other applications developed by application development companies. Then they assess all news stories, test their truthfulness and then publish those material. Publishing the original source material behind each of news stories is the way in which they show the public that their story is authentic. By making the documents freely available, they expand analysis and comment by all the media and public.

Importance of WikiLeaks:

Wiki Leaks publish all news stories on its website with certain privileges to make them secure. It has collaborated with web development companies to achieve its purpose.

Publishing enhances transparency, and this transparency generates a better society for everyone. Scrutiny helps to achieve reduced corruption in politics and healthier democracies in all society’s institutions, including multi-national corporations, software development companies, government and other organizations. 

Wiki Leaks has provided a new model of journalism. As Wiki Leaks is a non-profit organization, it doesn't follow the conventional model of competing with other media, rather than it works cooperatively with different journalistic media organizations around the world. They believe the world’s media should work together to bring stories specially about all politicians to a broad international readership.

Few Notable Leaks of Wiki Leaks:

•  (WikiLeaks, 2007) helped providing information to the UK newspaper The Guardian to publish a story about corruption by the family of the former Kenyan leader Daniel arap Moi  in August 2007.
• (WikiLeaks, Information published by WikiLeaks, 2008) released allegations of illegal activities at the Cayman Islands branch of the Swiss Bank Julius Baer in February 2008.
• (WikiLeaks, Information published by WikiLeaks, 2008) posted the contents of a Yahoo account belonging to Sarah Palin during  the 2008 United States presidential election campaign in September 2008.
• (WikiLeaks, Information published by WikiLeaks, 2009) released 86 telephone intercept recordings of Peruvian politicians and businessmen involved in the 2008 Peru oil scandal in January 2009.
• (WikiLeaks, Information published by WikiLeaks, 2010) released around 4,00,000 documents relating to the Iraq war in October 2010.
• (WikiLeaks, Information published by WikiLeaks, 2015) released articles, which showed that NSA kept spying on many German telephone numbers of German federal ministries, especially the Chancellor Angela Merkel, in July 2015. 

Conclusion:

Wiki Leaks is an international, non-profit, journalistic organization which publishes different secret political affairs on its website securely with the tie-up of different web development companies globally.

Bibliography

WikiLeaks. (2007). Information published by WikiLeaks. Kenya: Guardian.

WikiLeaks. (2008). Information published by WikiLeaks. Cayman Islands: WikiLeaks.

WikiLeaks. (2008). Information published by WikiLeaks. United States: WikiLeaks.

WikiLeaks. (2009). Information published by WikiLeaks. Peru: WikiLeaks.

WikiLeaks. (2010). Information published by WikiLeaks. Iraq: WikiLeaks.

WikiLeaks. (2015). Information published by WikiLeaks. Germany: WikiLeaks.

Enterprise Data Warehousing

Introduction:

       A data warehouse is a database designed to enable business intelligence activities. It exists to help users understand and enhance their organization's performance. A data warehouse environment can include an extraction, transportation, transformation, and loading (ETL) solution, statistical analysis, reporting, data mining capabilities and client analysis tools. It also helps for content management systems that manage the process of gathering data, transforming it into useful, actionable information, and delivering it to business users.

     A common way of introducing data warehousing is to refer to the characteristics of a data warehouse as follow:

• Subject-oriented: Data warehousing is designed to help analysing data for a particular subject.
• Integrated: Data warehouses must put data from disparate sources into a consistent format.
• Non-volatile: Once data is entered into the data warehouse, it should not change. This is logical because the purpose of a data warehouse is to enable you to analyze what has occurred.
• Time variant: A data warehouse's focus on change over time is what is meant by the term time variant.

Key characteristics of data warehousing:

• Data is structured for simplicity of access and high-speed query performance.
• End users are time-sensitive and desire speed-of-thought response times.
• Large amounts of historical data are used.
• Queries often retrieve large amounts of data, perhaps many thousands of rows.
• Both predefined and ad hoc queries are common.
• The data load involves multiple sources and transformations.

Tasks of Data Warehousing:

• Configuring an Oracle database for use as a data warehouse
• Designing data warehouses
• Performing upgrades of the database and data warehousing software to new releases
• Managing schema objects, such as tables, indexes, and materialized views
• Managing users and security
• Developing routines used for the extraction, transformation, and loading (ETL) processes
• Creating reports based on the data in the data warehouse
• Backing up the data warehouse and performing recovery when necessary
• Monitoring the data warehouse's performance and taking preventive or corrective action as required

Challenges of data warehousing:

There are so many challenges faced by software development companies regarding data warehousing as follow:

Ensuring acceptable data quality:

• Disparate data sources add to data inconsistency
• Not stabilized source systems

Ensuring acceptable performance:

• Prioritizing performance
• Setting realistic goal

Testing data warehouse:

• Test planning
• No automated testing

Reconciliation of data in data warehouse:

• Complex

User acceptance:

• Reluctant users

Benefits of Data warehousing:

• Congregate data from multiple sources into a single database so a single query engine can be used to present data.
• Mitigate the problem of database isolation level lock contention in transaction processing systems caused by attempts to run large, long running, analysis queries in transaction processing databases.
• Maintain data history, even if the source transaction systems do not.
• Integrate data from multiple source systems, enabling a central view across the enterprise. This benefit is always valuable, but particularly so when the organization has grown by merger.
• Improve data quality, by providing consistent codes and descriptions, flagging or even fixing bad data.
• Present the organization's information consistently.
• Provide a single common data model for all data of interest regardless of the data's source.
• Restructure the data so that it makes sense to the business users.
• Restructure the data so that it delivers excellent query performance, even for complex analytic queries, without impacting the operational systems.
• Add value to operational business applications, notably customer relationship management (CRM) systems.
• Make decision–support queries easier to write.

Conclusion:

Data warehousing is a collection of methods, techniques, and tools used to support knowledge workers—senior managers, directors, managers, and analysts—to conduct data analyses that help with performing decision-making processes and improving information resources. This concept is very useful to all software development companies in India.

Information Security Automation Program

Information Security Automation Program (ISAP) powers and standardizes technical security operations for Asp.net software companies india. Mainly focused on government, ISAP offers security checking, remediation, and automation of technical compliance actions to such rules as FISMA and the FDCC.

ISAP objectives allows standards-based statement of vulnerability data, customizing and handling configuration baselines for various IT products, evaluating information systems and broadcasting compliance status, using standard metrics to weight and aggregate probable vulnerability impact, and remediating recognized vulnerabilities.

ISAP’s technical provisions are measured in the related Security Content Automation Protocol. Information Security Automation Program’s security automation content is either controlled within, or referenced by, the National Vulnerability Database.

ISAP is being dignified for Asp.net software companies india through a trilateral memorandum of agreement (MOA) between Defense Information Systems Agency, the National Security Agency, and the National Institute of Standards and Technology. The Office of the Secretary of Defense (OSD) also contributes and the Department of Homeland Security (DHS) funds the process infrastructure on which ISAP relies.

The ISAP Information Security Model

The Information Security Automation Program (ISAP) is aimed at allowing the automation and correction of technical security operations. ISAP participates a number of individual projects, all designed to be compatible and to focus on individual areas essential for the overall coverage. 

ISAP technical specifications are controlled in the connected Security Content Automation Protocol (SCAP). SCAP is the model for using exact standards to enable automated vulnerability management, quantity and policy compliance assessment.

SCAP includes the following modules:

• CPE : The first element of SCAP is the Common Platform Enumeration (CPE). This is a structured naming scheme for technology element (operating system, equipment, services). CPE provides a flexible model for Asp.net Software Company in india for generating an inventory of the key infrastructure elements across the entity, allowing for further examination by adding the information delivered by the other SCAP elements. Objects face their first obstacle when trying to determine how to address security matters.
• CVE : The next component of SCAP is the CVE. CVE is a gathering of publicly known information security vulnerabilities and contacts that have been classified and documented by independent reviewers. CVEs provide a platform of mutual identifiers. This allows continuous naming of security vulnerabilities. Regardless of the tool or mechanism used to assess a system, and as long as CVE is used, the vulnerability will receive the same name and arrangement for c#.net software company in india. 
• CVSS :  After showing a complete inventory of the technology environment and documenting the existing vulnerabilities for c#.net software company india, entities can advance to deploy a consistent classification for vulnerability effects. The Common Vulnerability Scoring System (CVSS) is used to define the impacts of IT vulnerabilities. The model is based on a quantitative approach that offers a measure regarding different aspects of control, and it can be tailored to express the organization’s view on how vulnerabilities impact the business. CVSS can be used to simplify the prioritization of vulnerability remediation activities and also to compute the severity of vulnerabilities. 
• OVAL : The Open Vulnerability and Assessment Language (OVAL) can be used to express configuration information of systems for testing, investigating the system for the occurrence of the specified machine state (e.g., vulnerability, configuration, patch state) and recording the results of this assessment. OVAL acts as the proxy among the system configuration and the analysis tools used within SCAP and delivers significant flexibility for auditors and security professionals to describe the rules and parameters that should be evaluated.
• XCCDF : XCCDF is an Extensible Markup Language (XML) that can be used in asp dot net company in india to generate checklists, benchmarks, audit tests and system assessments. XCCDF documents include a set of rules that will be tested as part of the assessment. Also, there are rules scoring and testing operations supported by the system. Results can be benchmarked alongside predefined lowest levels (e.g., when a starting point has been defined for the platform). 

Conclusion: Information security and audit professionals can assume this technology to be a mechanism that will assist them deal with the complexities and size connected to technology control environments. Information can be arranged for executive management by combining the data extracted from SCAP modules and showing heat maps that can be discovered for noncompliance areas; this will simplify the message and permit for better oversight of the control environment.

COBIT - Control Objectives for Information and Related Technology

Introduction:

COBIT stands for Control Objectives for Information and Related Technology.  It is a framework created by the ISACA (Information Systems Audit and Control Association) for IT governance and management. It is a tool which supports managers and allows balancing technical issues, business risks and control requirements. It is a control model that guarantees three control objectives – confidentiality, integrity and availability of the information system. It delivers a great value to the organization and helps business managers to practice better risk management practices associated with the IT processes.

Today, COBIT is used globally for the IT business processes by all managers. It is a thoroughly recognized guideline that can be applied to any organization across industries. Overall, COBIT ensures quality, control and reliability of information systems in organization, which is also the most important aspect of every modern business especially software development companies for which IT management is a vital process. 

COBIT Framework:

The COBIT business orientation includes linking business goals with its IT infrastructure by providing various maturity models and metrics that measure the achievement while identifying associated business responsibilities of IT processes. The main focus of COBIT is on following four specific domains:

1. Planning and Organization
2. Delivering and Support
3. Acquiring and Implementation
4. Monitoring and Evaluation

COBIT  has a high position in business frameworks and has been harmonized by several successful custom software development companies. COBIT is being used by all organizations whose primary responsibilities happen to be business processes and related technologies. This is for all organizations and business hat depend on technology for reliable and relevant information. COBIT is used by both the government departments, federal departments and other private commercial organizations. It helps is increasing the sensibility of IT processes to a great extent.

Components of COBIT:

• Framework:
• IT helps organizing the objectives of IT governance and bringing in the best practices in IT processes and domains, while linking business requirements.
• Process descriptions:
• It is a reference model and also acts as a common language for every individual of the organization.
• The process descriptions include planning, building, running and monitoring of all IT processes.
• Control objectives:
• This provides a complete list of requirements that has been considered by the management for effective IT business control.
• Maturity models:
• These accesses the maturity and the capability of every process while addressing the gaps.
• Management guidelines:
• It helps in better assigning responsibilities, measuring performances, agreeing on common objectives and illustrate better interrelationships with every other process.

Latest version of COBIT – COBIT 5.0:

The COBIT 5.0 framework has been able to bring about a collaborative culture within the organization and this better met the needs, risks and benefits of all IT initiatives. A COBIT 5.0 Certification not just prepares professionals for the global challenges to the business IT process but also delivers substantial amount of expertise information on:

• IT management issues and how they can affect organizations
• Principles of IT governance and enterprise IT while establishing the differences between management and governance
• Accessing the ways in which COBIT 5.0 processes can help the establishment of the basic principles along with other enablers
• Discussing COBIT 5.0 with respect to its process reference model and goal cascade

COBIT will be majorly beneficial to:

• CIOs / IT Directors
• Risk committee
• Process owners
• Audit committee members
• IT professionals

Conclusion:

COBIT aims to research, develop, publish and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to-day use by business managers, IT professionals and assurance professionals.

PCIDSS - Payment Card Industry Data Security Standard

Introduction:

PCIDSS stands for Payment Card Industry Data Security Standard. It is a proprietary information security standard for organizations including application development companies that handle branded credit cards from the major card schemes including American Express, MasterCard, Visa Inc., Discover Financial Services and JCB International. To protect cardholder data, these five global payment brands launched PCI (Payment Card Industry) Security standards council.

It ensures that merchants' credit card processing procedures meet certain security requirements as follow to make online payment systems secure:

• Install and maintain firewall configuration to protect data
• Do not use vendor-supplied defaults for system passwords and other security parameters
• Use and regularly update antivirus software
• Protect stored data
• Develop and maintain secure systems and applications
• Restrict access to cardholder data by business need-to-know
• Assign a unique ID to each person with computer access
• Restrict physical access to cardholder data
• Encrypt transmission of cardholder data and sensitive information across public networks
• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes
• Maintain a policy that addresses information security

This PCIDSS applies to all organizations web development companies that store, process or transmit cardholder data. Every business that accepts credit card or debit card processing payments and stores, processes and transmits payment card data must meet PCIDSS standard. 

PCIDSS specifies and elaborates on six major objectives as follow:

• A secure network must be maintained in which transactions take place. It involves use of firewalls that are robust enough to be effective without causing undue inconvenience to cardholders or vendors.  Authentication data such as personal identification numbers (PINs) and password must not involve defaults supplied by the vendors. Customers should be able to conveniently and frequently change such data.
• Cardholder information must be protected wherever it is stored. When cardholder data is transmitted through public networks, that data must be encrypted in an effective way. Digital encryption is important in all forms of credit-card transactions, but particularly in e-commerce conducted on the Internet by e-commerce solution provider.
• Systems should be protected against the activities of malicious hackers by using frequently updated anti-virus software, anti-spyware programs, and other anti-malware solutions. All applications should be free of bugs and vulnerabilities that might open the door to exploits in which cardholder data could be stolen or altered. 
• Access to system information and operations should be restricted and controlled. Every person who uses a computer in the system must be assigned a unique and confidential identification name or number.  Cardholder data should be protected physically as well as electronically.
• Networks must be constantly monitored and regularly tested to ensure that all security measures and processes are in place, are functioning properly, and are kept up-do-date. Anti-virus and anti-spyware programs should be provided with the latest definitions and signatures.
• A formal information security policy must be defined, maintained, and followed at all times and by all participating entities. Enforcement measures such as audits and penalties for non-compliance may be necessary.

Conclusion:

The beauty of the internet is attracting customers from around the world. However, it also attracts cyber criminals and so payment security is very necessary. PCIDSS is a security standard which has to be followed by every organization to secure cardholder data of customers. There are many software available for payment security provided by software development companies in India which facilitates data confidentiality, integrity, authentication, authorization etc.

Article Summary:

This article gives brief introduction about Payment card industry data security standard, its requirements and objectives. It also explains how a merchant should comply protection of cardholder data with PCIDSS.

Information Security Awareness in an Organization

Information is considered lifeblood of a successful and profitable business and employees of the organization work as veins to pass this information through. Confidentiality, Availability and Integrity of information are then directly related with employee’s behavior towards information. Most kentico software development companies think information security is a technical issue and do not consider involvement of employees in ensuring continuous security of the information. Organizations may have components of information security awareness program but without proper management of the needed resources, they will not be able to complete it properly and continue to be successful. Identifying and bringing together all available components to develop an effective information security awareness program can be a difficult and overwhelming task.

Brief about Information Security Awareness

Information Security is the protection of information in opposition to fault, disclosure and manipulation. 

It is commonly accepted that the majority of the security violations are due to human interaction rather than technology fault. Yet, companies depend and grant a lot of consideration to technology and usually forget participation of human beings in the system. Usually organizations use best of the best products and technology for the protection of information and infrastructure. They ignore human’s contribution and role in securing organization assets. Actually kentico companies in India make this mistake and relate information security with the products and technology although it is a process which needs human interaction and involvement. There is no such thing as 100% security but we try to maximize its level through an awareness program and human involvement in the process. 

A simple definition of the three security pillars is as follows. If anyone of them is missing then it’s a flaw and is against the information security measures.

Confidentiality: It means only authorized people can see information e.g. you are the only one authorized to see your bank statement.

Integrity: It ensures that information has not been changed either in transit or while in storage. It means only authorized people can change the information e.g. you can see bank statement but not authorized to change it according to your wishes.

Availability: It means information is available when and where it is needed e.g. you can get money from ATM machine when you want to buy things.

Information Security Awareness is user’s education and awareness to handle information security threats and minimize their impact. Awareness program basically focuses attention on information security issues like confidentiality, integrity and availability. It highlights the importance of these factors, their role in business and finally concentrates on how to behave with them in a confident way.

“Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly.”

Information Security awareness is a method used to educate people in the organization such as a kentico cms company. It highlights the importance of information, threats to that information and staff’s contribution in implementing policies and procedures for the protection of information. Awareness program is an attempt to change the behavior of employees towards systems and processes in the organization. It teaches what needs to be protected, against whom and how.

Information Security Awareness is a Business Need

In today’s business environment most of the companies rely on electronically exchanged information. It is a requirement of all the departments to produce and pass information across different departments in a quick and secure manner to support their business decisions. Information plays an important role in making decisions. Therefore kentico companies in India and even the government departments have different classification of data based on its importance and use. 

Business success depends upon continuity of operations and information provided to the business processes by information systems. The growth, excellence and efficiency of the business could be damaged due to the threats and misuse of information. Therefore, awareness program basically helps, set measures and educate users on how to behave and get benefit out of information without jeopardizing its confidentiality, integrity and availability. 

The employees are the primary users of the information. A lack of awareness and mishandling of information could expose this information to competitors or get corrupted. If this information is freely available the following could be some of the impacts on the company and its business functions:

• The information available easily can be used by competitors to design strategies and launch new products with more features

• The company’s credibility can be affected from this disclosure

• Customer confidence can be lost

• Help competitors to gain more share in the market

• Suppliers and partner would be conscious to deal with the company

• Non compliance to government and industry laws and standards

• Employees will lose trust and will look for other opportunities

In today’s competitive business environment to have a good reputation in the market and legal compliance is a major concern. Suppliers, partners and even clients ask proof of information security before making any transaction. They want to make sure that all the information given to the company will be protected and will be used only for the purpose it is provided. 

Therefore need of successful and responsible organization is to have well written security polices and procedure, run information security awareness program on a continuous basis and be conscious in protecting its information assets. Implementing a strong information security awareness program can be a very effective method to protect critical business secrets and it will help employees to understand:

• Why they need to take information security seriously

• What they gain from active participation and support

• How a secure environment helps them complete their assigned tasks

Information Security Awareness Goals and Objectives

As we all know people are the weakest link in the chain and are the source of many information security breaches within the organization. Before demanding information security, employees should be conveyed the importance of a kentico software development company’s information and criticality. An educated and aware user is the foundation of a secure and reliable business environment. 

Dealing with information security threats and incidents is not a technology issue but people’s behavior. It is a critical factor to have a successful and effective information security program that will modify the behavior of employee’s dealing and interacting with company’s policies and procedures. 

Usually IT or Security department is considered responsible for the security of information assets. It is a misconception which has to be communicated among employees that the IT department is not the only one responsible but Information security is everyone’s responsibility. Information Security is everyone’s responsibility and at any level of the hierarchy.

Information security awareness program helps in minimizing the cost of security incidents, helps accelerate the development of new application systems, and helps assure the consistent implementation of controls across an organization’s information systems.

The primary and foremost objective of any awareness program is to educate users on their responsibility to protect the confidentiality, availability and integrity of their organization's information.

One of the objectives of an awareness program is to convey simple, clear and presentable message in a format that is easily understood by the audience.

The awareness program’s objective is that users understand not only how to protect the organization’s information, but why it is important to protect that information.

Awareness program’s goal is to get users attention on information security policies and increase awareness level on all security controls and practices in the organization such as a kentico cms company.

One of the goals is to create a security culture across the organization and keep on reminding employees about its importance and their contribution in that.

“Continuous improvement should always be the theme for security awareness and training initiatives, as this is one area where “you can never do enough.””

Summarizing, information security is a behavior and attitude rather than a technology issue. The only thing which can change is the behavior and thinking of the staff through awareness and education. People join organizations with their own beliefs, values, culture and principles. Information security awareness program facilitates those people to understand and take on the organization’s culture, values and ethics. 

This article describes the importance and the association of employees with information security awareness program, and motivational factor to attract employees to be responsive to this program. This is required and is the responsibility of all members in the organization such as a kentico cms company to protect the information assets.

An information security awareness program is a vital need within any organization that wishes to ensure privacy, security, authenticity, effectiveness and availability of information assets. The success of awareness program depends upon management’s consent and continuous support for a kentico company in India.

Bibliography

• https://www.pcisecuritystandards.org/documents/PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_Program.pdf
• http://www.deertech.com/e-news/march2013_1.html
• http://en.wikipedia.org/wiki/Security_awareness
• http://www.giac.org/paper/gsec/4340/organization-everyones-responsibility-information-security-awareness/107113

Courtesy: Sanika Taori

How to Choose the Best Web Content Management System - Part 2

From the Developer’s Perspective:  Important Capabilities for Your Web CMS

While marketing decision makers are focused on the content management system capabilities that help optimize the customer experience, developers and IT decision makers should evaluate solutions based on the underlying infrastructure, development tools, and other features and capabilities that ensure performance, flexibility, scalability and ease of use for developers.

Here’s a checklist of critical aspects for developers and IT to consider when evaluating a new web CMS:

• Developer productivity: Look for a CMS that streamlines development and maintenance with easy-tousle tools, controls, and capabilities. Your web CMS should enable you to work with the tools you’re already familiar with, such as Microsoft Visual Studio, to make the best use of existing skills.
• Roles and administration: A good web CMS will provide a sophisticated permission management system that allows you to grant rights to users, groups, and roles for ease of administration and control. 
• Integration: Look for a solution that includes pre-built integration with leading enterprise software, including the ability to connect to databases and web services without complex programming.
• Design flexibility/customization: The web CMS should be flexible and easily customizable, with tools that let designers create and update site experiences without coding. 
• Security: In addition to a permission management system for granting rights to users, groups, and roles, your web CMS should also support external authentication and authorization systems like Active Directory without requiring extensive coding and integration efforts. 
• Scalability and performance: It’s essential to understand the performance and scalability implications of any web CMS you’re considering. To keep maintenance and ownership costs low, choose a solution that will let you deploy multiple websites on a single system. And for greater scalability, choose a web content management system that can leverage the cloud infrastructure to rapidly deploy and scale servers to handle increased website traffic and enter new markets—without requiring additional investments in hardware.
• Support for responsive design and mobile devices: Look for native support for multi-device output, with features such as device previews to enable optimization of content, site layouts, and renderings. The web CMS should automatically detect the visitor’s device type and serve optimized content for that device.
• Multisite and multilingual support: Select a web CMS that supports any number of domains mapping to different web properties, as well as flexible sharing of content and code between sites. Ensure that the solution enables many-to-many language support to avoid creation of extensive new data structures when supporting different languages. 
• Technical support and training:  Evaluate the breadth and depth of the vendor’s support and training offerings to make sure they deliver the level of support and education your organization has come to expect.

A Roadmap for Choosing Your CMS

Once you have your own list of important marketing and technical capabilities for a new web CMS, then you can create a short list of potential solutions that meet your needs. Once you have a short list, you’ll need to put one or more web CMSs to the test to see which one bests suits your organization’s needs.

The following best practices provide some guidance on how to gather hands-on experience, third-party objective information, and product know-how to inform your decision. Think of it as a roadmap for choosing your new web Content management system:     

1. Bring marketing and IT together: The entire team, including marketing, content editors, developers, and designers should participate in comprehensive demonstrations. While the initial meeting includes the entire team, allow different groups ample time to have their own sessions with the CMS vendor where they can ask questions, at their level, that address their business or technical requirements.
2. Try it before you buy it: Request that the CMS vendor install a clean/out-of-the-box version of its product for your development team. Demo systems are highly configured and don’t necessarily give you a clear view of the complexity of the product. With a clean installation, your organization can see how easy or difficult it is to get started.
3. See it in action: Ask the web CMS vendor to build a simple website from scratch for your development team. This will reveal what functionality ships with the product, as distinct from customizations that may have been included in the demo system.
4. Attend vendor training: Strongly consider sending your developers to the web CMS vendor’s technical training class. They will gain a clearer perspective of the product’s capabilities and shortcomings, potentially saving your organization significant time and money in the long run.
5. Tap the developer community: Determine if there is a vibrant developer community around the content management system companies you’re considering and then tap into it for further insight into the product.   
6. Talk to other customers: Ask the vendor for references of customers in your industry. Speak with those customers to gain insight into real-life experiences with the product.  

Article Summary:

We’ve come a long way since the days when a content management system (CMS) was simply a way to manage and update the content on your website. Today, a web CMS is just one type of technology you need to consistently deliver an excellent customer experience. While your web CMS is a crucial component, today you must look at it as part of a larger customer experience management capability.

Why the shift? It all starts with the connected, empowered customer who brings greater expectations and preferences about how and when he or she wishes to engage with a brand.  Today’s customers expect a seamless, multichannel experience that anticipates their needs and wants. Companies that deliver this type of experience are building trust and loyalty that result in top- and bottom-line improvements including:  greater return on marketing investment, increased conversions, higher revenues, and greater lifetime customer value.

How to Choose the Best Web Content Management System - Part 1

Choosing a Web CMS is about more than Content Management

To achieve these business outcomes, companies are embracing the discipline of customer experience management and investing in the technology that enables it. A customer experience management platform lets you drive consistency in the experiences that your customers have with your brand. And that’s where a web content management system company comes in. A web CMS helps you achieve that consistency and deliver great web experiences. The rest of the customer experience management solution helps you deliver that content and consistency in other channels such as email and social.

Because your web CMS must interoperate seamlessly with the components of customer experience management, the CMS decision shouldn’t be made in a vacuum. This paper highlights the criteria – both from the marketers’ and the IT/developers’ perspective – that today’s organizations should consider when selecting a new web CMS as part of a broader customer experience management strategy.

The New Requirements for Today’s Web CMS 

One of the hallmarks of customer experience management is delivering a consistent experience across all touch points. That’s difficult to achieve if your content management capabilities are isolated in a siloes system. Instead, your web CMS needs to integrate and interoperate as part of a centralized platform for customer experience management.

A customer experience management platform unifies channels, campaigns, visitor information, and performance measurement into one integrated marketing toolset. The web content management system company serves as the core of the platform, enabling you to create, manage, and deliver the most relevant content for each interaction based on centralized customer intelligence. And because of this prominent role in delivering and managing an excellent multichannel customer experience, your web CMS must be much more robust, scalable, and flexible than ever before.

It’s also important to ensure your web CMS can seamlessly integrate with core systems such as your customer relationship management (CRM) software, ad-serving software, video streaming application, and any other system that would benefit from sharing customer data across the enterprise. Centralizing and sharing customer data enables sophisticated personalization and targeting to deliver a more tailored, relevant experience, which improves customer engagement.

Now that we’ve set the context for the importance of the web CMS for customer experience management, let’s take a closer look at the requirements you’ll want to consider when choosing the best web CMS for your organization.

From the Marketer’s Perspective:  Important Capabilities for Your Web CMS

Today’s marketers require a web CMS which offers far more than simply managing content. Ensuring an excellent customer experience calls for a set of capabilities that range from enabling you to deliver powerful interactive features to engage customers on your website, to collecting and utilizing customer behaviour for personalized interactions, to displaying content optimized for mobile devices.

The following criteria take these and other requirements into consideration and can be used as a starting point for the marketing team’s evaluation of a potential new web CMS:  

• Easy-to-use interface: This remains a must-have for any web content management system companies in India. An intuitive, easy-to-use interface enables both marketers and content editors to add and edit online content quickly without having to know HTML. Casual users should be able to complete routine workflow tasks quickly and easily, while power users can utilize a more robust interface and set of functionality.
• Single view of the customer: Look for a web CMS that collects and utilizes visitor information to personalize the experience. The web CMS should capture information and insights about customers and prospects and combine this information with customer intelligence from other systems such as your customer relationship management (CRM) system for a single, comprehensive view of the customer.  
• Email and automation: The web CMS should integrate email campaign management, testing, and optimization to maximize campaign and site performance, drive higher conversion rates, and improve marketing return on investment. Look for marketing automation capabilities that help you eliminate repetitive tasks and streamline your marketing efforts around everything from email campaigns to landing pages, lead scoring, segmentation and profiling, and testing and optimization.  
• Real-time personalization and targeting: With a single view of the customer, your web CMS should be able to automatically sense and adapt to customer behaviour to offer the most relevant content and interactions.  Look for features such as native content profiling to help capture insight into customer needs and interests. 
• Search engine optimization (SEO): The web CMS should integrate SEO with the publishing process so that keyword-rich content and metadata, search-friendly URLs, and other SEO tactics are consistently and automatically implemented.
• Multilingual support and translation: If your organization has or will have international sites, multilingual and translation support should be on your requirements list. The web CMS should natively support content and websites in multiple languages as well as provide content editing tools that “speak” the major global languages your local, in-country marketing teams use. Also look for a web CMS that easily integrates with professional translation services to streamline the process of translating and publishing multilingual content.  
• Social media support: Any web content management system you choose should include a strong social media component, enabling you to easily create branded communities as well as deliver a seamless experience with third-party social networks. The right CMS should make it easy to establish—and maintain—a dialogue with your customers through blogs, forums, polls, and integration with social media sites such as Facebook and Twitter. 
• Mobile device support: Your web CMS should serve up a consistent, compelling experience on virtually any device. Look for a solution that automatically detects the visitor’s device type and optimizes the content for the specific device without having to re-render the site for each variation.
• Multichannel support: Insist on a web CMS that delivers multichannel support and integration including web, mobile, email, and social. The right CMS should enable you to view all your channels as a single experience and a seamless conversation with the customer, letting you orchestrate, monitor, and measure customer interactions across channels. 
• Flexibility to connect with other business applications: Insist on the ability to easily integrate any and all of your line-of-business applications such as customer databases and CRM and ERP systems. Look for prebuilt integration with leading enterprise software packages. You should also look for the ability to connect to databases and web services without complex programming. 
• Adaptive to future experience and site design improvements: Pick a web CMS that allows you to change design and experience elements without IT effort. You’ll want to be able to update page layouts, add pages, and alter designs all without coding. 

eCommerce & Content Management: More Important than Ever

Introduction:

It feels old-fashioned to write the word "e-Commerce,” but the reality is that billions of dollars in business has moved to the Web. While some people may still be shell-shocked by the dot.com fallout, a significant part of business process happens using the Internet as infrastructure. And while the better-known retail e-Commerce ventures (amazon.com, ebay.com) and e-Commerce solution providers are perhaps the biggest players in some people’s minds, they actually make up a small piece of the e-Commerce pie; far more e-Commerce is done between businesses. 

The electronic messages themselves—purchase orders, invoices, and quotes— represent some of the “content” of e-Commerce given by content management system company. Such messages, and the security and transaction apparatus applicable to them, are challenging pieces to the e-Commerce puzzle. The transaction itself, though, is just one step in a lengthy process that begins with a prospective customer researching some kind of requirement, and continues through the marketing and selling process, the transaction itself, follow-on customer support, customer relationship management, and, later, up-selling and cross-selling.

Gilbane Report readers will know the next point to be made, and that is that content is closely tied to all of these processes, and so content management plays a fundamental role in Internet-based commerce. We have worked closely with many large companies that have been automating how content is used in design, manufacturing, sales and marketing, logistics, and customer support. These are areas of intense focus for many companies now, and the platforms and systems to support content management are growing more powerful and more functional all the time.

It is, of course, obvious why content management is fundamental to e-Commerce: Commerce involves intensive communication at all phases of the process, and e-Commerce solution provider requires that much of the communication happen automatically and online. When the products are complex, the content is correspondingly voluminous and complex, increasing the benefits of content management technology.

In fact, the challenge of content management is even more complex. Content management supports all kinds of business processes—research and development, design, manufacturing, marketing and sales, customer support, maintenance, and supplies. There is an important leverage point at the nexus of business processes and the content that supports these processes because of the intimate relationship between content and business process at all points in the buying and selling process, and others have tried to articulate this in various ways. Forrester terms this transactional content, and Gilbane Report colleagues Mary LaPlante and Bill Zoellick have offered a helpful definition:

"Transactional content can be defined as shared information that drives business-to-business processes. It is the content that flows through the commerce chain, initiating and automating processes such as procurement, order management, supply chain planning, and product support. Transactional content is shared in the sense that it is exchanged among partners, suppliers, customers and distributors who each can contribute to it."

Transactional Content Management Challenges:

Because of these constraints, the content management market continues to broaden, and the offerings continue to widen. There are many tiers in the Web content management marketplace:

• Enterprise solutions, examples of which include Vignette, Documentum, Interwoven, and Stellent.
• Mid-level solutions, examples of which include Red Dot and Percussion.
• Small business solutions, examples of which include offerings from Microsoft, Ektron, and others.
• Open source solutions, examples of which cover the wide range of markets.
• Hosted solutions such as those from Atomz and CrownPeak.

Many manufacturing companies are small and mid-sized businesses whose technology needs span both information technology and the process technology for their core business. Because of this, not every small company can develop its own sophisticated Web presence. As a result, industrial search engines such as ThomasNet, GlobalSpec, and Kellysearch have emerged to fill an important market need. 

Conclusion:

The manufacturing marketplace is a large and active marketplace that is driven by e-Commerce solution providers where content management has a vital role to play. However, many manufacturing companies are small- and medium-sized businesses, where IT is only one kind of investment competing for capital. 

Because of these structural constraints, content management is not always the highest priority for these companies, even though they clearly need, at minimum, Web content management to support marketing and sales efforts. Moreover, many of the content management offerings are priced well beyond what these companies would be willing to spend. The enterprise solutions really are only for the biggest organizations, and even companies that sell mid-market content management solutions will tell you that they are selling to the Global 2000. This leaves many companies—indeed, most manufacturing companies—out of the target market for many content management technologies.

Article Summary:

The main driver behind EAI (Enterprise Application Integration) when it emerged in the mid-nineties was the need to integrate content and transactions for e-Commerce. The revolutionary benefits of e-Commerce that were promised assumed that back-office marketing, product data, inventory, and transaction systems were all integrated and kept up-to-date, but the industry’s dirty little secret was that such integration either didn’t exist, or was extremely fragile and unreliable. When e-Commerce actually worked like it was supposed to, it was almost prohibitively expensive.

Web Content Management System - Part 2

Security Concerns And Precautionary Measures:

As we have shown, a WCMS is an application built on top of existing web technology by web development companies. Like other web applications, a WCMS is subject to the same security threats and operation process vulnerabilities as other web applications. In this section, we discuss the common security concerns and ways they can be mitigated.

Security Concerns 

Given that a WCMS is a software application, it is prone to bugs just like any other program. Vulnerabilities have been found in WCMS. As one example, a vulnerability called “absolute path traversal vulnerability” was found in the open source product OpenCms in 2006. This flaw would allow remote authenticated users to download arbitrary files3. 

Another security concern lies with protection of authentication credentials when accessing a WCMS. Many WCMS products are designed primarily to solve the content management problem of websites rather than building a secure product. Some WCMS products do not provide adequate protection for logins and passwords for example, and these passwords— including the administrator password—are sent as plain text over the network.  

Similarly, as part of the publishing/uploading process, a WCMS might use file transfer protocols such as FTP to transfer files from the WCMS data storage server to the web server. FTP is not a secure protocol in the sense that authentication credentials and passwords are sent as plain text over the network. In addition, because publishing is an automatic process from the WCMS to the production web server, FTP credentials might be hard-coded in certain configuration files. Usually a hard-coded login password like this will not be changed regularly. As a result, any leakage of this password could allow someone illegally access to web content on the production web server. 

If the WCMS includes other modules, individual subsystems may have their own bugs and introduce their own vulnerabilities to the WCMS. For example, if the WCMS has an email module, it might be prone to the same common threats faced by email server such as email spoofing. On top of this, the backend database server of the WCMS may have its own vulnerabilities as well.

Precautionary Measures

There are a number of precautionary measures that should be done proactively to mitigate the security threats identified above:

1. Follow best practices by applying the latest security patches to all web server software. Any alerts or warnings about vulnerabilities on the WCMS product being used should be addressed immediately, especially if the WCMS can be accessed directly from the Internet. Any patch management process should also address additional WCMS modules, including email subsystems, backend database servers, JAVA runtime environments, and so on.
2. A strict password policy should be defined. This should include a minimum password length, initial assignments to personnel, restricted words and formats, and a limited password life cycle.
3. Logins and passwords sent over the Internet should be protected by SSL / TLS, so that attackers can’t sniff them over the network. In general, access to administration pages should be further controlled and these should not be open to Internet access.
4. When publishing any web content from the WCMS to the production web server, file transfer programs such as FTP should be replaced by a Secure Shell (or SSH) that protects transmission channels by encrypting data. Some SSH implementations also support a feature that controls which IP addresses are allowed to connect to the destination server. 
5. To enforce data security, many WCMS implementations have built-in access control whereby groups of users are segregated into editor and administrator (approver) roles. These roles and their corresponding access rights should be clearly defined and reviewed periodically. 
6. A good WCMS should keep an audit trail, logging all editing and approval activities. These audit trails should be retained for a period commensurate with their usefulness, and should be secured so they cannot be modified and can only be read by authorized persons.

Conclusion:

While a good WCMS can facilitate businesses to better control their web content developed by web development companies, making it more responsive in today’s dynamic business environment, end-users should also be aware of the possible security impact on the enterprise.

Article Summary:

A Web Content Management System (WCMS) is a web application that facilitates a group of users, usually from different departments in an enterprise, to collaboratively maintain and organize the content of a website in an effective manner. Over the past few years, web content management systems have grown in importance as more and more organizations communicate and publish their information via the web. Like other web based applications, WCMS’s applications are exposed to the same set of common security threats found in any network and web-based operation or process. In this paper, we will outline the common security concerns of WCMS, and provide a number precautionary consideration.

Web Content Management System - Part 1

Web Content Management System:

Since the dot-com boom of the late 1990s, corporate websites have become commonplace for almost any type of company, large or small, across the globe. Almost every enterprise these days needs a website to communicate with customers, partners, shareholders, and so on, providing up-to-date information on the enterprise, its products and services. Increasingly, commercial activities and order transactions are conducted on enterprise websites. These can be developed by web development companies.

The Classic Approach to Web Content Updating:

Building and setting up a website is not a one-time project. Different departments in the enterprise will have areas of content they need to add to and update. Plus, websites have to be maintained and updated on a regular basis due to the dynamic nature of modern business.

In the early days of website maintenance, the task of uploading and updating site content usually fell to the IT department. One method for uploading web content to the server was to use file transfer programs such as FTP (file transfer protocol). Another common approach was to create an upload function within a Web interface allowing different content owners to select appropriate files and upload them via HTTP. Both methods are common, and still used by web hosting companies and small & medium enterprises (SMEs).

Problems With the Classical Approach:

Traditionally, technical staff would have to assist a content editor who needs to update a site by translating the content into a suitable web page format (i.e. HTML) and uploading it to the web server on their behalf. This iterative process often led to delays in publishing, and is obviously not an efficient process given the high mutual dependence required between the content provider and the technician.  

Managing the website updating process is another problems with older approach. Sometimes a web page may consist of several content areas that require input and material from several different enterprise departments. When more than one person is able to update web pages simultaneously, the problem of logging and tracing “who has amended what” and “what the latest version of a page is” becomes serious.  

Web Content Management Evolution:

The Web Content Management Systems (WCMS) that have appeared more recently are designed to tackle these problems, and make it easier to collaboratively update a website which is developed by web development companies. A WCMS is a web application that facilitates a group of collaborative users, usually from different departments across an enterprise, to maintain and organize web content in an effective and manageable way. Web content can include text, images, audio and video. A modern WCMS can also include workflow features so that the creating, storing, and updating of web pages, along with approval sub-procedures, can be streamlined.  In addition, features such as versioning, check-in/check-out auditing, and so on are useful for managing and tracking the updating of web pages.

Impact And Business Trends With WCMS:

Commercial WCMS products have the following benefits:

1. Quicker response times: making new web content such as marketing materials available on the web is much quicker because content owners can update materials to a website directly, without the need to assign such tasks to technical personnel;
2. More efficient workflows: requests for changes and updates to a site are simplified under a WCMS framework. Users across different departments can add and apply changes to web content with a pre-defined and agreed upon workflow process.
3. Improved security: under a WCMS framework, content is only published after approval by designated supervisors or managers. This reduces the chance of publishing material by mistake, which is usually due to human error. In addition, most WCMS systems provide audit trails of publishing activities all of which help maintain accountability;
4. Other benefits include improved version tracking, integration with translation servers, and consistency of page presentation through the use of common page layouts and controlled templates.

Web content management has grown in importance over the past few years, and commercial as well as open source WCMS products are now available on the market.

The Common Components Of WCMS:

Many WCMS are programmed in languages such as Java and PHP by web development companies, and run on a web server. In addition to the web server, WCMS may also contain additional components such as workflow engines, search engines, and email integration modules.  

Web content and data is normally stored in data repositories or databases such as MySQL (open source) or Oracle (commercial). This could include text and graphic material to be published. Older versions of web pages from a particular site under management may also be stored in the database. 

Generally, draft web pages are not uploaded directly to the production web server. Instead, users keep copies of draft pages offline until they are approved for publication. Then, once approved and signed-off, a file transfer program runs automatically, uploading and linking in the final pages on the production web server. 

A WCMS is essentially a web application supported by a backend database, with other features such as search engine, and perhaps integration with a translation engine. The general security threats applicable to web applications, such as cross-site scripting, injection flaws and/or malicious file execution, can all be applied to a WCMS.  

For the purposes of accountability, users normally need to be authenticated before they can access the WCMS. In some situations, users authenticate via an intermediate server called a reverse proxy server, instead of connecting directly to the WCMS server. In addition, content duties are segregated by dividing users into two groups—content editors and content administrators—where only content administrators have final publishing authority. The role of technical personnel would be in building web page templates and maintaining the consistency of web page layouts and a common look-and-feel.

Generally, data and content sent to a web server is considered public information. If it is necessary to store sensitive information on WCMS servers, appropriate data encryption and authentication measures should be put in place.