Equifax Breach Shines Light on Common Web Vulnerabilities

If you’ve been living off the grid or hunkered down to avoid the wrath of mother nature, you might have missed the big news from last week. Equifax, one of the big 3 credit reporting entities in the United States, reported a security breach of epic proportions.

The breach involved Personally Identifiable Information (PII) for roughly 143 million people in the US alone, or close to 1 in every two people. Data lost included names, birth dates, and addresses, but also extended to social security numbers, credit card numbers, and in some cases driver’s license numbers.

To exacerbate the problem, Equifax’s handling of the response and notification has also consumers and experts alike concerned with their ability to address the issue. In fact, the incident is so severe, and the management of it so questionable, the House Financial Services Committee will be holding hearings to gain a better understanding of what this means to consumers and the country.

What might be the most damning, however, is how the breach occurred. Currently, signs point to Equifax having fallen to one of the most common security vulnerabilities known – a SQL injection.

Yet, while a company entrusted with the wealth of personal information that Equifax had stored on consumers should have taken greater precautions, hacks like these are called common for a reason. Many companies fall prey to them. Others don’t even know they should be testing for them. And still, more rely on a single point of failure – a developer – to be the one to hold back the tide of hackers trying to get at your company’s data.

So, what are the most common web vulnerabilities your company should be looking for? And how do you effectively, and consistently, ensure the security of your data?

Top 5 Common Web Vulnerabilities

While not a complete list, these are some of the most common – and therefore, serious –  vulnerabilities in web applications.

Authentication Issues and Session Management

HTTP does not provide functionality for user authentication and session tracking, so this must be handled by the web applications. Because of this, developers must be vigilant to ensure that session data is encrypted at all times, otherwise, it provides opportunities for hackers to hijack a user’s session during an active session.

Cross-site Request Forgery

With a cross-site request forgery, a third-party site attempts to request access to a web application that a user is already authenticated to. Examples are social media sites, financial institutions (banks, credit cards sites), and email clients. Once access is obtained, the malicious site can then access functionality on the authenticated site, wreaking havoc on bank accounts and through email.

Security Misconfigurations

With the complexity of applications that are part of a web application ecosystem, it’s important that users and processes have the minimum security access that they need to get done their intended tasks. Unfortunately, either because of a lack of resource training or through systems allowing access to more data than is needed, processes and accounts may be able to see data or perform actions that they should have access to. Because of this, a malevolent user, or someone who can access a user or process account, can perform harmful actions that they shouldn’t be able to otherwise gain access to.

XSS – Cross-Site Scripting

Validation is an important part of user submitted data when it comes to the security of your application. In a cross-site scripting attack, client-side scripts are injected into a site and can execute on pages that are dynamically generated leveraging user-supplied data can be at risk if the information isn’t validated. As a result, users can be redirected to a malicious site that appears like the original site or their sessions can be hijacked.

SQL Injections

It’s believed that a SQL injection is what was used in the Equifax breach. Like a cross-site scripting vulnerability, SQL injection can occur when data coming into the site is not validated. In these cases, user-supplied data is input into a web application, but without data validation, a malignant SQL query and commands can be passed directly into the database. Equifax isn’t the only large company that has fallen victim to a SQL injection attack. The PlayStation breach of 2011 was also caused by SQL injection.

Strategies for Protecting Your Data from Common Web-based Threats

The good news is that most of the most common attacks are easily taken care of with education, testing, and consistency.

Developers, system administrators, and security staff should be well-trained to be aware of best practice for web application security. Knowing when encryption should be used on data, and how to minimize exposure to data through access control, can reduce system exposure to outside entities.

Education can also ensure that data cannot be injected into the site through foreign scripts or malicious SQL code passed through web application form elements. When developers are taught to limit form inputs and validate data, at least one attack vector is minimized.

But the entire burden shouldn’t be placed on the shoulders of the developers. While application testing is done, boundary testing – in other words, testing beyond what the expected use of an application is – can identify areas of potential vulnerability.

Beyond the areas of education and standards, though, regular full site testing can be invaluable. Penetration testing on applications that have access to sensitive data can inform improvements that need to be performed to secure your site. While internal teams can perform regular penetration tests, periodic testing and security audits by an outside partner can provide invaluable insights that might otherwise be overlooked.

Simple oversights in web application security can have devastating results, as the Equifax breach has shown. A common vulnerability can be easily exploited by hackers and cause life altering effects on millions. But even if your company doesn’t deal with the same level of sensitive data, you have a responsibility to your users and the enterprise to protect the data stored on your systems. Vigilance, education, and awareness are the greatest tools at your disposal to protect your organization from outside attacks.

The post Equifax Breach Shines Light on Common Web Vulnerabilities originally appeared on the Curotec Blog

4 E-Commerce Feature You Didn’t Know You Needed

E-commerce continues to grow at a rapid pace. If you’re thinking about starting an online storefront or adding the ability to purchase your products online in addition to a brick and mortar store, you’ve probably already considered some of the most common features that you’ll need.

Some of these features may include an easy way to add new products, the ability to quickly set up your storefront, the ability to set up sales and specials, store analytics, and integrations with payment providers.

But there are features that you may not be considering that can be just as important as the ability to import your products. Below we’ve called out 4 e-commerce features that you may not have thought of, but that can take your business to the next level.

 

An Extensible E-commerce Platform

When you first set up your e-commerce site, it may seem like the platform you’ve chosen has everything you’ll ever need. But you should take a step back and review what your company might need in the future, or at the very least understand that what you need today might not be what your customers will demand from you tomorrow.

Since it’s unlikely that you have a crystal ball to know what that might be, your insurance against your needs outgrowing your platform is to choose one that is extensible.

What does that mean? It means that you’ll be able to add functionality to your platform without having to bring in an expert to make significant changes to the core of your e-commerce platform. This not only allows you to add functionality as it becomes relevant, such as fraud protection, mentioned below, and customer service software, it also allows you to respond to your market as the needs of your customer base change. Additionally, it can allow you to amp up the security on your site by adding new innovations as they become available.

 

Open Source E-commerce Implementation

While having a site that is extensible means you can add pre-built components to grow your business and your platform’s functionality, choosing an open source e-commerce solution means that you can make your storefront into anything you want, with a little help from a knowledgeable technology partner.

Because open source software provides the code that makes up the platform’s functionality available, a skilled technology partner can help you change or add functionality to your storefront that may not exist otherwise. If you’ll need specialized functions to make your storefront the best it can be, going open source can be the most robust means of ensuring you get exactly what you want.

Remember, though – open source may not mean free. Some companies still charge for their platform, but once you are a licensed user you have access to the underlying code.

 

Integration with Fraud Protection

Payment processing is a no brainer for an e-commerce site. But with e-commerce fraud on the rise – fraud rates in 2016 were 33% higher than those a year earlier – you need to consider protecting those purchases as much as being able to accept them.

E-commerce sites typically leverage the Card Verification Value (CVV), located on the back of the credit or debit card, as a step toward ensuring a transaction is valid. But CVV verification is only a first step toward fraud prevention.

Outside services, like ClearSale, provide modules that can be used with various e-commerce platforms that can help verify the validity of a charge as well as identify the likelihood that a particular transaction may get charged back – something known as “friendly fraud”.

 

Ability to Connect to a 3PL

As your business grows, your ability to manage inventory, order fulfillment, and shipping management, along with your business will diminish. It’s at this point that many e-commerce retailers look to 3PLs for assistance with the inventory and order fulfillment needs.

A 3PL – or third-party logistics provider – can manage these elements of your business for you, providing you with benefits like reduced shipping time and cost, updated and streamlined warehouse procedures, and inventory adaptation and management based on demand.

However, adding a 3PL to your online retail business will provide fewer positives to your business if you need to manage orders directly. Instead, a direct integration to your 3PL will allow orders coming in from your website to flow seamlessly into your order fulfillment systems with your third-party logistics provider.

If you’re just starting out in the online retail space, some of these concerns may seem far reaching. But as your business grows, you’ll be glad you took the time to plan for expansion. Overhauling your e-commerce site shortly after setting it up is a frustrating experience and one that can be avoided when you consider a few additional features that will free to you to grow and build your business.

The post 4 E-Commerce Feature You Didn’t Know You Needed originally appeared on the Curotec Blog

You’re Already Soaking in it: Brownfield Software Development

The definition of brownfield software development is the development and deployment of new software and systems in the presence of existing and legacy systems.

Sound familiar? That’s because unless you’re part of a brand new startup, you’re already doing this. It’s the reality for anyone working in an enterprise IT environment.

If we were all working within our “happy path” plans, we’d be able to develop new software and systems that immediately worked with our existing ones, and integration between system would be easy. But just like a 15-year-old car doesn’t have built in GPS, neither do legacy systems operate in the same way as new software.

Brownfield development must take into consideration how it will interoperate with the existing systems to prevent causing more problems than the new software solves.

What is Brownfield Development

The term brownfield is borrowed from the construction industry. Brownfield land describes a new building location that, in the proves of planning and construction, must take into account the area’s existing structures and work around those to prevent causing problems.

The value in brownfield development is that it extends the in-place systems. The critical piece is context – to understand the environment that the development is being done in so that it doesn’t disrupt current software operations.

To gain this value, however, the project cannot be planned or executed in a vacuum.

Brownfield vs Greenfield

Many software projects assume a clean slate, or what is alternatively called a greenfield development environment. Requirements are gathered, schedules developed, and software is built.

Greenfield software is developed under the pretext that it is either standalone or that the system it will be inhabiting is clean a fresh. These kinds of projects are, for obvious reasons, extremely rare.

When projects must be developed in the presence of legacy applications, ignoring existing applications to develop a new application only adds technical debt to what is likely already overloaded IT schedules and resources.

When planning a new application within an existing ecosystem, gaining an understanding of the touch points between it and the applications it must touch is only part of the project’s considerations. The effect that the software will have on the system must be taken into account as well. End to end clarity of the enterprise architecture and the new application’s place within it can reduce the negative impact of its development.

Strategies for Brownfield Application Development

 

Bring Together the Right Resources

When executing a brownfield software project, having the right brains considering the problem is the first step to success.

Go beyond those that will build the application and include on the team those that have an understanding of the bigger picture. This should include:

• Enterprise Architects – provide an end to end understanding of the systems
• Business owners – keep requirements on track
• Stakeholders – ensure the application being built is providing value
• Subject Matter Experts of adjacent products – will provide insight into the inner workings of other applications

These team members should be included throughout the initial planning process. If you’ve engaged an outside firm to help with the development, make sure they are also included in these planning meetings.

Create a Minimally Viable Product

Based on the agreed upon requirements and business needs, the team can begin building what is known as a minimally viable product.

By creating an application that accomplishes a minimum set of functionalities and placing it within the ecosystem, a better picture is gained around both the effect it will have on the systems and the unforeseen challenges of integration.

This requires building a product that actually works – this isn’t a proof of concept to be thrown away after. Instead, this product will be what future iterations will be built upon.

Investigate Modern Integration Methods

As your application goes through planning, you may discover that it needs to communicate with others in the ecosystem or access data from other parts of the system. While you may already have integrations between applications in place, this may be the time to re-evaluate the value of how you connect those applications.

These choices should be part of your early planning as they can impact your application design. Consider the following integration and application design patterns:

• Point to Point: These integrations allow two applications to communicate, but are not flexible. However, they are rapid to develop and work well depending on the number of integrations needed in an ecosystem
• APIs: Application Programming Interfaces, or APIs, are flexible connections between applications, allowing them to use functionality and data from far reaching software
• Microservices: Microservices take API designs to the next level. Building loosely coupled services increases application interoperability

The likelihood is you’re already building in a brownfield application environment. But you’re also probably approaching your projects like they are greenfield endeavors. Stop ignoring the intricacies of developing against existing applications and instead include the resources and strategies to launch a successful software project.

The post You’re Already Soaking in it: Brownfield Software Development originally appeared on the Curotec Blog

Does My Custom Software Project Really Need a Business Analyst/Product Manager?

After considering the benefits and needs, vetting development firms, and finally choosing the right partner, you’re ready to start your custom software project. You discuss the project with your software partner – you look at time, budget, resources. And you notice something.

Among the developers and testers assigned to a project, there is a line item for a business analyst/product manager. You immediately wonder why – you’ve made the need for the software clear, and explained why you’re going to both the trouble and expense of having it built. Why add another body to the project?

A BA or product manager may seem like an unnecessary expense, but in truth, the inclusion of this role on your project team can save you money and leave you with a better product that better meets your business’s unique requirements.

What Does a Business Analyst or Product Manger Do?

It’s first important to understand that in the context of custom development, these roles can be very similar. Or, in actuality, you can view business analyst as a subset of what product managers do. While this is not true with large development projects with extended development cycles, or even for mature software, in the case of a custom development project a product manager can do both.

Certainly, Agile purists could make a case for separating the roles, in most cases for smaller or contained products the roles overlap and can be managed by a single resource.

But what exactly is it that they do?

To begin with, they work to understand the requirements of your project. Again, you may think that you’ve already outlined what it is you need. But with experience and skill, the product manager or BA digs deeper to assess the need.

You may see a single functional element that needs to be addressed with your new software product. The product manager or BA is trained to speak with stakeholders and understand the real problem you are trying to solve. It may be larger or smaller than you realize.

This allows them to validate the requirements to make sure that the development team isn’t building a much larger solution than you need – which wastes money and time – or a much smaller solution – which prevents you from actually solving the problem you started out to address.

They will lead discussions with stakeholders, ensuring that meetings and discussions on the requirements don’t drift into unrelated or tangential topics or dead ends.

They also act as a bridge for stakeholder to stakeholder relations, and for business to developer discussions. They can mediate between stakeholders who can have competing needs. Plus, a core function of a product manager or BA’s job is to represent the customer throughout development. This safeguards that the developers are building the right solution for the business need.

In the end, the product manager or BA is the one team member who has the business’s needs and requirements in mind that and involved throughout the entire project. They provide a single, holistic view, representing the business but understanding the technical challenges.

The Benefits of a Product Manager or BA on the Project

A few of the benefits of having a product manager or BA on a project are hinted at by their responsibilities, but their contributions go far beyond what their role implies. The benefits of having them involved can be placed into two, overlapping categories – project efficiencies and cost reduction.

Project Efficiencies

Because of the product manager or BA’s holistic view of the entire project, and their contact with business stakeholders, they are in the unique position to identify additional functionality that may be required to make the project successful. It may be minimum effort to add functionality to your solution that will significantly increase the value of the software to your organization.

With a deep understanding of the need for your custom software solution and the business challenges it will address, the product manager or BA can prioritize the functionality to guarantee that the most important functionality is prioritized above the nice-to-have features.

They will also have a view of the project, the resources, and an understanding of when the needs of the software shift as your business adapts to change. Change management can be a critical part of a project, incorporating new information into the process and keeping it moving forward while also keeping their eye on the important pieces of the solution.

Cost Reduction

With a complete view of the business need and the IT resources, the product manager or BA can help to guide the development team in creating the right functionality from the start, instead of creating re-work because of a missed or misunderstood requirement.

Because they represent the client to the development team and have a broad view of the solution, their role allows them to identify functionality being built that may conflict with later work. This is invaluable to both the client and the development team. Product managers and BAs can see the whole picture, and understand how that fits in with the intended solution.

At first glance, it may seem that a product manager or BA is a superfluous member of a custom software development project. But through their role on the project, your solution will be developed efficiently and cost effectively, and meet the critical needs of your stakeholders. The benefits of having a Product Owner or BA on your project more than pays for itself.

The post Does My Custom Software Project Really Need a Business Analyst/Product Manager? originally appeared on the Curotec Blog

The Importance of Integrating with Your 3PL Partners

Ninety percent. That’s how many domestic Fortune 500 companies rely on third-party logistics (3PL) providers for supply chain services and outsourced logistics, according to a new report by supply chain consultancy Armstrong & Associates.

That number alone is impressive, but it becomes even more astonishing when you compare it to Amstrong’s previous report from just 3 years ago. The report from 2013 found that 46% of the Fortune 500 partnered with a 3PL. This significant increase makes one thing very clear – partnerships with 3PLs are here to stay, especially for eCommerce logistics.

Given that third-party logistics aren’t going anywhere it makes sense to ensure that your processes with your 3PL provider are as efficient and as seamless as possible. Automation of order processing is one way to ensure that orders happen quickly and without errors.

Implementing an integration between your organization and your 3PL software is a cost worth investing in, saving you time, money, and even your reputation.

Resource Savings with 3PL Integrations

The first benefit that immediately comes to mind when talking about automation with your logistics provider is a lesser need for resources. It also means a reduced need to train team members on data entry systems. Whether you have a staff that is dedicated to order entry and management, or resources that manually handles this as one facet of their job, an integration can free up those man hours for other tasks.

Integrations Provide Visibility to Inventory

An integration with your supply chain partners can provide more timely updates to inventory levels. By having a more up-to-date understanding of what you have, and what you need, there is less risk of overstocking an item or running out. This not only helps you provide better customer service but also keeps tighter control on your cash flow. With an integration, you’ll have the data you need to pull accurate reports across your entire product line.

Manual Entry Errors Can Cost Real Money

Manual entry errors are a fact. There is no getting around it. According to the book Purchase Order Management Best Practices: Process, Technology, and Change, errors occur an average of once in every 300 keystrokes. Depending on the complexity of your SKUs, that could be as many as one errors every 7 to 8 orders.

This translates into hard dollars that can be lost as a result. Returns cost online sellers between $6 and $18, and that doesn’t include items returned because they were damaged or otherwise delivered in unsaleable condition.

Validating manual entries is a means to reduce costs, but there are still dollars associated with quality checking order entry. Keep in mind the 1-10-100 rule for data entry – in essence, it costs $1 to check data entry for accuracy, $10 to clean up incorrect data entry, and $100 for errors that get through the system.

With an integration to your 3PL, manual entry is all but eliminated, and any errors can be traced either to the customer or a consistent programmatic issue that is both predictable and easily remedied.

Manual Entry Errors Can Hurt Your Reputation

At a time when a good word on social media can boost sales, and a poor review and make them plummet, your reputation is a critical piece in acquiring and maintaining your customers. So, it should come as no surprise that high error rates as a result of manual order management can take a toll on that reputation. An incorrect or poorly managed order or return can result in lost sales as quickly as being out of stock on an item or incorrect pricing.

As above, an integration can significantly reduce errors in your supply chain and order management process, helping you provide consistent order delivery and customer service.

Fulfillment Efficiency

Several studies have shown that the speed and efficiency of your supply chain can have a direct impact on customer satisfaction. When orders are managed manually, data entry times can be inconsistent. Additionally, a manual system has an upper limit, and scalability depends on resourcing.

An automated solution, even one that is batch processed, provides consistent and hands-off uploading of your orders to your 3PL. Orders can be handed off to your supply chain partners even on holidays or in the middle of the night.

Many eCommerce vendors prefer to leave the order handling to the experts, partnering with a 3PL for logistics. But to fully take advantage of the value to your business, vendors should consider implementing an integration between their systems and their partner’s. Automated order processing and management will save you time, money, and improve your customer’s satisfaction.

The post The Importance of Integrating with Your 3PL Partners originally appeared on the Curotec Blog

Recognized as a Top 10 Philly Company

Curotec is a top 10 Philadelphia web designer on Clutch!

Clutch is an independent tech research firm based in Washington DC. They are a research, ratings and review platform. Their research methodology is based on client interviews, market presence, clientele and experience. According to Clutch, we “more than proved our commitment to providing exceptional service for our clients”. If you want to learn more, you can read our success stories and client interviews.

Curotec was featured as a top 10 web designer for Philadelphia yesterday in a press release sent out by Clutch. We were celebrated for our technical expertise, business acumen, and commitment to our clients. Clutch also reached out to Brian Dainis, founder and CEO of Curotec, to share his thoughts on popular CMS’s.

” Analyzing your users, and traffic patterns, understanding how they use your site and where your traffic comes from…We analyze stuff like that. We look at Google Analytics. We set up conversion funnels. We do multivariate and A/B testing to really get to the actual user experience that converts the best. So, just understanding all that stuff, where your traffic comes from and how you can maximize it. “

Brian shared his thoughts on the efforts that go into constructing powerful websites for our clients and it is an honor to be recognized for our detailed efforts and processes that go into crafting the best solutions. Curotec is growing quickly, but we are always committed to delivering great work for our clients, every single time.

The post Recognized as a Top 10 Philly Company originally appeared on the Curotec Blog

The Next Evolution of Commerce – Contextual Commerce

As long as there has been the human idea of trade, there has been someone willing to sell you something you need or want in exchange for something you have. At one point, it was grain for cattle, or cotton for tobacco.

Permanent settlements led to brick and mortar stores, who held their own for hundreds of years. But once the internet arrived, all bets were off. We’ve rapidly advanced in the last 15 or so years from brick and mortar, to eCommerce, to mobile commerce, to omnichannel, each providing consumers with increasingly convenient shopping experiences.

The next evolution of commerce is upon us, and it’s important for both brick and mortar stores and eCommerce companies to take notice of. That evolution is contextual commerce, and it takes the idea of convenience to a whole new place.

What is Contextual Commerce?

Contextual commerce is really the holy grail of commerce. It’s being there when your customers are when they need a product you offer. Put another way, it’s in-the-moment shopping. No lists, no trying to remember anything. It’s purchasing what you need, or what you want, the moment you realize you need it.

This isn’t a new concept for retailers. Walk through the parking lot on the way into a baseball game, and there are trailers set up selling jerseys. At concerts, you can buy copies of albums and band t-shirts. Walk down a street on a hot day, and a young entrepreneur has set up a lemonade stand. In the moment you are thirsty, you want to support your team, you’re excited about the band, there is a retailer there, providing what you wanted.

Technology, however, has enabled contextual commerce at a whole new level. Instead of betting that someone will want a jersey, you can suggest one to someone who is near a ballpark, thanks to GPS. With IoT devices, you can re-order laundry soap while you’re standing at the washing machine.

For eCommerce, contextual commerce comes on the back of what Google calls “micro-moments”. As the search giant describes it “Micro–moments occur when people reflexively turn to a device—increasingly a smartphone—to act on a need to learn something, do something, discover something, watch something, or buy something. They are intent-rich moments when decisions are made and preferences shaped.”

Contextual Commerce is Already Out There

Given that contextual commerce isn’t a new concept, it’s no surprise that there are already a lot of examples of it in use. The current players in the space are no surprise, either.

Pinterest is a clear choice for purchases in the moment. The social media sharing site is all about pinning pictures of projects, images, and yes, products, that their users find interesting or want to remember later. And previously, a Pinterest user who saw a pin of something they wanted to buy would have to click on the item, go to the eCommerce site, add it to their cart, enter their payment information, and check out. But Pinterest is now leveraging technology from Braintree that allows the entire commerce experience to happen within the site. Pinterest doesn’t lose you to another site, the merchant still gets the sale, and the user gets a more seamless buying experience.

WeChat, the Facebook of China, is another example. As the most advanced and largest contextual commerce platform out there, it’s the prototype for several social media platforms that are playing catch up, including the aforementioned Facebook. WeChat goes beyond simply offering the ability to purchase something through their interface, but takes contextual commerce to the next level, allowing it’s 900 million users to call a taxi and execute peer-to-peer payments.

A little closer to home, Amazon has fully embraced the idea, leveraging context purchases in a number of ways. The Amazon Dash buttons are the ultimate in convenience. Place the Dash near where you use a particular item. When you’re running low, simply push the button on the IoT device. It places an order for that items and uses your chosen preferred payment method to process it.

Owners of the Amazon Echo can say “Alexa, what are today’s deals?” and get a list of the current featured items from the site on any given day. Taking it one step further, you can then use your voice and the Echo to purchase one of those items.

And it’s not just about purchasing from Amazon. Hungry and have an Echo. Enabling the Pizza Hut skill lets you use your voice to place your usual order. You don’t have to get off the couch, or even pull out your cell phone.

Business Systems Needed to Support Contextual Commerce

Contextual commerce doesn’t just happen. And it doesn’t just exist on someone’s phone or watch or other IoT device. It must be backed by business systems robust enough to handle the automated ordering from anywhere at any time.

A frictionless payment experience requires not only a payment service that can handle storage and processing of various payment types. It must also be secure, as the checks between selecting an item and purchasing it are removed in an effort to streamline the process.

For those that have not yet integrated their logistics and fulfillment systems with their eCommerce or ERP, contextual commerce may provide more of a headache than a revenue boon. Manually processes between these systems would only increase with a contextual shopping experience, leading to customer frustration and a poor experience.

The same is true for your customer service, returns, and issue tracking systems. A purchase experience that is seamless, followed by a cumbersome and difficult returns process leaves the impression that you’re happy to take the customer’s money, but loathe to give it back when appropriate.

After hundreds of years of few if any changes to commerce, the last 15 years have catapulted the industry in new and not unexpected ways. Like those who delayed in adopting eCommerce for their brick and mortar stores, hesitating to join in on the contextual commerce evolution may leave you playing catch up in just a few years. But having the right systems and integrations in place is critical to having a satisfying commerce experience.

The post The Next Evolution of Commerce – Contextual Commerce originally appeared on the Curotec Blog

Curotec Recognized on Clutch

Curotec is proud to announce that it has been recognized on Clutch.co as a firm that delivers. Clutch is a B2B ratings and review firm based in Washington DC. Their users come to them for high-quality research on the top service companies or software solutions from all over the globe. To be included in their research is a testament to the exceptional service that Curotec provides for its clients.

Clutch’s research methodology is based on verified client interviews as well as an ability to deliver on projects. Check out a brief sample of what Curotec’s clients have said.

“We were most impressed with Curotec’s ability to provide solutions to complex challenges. They thought of everything, from having the smallest word in the smallest corner of the site translatable to building a huge backend infrastructure that would be able to manage multiple countries and languages, to getting us closer to impacting conversions on a non-e-commerce site. The infrastructure development was robust and complex, but it ran smoothly. The finished deliverable was a home run for us.”

 

“I’ve had nothing but positive experiences with them.”

To be featured on Clutch is to be recognized as a superior service provider for our clients. To see more examples of the great service we provide for our clients take a look at our profile on Clutch and our successes on our site. We look forward to continuing to provide exceptional enterprise software solutions for you.

The post Curotec Recognized on Clutch originally appeared on the Curotec Blog

How to Avoid an Epic Outage Like AWS’s

At the end of February, Amazon cloud service, AWS had a major outage. The outage caused some very high profile sites to go down, including Netflix, Reddit, Quora, Medium and even some government sites.

Overall, AWS service is extraordinarily reliable, and no service has 100% uptime. It’s not surprising that AWS eventually had an outage. What is surprising is the initial cause of the outage, and why recovery took so long.

The outage itself was caused by simple human error. An engineer working on a bug in the billing system took more servers offline than were needed. Unfortunately, like a set of dominos, the additional servers going down took more, and then more.

But that’s not where the story ends. Because so much of the system went down, the systems required full restarts to recover. It was these full restarts that had the systems down for multiple hours.

Amazon has said that they will be adding in additional safeguards to prevent this kind of issue from occurring again, certainly at this magnitude. They are taking the healthy and most appropriate path out of the problem. They are looking closely at the issues and finding ways to correct them so they never end up in the same place again.

And while Amazon should be praised for facing the problems that set them up for the massive outage, they are Amazon, the premier cloud service provider with a global presence. Thanks to their near constant up time, they can take a hit like this and not see significant damage to their bottom line.

In the same situation, though, you may not be so lucky. A time like this is the perfect time to think about your own system maintenance and outage plans.

Less than Disaster

Typically when we in IT talk about outage planning, we talk about disaster recovery. Don’t get me wrong, disaster recovery is a good thing and a worthwhile investment. If you don’t have a disaster recovery plan, you’re rolling the dice.

But we usually equate disaster recovery with exactly that – a disaster. Hurricanes, earthquakes, massive cyberattacks that cost you terabytes of data – these are the kinds of things mentioned in many disaster recovery documents and presentations.

Not to be dramatic, but for smaller companies, and even mid-sized enterprises, being down for a few hours at the wrong time is a disaster for your organization. If you’re a retail organization and you go down for half a day on Cyber Monday, well, that’s a disaster. If you’re a university and your registration system goes down just as registration opens, that’s a disaster.

Any outage during a peak business time can mean significant trouble. It’s why large IT organizations have blackout periods for new software releases during critical business periods. It’s not worth the risk.

And that’s what we’re really talking about here, risk management versus disaster recovery. For instance, think for a minute about driving your car. Risk management is like obeying traffic laws and driving defensively. You’re doing what you can to avoid getting into an accident. Disaster recovery is like car insurance. When the unexpected happens, you’re glad you have it.

Having a disaster recovery plan but not a risk management plan is like driving recklessly, all the time because you have car insurance.

Managing the Risks

Depending on the special needs of your organization, risk management can mean a number of things. That’s because it’s specific to your business risks. That retail organization in the above example will have some risks that are different than the school, and some that are the same.

What’s really important when looking at risk management is acknowledging that it’s a process that involves problem identification, fixing what you can and planning for what you can’t.

Those in an ITIL or COBIT managed organization are probably familiar with the problem identification piece, and likely even participated in fixing some issues. But organizations shouldn’t stop there and hope that they’ll never have to deal with the problems associated with something you can’t fix.

Let’s take a quick look at an, admittedly, forced example.

In our example, your teams are evaluating the potential risks of their systems going down. They identify a system that takes 5 hours to completely reset, based on all of the server dependencies and additional processes needed to restart everything involved with that system. This is the identification phase.

The teams go through and find ways to reduce that reset time by removing out of date dependencies and better aligning parts of the systems that can be reset in tandem. Maybe they need to update old software or perform patches that were slowing things down. They have fixed part of the risk.

But this leaves a 3-hour window where your system may be unavailable in the event of an unexpected system restart. Maybe that’s fine if it’s in the middle of the night. But that never seems to be when critical systems go down.

Some companies stop here and just assume they have done what they can. Instead, take the time to consider any potential workarounds. Is there another system that can take up the slack? Can customers be offloaded to your call center during the outage? These may be quick and easy ways to address the downtime.

Perhaps it’s a more critical system than that. If you’ve got regional redundancy in your systems, through AWS for instance or even your own, private network, can the workload be shifted to the same system in another region? It might be slow, but slow is better than down. Think through your alternatives, including redundancy, to identify issues on systems that are critical for business continuity. 

The last piece of risk management is as important as the first three. When an outage happens, take the time to do a root cause analysis, much like AWS did with their systems. Understand what went wrong and look at what can be fixed or what checks can be put in place to prevent that problem from happening again. And then implement those fixes. It might seem overwhelming at first, but over time it will become part of your regular workflow.

Fixing problems associated with risk might seem like adding additional burden to your already overloaded IT teams. Bringing in a partner that can work through remedies to your biggest issues can relieve some of the stress on your teams, while still providing your organization the protection it needs to keep the business running smoothly. Regardless how you cope with the additional work, risk management is one of the most important steps you can take to ensure your business can effectively operate when the inevitable happens.

The post How to Avoid an Epic Outage Like AWS’s originally appeared on the Curotec Blog

The Two Sides of Wellness and Wearables in the Workplace

Wellness programs are not a new thing for companies. It’s been long understood that a healthier workforce leads to a more productive environment with fewer sick days for employees. In fact, companies lose around $164 billion in productivity, annually, to obesity related issues.

Wellness programs go beyond weight management and physical health care. Recent trends in corporate programs include emotional wellness components, which help to drive employee engagement. These programs include mindfulness practices like yoga and meditation.

In the last few years, these programs have expanded to include the use of wearable trackers and gamification elements to motivate employees and keep them moving towards the goals of better health.

Health insurance providers are in full support of using devices and tracking to help create a healthier workforce. In fact, insurers are reducing corporate rates for companies where health trackers are used.

Technology is a significant enabler to the successful use of corporate wellness programs. But these programs can create concerns, both for employees and for IT departments.

The Technology of Wellness Programs

Companies have a few options when it comes to incorporating wellness programs into their operations, from insurer sponsored programs to independent companies that integrate with your organization’s goals.

For these programs to be effective and for some of the more motivating features to be used, there needs to be some level of reporting and tracking. These features need to be convenient, accessible and always available to encourage use.

Technology is the unifying element of these programs, no matter where the wellness program is sourced from. Between websites and mobile applications, these providers make it easy for employees to record their activities and participate in online education programs no matter where they are or when they have time.

Making it even easier is the use of wearable devices. Step trackers and heart rate monitors allow stats to be added to an employee’s profile without requiring the user to think about it. They also provide an unbiased third party report of activity.

All of this combined leads to generally accurate reporting and opens the door for gamification and intrinsic rewards to be used to keep employees on track.

Between wearables, websites and mobile applications, employees have tools available that can help them focus in and achieve their health goals. But the very devices that are enabling the workforce to get healthy can be dangers to the enterprise that is supporting their use.

IT Strains and Risks

The challenges that these applications bring are nothing new to IT. The difference here is that these activities are now endorsed, and even encouraged, by the organization. As such, IT must make accommodations for these risks. The good news is, the problems are ones that IT is already addressing.

One of the concerns is the program websites. While allowing access to outside sites is commonplace for most industries, the sites associated with wellness programs require logins and contain personal information. Training personnel to use unique passwords on outside systems is important in these situations, as is reminding them of the importance of secure passwords.

Because these sites are outside of a company’s sphere of influence, it’s difficult to tell when a security threat, like a virus, is introduced that can affect your corporate network. There is also a greater opportunity for phishing schemes and other social engineering attempts as there is a trusted outside company that could legitimately be looking for information from an employee.

Mobile applications and devices also increase the threat surface. As with any organization that allows BYOD – Bring Your Own Device – concerns around corporate information security and data leakage need to be taken into consideration. Enterprise mobility management and application management solutions can help with these risks, but no single solution is perfect. These solutions don’t address issues like compromised or rooted phones or access to corporate assets if a device is lost or stolen.

As with third party websites, mobile apps can create an access threat through compromised code as well. But given that mobile apps are particularly effective when it comes to wellness programs – digital health apps are identified by consumers as the second most important element in helping support their goals – a wellness program that doesn’t include access to apps may be getting in its own way. Adding threat testing of these outside applications can help to alleviate the worst of the concerns for enterprise IT departments.

And then there’s wearables. Wearables increase the number of access points. So, if you’re allowing the use of these items on your corporate network, you’re inherently increasing the number of places from which a hacker can gain entry into your system. Ensuring that all devices, including mobile and wearables, must adhere to your security policies is important to keep your network safe. Also, consider your network’s topology. Is it possible to allow access through a specific entry point, but still restrict the data available when entering through that point?

In addition to the concerns that your enterprise information security team may have, your employees may also be worried. Because their apps and devices are collecting information about their health habits, some team members may be concerned about who can access that data, and how it will be used. Educating and informing your workforce as to who has access to their information can help to reduce the anxiety employees feel about using tracking devices and employer-sponsored wellness programs.

Wellness programs are proven ways to encourage healthy lifestyles with your workforce. More importantly, your employees are more engaged and more productive when they are healthy. Today, technology plays a huge role in helping employees participate in these programs. And while the challenges to IT can be considerable, they can be managed with good IT security practices that most enterprises already have in place, combined with common sense security training.

The post The Two Sides of Wellness and Wearables in the Workplace originally appeared on the Curotec Blog

Amazon’s AWS S3 Storage Service Experiences Massive Outage

Starting at around 1 pm ET today, Amazon’s S3 storage solution began seeing high error rates out of US-EAST-1. Web sites and users across the US experienced outage issues with sites, both large and small. Included in the list were sites like Medium, Slack, Sprout Social, Adobe’s services, Flipboard, Quora, Business Insider, Netflix, Reddit and even the Securities and Exchange Commission.

With almost half of the AWS’s million clients using the storage solution, it’s not surprising that the outage has been felt so significantly. While some only used the service for image storage, other organizations use S3 to host their websites. The service reportedly stores 3 to 4 trillion pieces of data.

Amazon is working diligently to remediate the problem, but with their own service dashboard using S3 to store their status images, it was difficult for a while to understand what services were up or down without diving into specific service updates.

Outages like the one experienced today are rare, but because so many high-profile companies use AWS, it becomes very apparent when problems occur. Such issues are the reality of IT and servers, whether public or private. The expectation that a single service will have a perfect uptime record is unrealistic.

With that in mind, companies with mission-critical applications that require high availability should consider replicating your applications or sites across Regions.

AWS distributes their data centers into Regions, which are physical locations. But in addition to Regions, AWS has created Availability Zones, which are separately housed, discrete data centers located in the same region. These data centers have redundant everything – power, connectivity, and networking – to make them as fault tolerant as possible.

But for those who need additional fault tolerance, AWS offers the ability to replicate your data in different geographical regions. You retain control of the instances regardless of physical location, which allows companies with local compliance and data residency restrictions to manage those aspects themselves.

While an AWS outage is annoying, it’s important to remember that Amazon has one of the best uptime ratings of any of the cloud providers. Downtime is a reality in any server environment, but there are strategies, like multi-region architecture, to ensure a more consistent uptime experience.

The post Amazon’s AWS S3 Storage Service Experiences Massive Outage originally appeared on the Curotec Blog

Shadow IT Doesn’t Have to be Your Enemy

Even its name sounds a little frightening. 

“Shadow IT”. It sounds like something lurking in the corner, waiting to pounce. And its other names are worse, with some CIOs calling it “rogue” or “feral”.

The truth is, Shadow IT can be pretty scary for IT leadership. It creates more risks for the organization than just information security issues. It can even cause friction – or greater friction – between IT and other internal teams.

But there can also be benefits to Shadow IT if you’re willing to embrace it, prepare for it, and develop inclusive policies and education regarding it.

What is Shadow IT?

Gartner defines Shadow IT as “IT devices, software, and services outside the ownership or control of IT organizations”. But of course, reality is more nuanced than a simple definition.

Basically, Shadow IT starts out, and thrives, in organizations that either enable departments to do what they want or in companies where IT says “no” more often than they say “yes”.

If you have departments that adopt their own software, that’s Shadow IT.

If you have groups that have licensed their own cloud services, that’s Shadow IT.

If you have teams that have siloed themselves by using solutions that haven’t been vetted by IT, that’s Shadow IT.

This is a situation that has been exacerbated by the Bring Your Own Device (BYOD) trend that many enterprises are seeing and even encouraging. When combined with the overall tech savviness of the average person, Shadow IT seems like an obvious outcome.

While IT departments are trying to keep control around what’s used for both support and security reasons, some are seen as strict gatekeepers that are more likely to deny a request than consider it. Or, equally as bad, an IT department may seem willing to evaluate solutions, but not have the resources to do so quickly or efficiently. Other departments are “helping” when they go off book and find their own solutions.

What many of those that are outside of IT don’t realize is the problems they can cause when they seek out their own technologies. Even IT doesn’t always understand all of the risks associated with allowing Shadow IT to run rampant.

Shadow IT can Introduce Risk

The one risk of Shadow IT that its painfully obvious to anyone in traditional IT is security. Without an awareness of the risks associated with random software acquisition and installation, a department making its own software choices could potential open up the entire network to risk.

Support is another concern. While a team within the organization may have chosen, and are even supporting their own solution, it may not play nicely with other apps approved by IT. It might not even work well on the available equipment provided by IT. As a result, IT gets pulled in to troubleshoot systems sporting software and services they have no knowledge of.

Many organizations must deal with various levels of compliance. Whether that is tracking required by IT as part of Sarbanes-Oxley, or stricter requirements like PCI or HIPPA, organizations that allow or encourage non-IT teams to adopt their own IT equipment, software and platforms can put the entire organization at risk of being out of compliance.

Many groups will argue that they are using their own budgets for their Shadow IT initiatives, so it shouldn’t be a concern of IT. But costs are a larger concern than just what fits into an individual department’s budget. For instance, if multiple internal organizations have contracted individually with the same 3^rd party, the enterprise may be missing out on savings associated with volume licensing.

Lastly, Shadow IT can create integration nightmares for IT. If two internal teams need their software to talk to one another, but they are using disparate solutions, they may turn to IT to connect their data silos. Without having vetted the vendors, one, or both, solutions may be built on platforms unfamiliar to your IT organization. Or one could have no external interfaces available at all. A problem that could have been cut off during the evaluation process has now become a headache for the central IT organization.

How to Incorporate Shadow IT

As risky as Shadow IT can be, it’s unlikely that you’ll be completely unable to remove it from your enterprise, especially if it’s already got a foothold within the organization. But it might not even be in your best interest to remove all facets of Shadow IT.

Instead, working with the various teams within your organization can allow them some control over their solutions, while relieving IT from dealing with multiple demands with dwindling resources.

First and foremost, you should make sure that anyone considering investigating their own solution gets an understanding and some training on the security risks they need to be aware of during the evaluation process. And if you’re under compliance requirements, you want these organizations to understand what is required to meet the compliance rules.

Next, your policies around individual departments adopting their own software and services should include requirements that IT be aware before a choice is made, during the requirements gathering and definition phase. The intent here is not to tell other teams “no”, but to make them aware of other teams that are using similar software, or teams that may have a similar need.

If these multiple teams can agree on a single solution, they can split the costs across their budgets, and potentially gain the benefits of volume licensing. It also gives the central IT organization the opportunity to guide these departments to solutions that are known to operate well within the existing technology ecosystem.
Shadow IT doesn’t need to be a thorn in the side of your traditional IT department. It’s possible for individual organizations to work with the central IT organization to get what they need, while still meeting the requirements and mitigate the risks to the larger organization. Training, planning, and becoming part of the Shadow IT process gives you insight into the needs of these teams without becoming the department of “no”.

The post Shadow IT Doesn’t Have to be Your Enemy originally appeared on the Curotec Blog

Curotec Wins 2016 Gold Davey Website Award

Philadelphia, PA, January 8th, 2017 – The Academy of Interactive and Visual Arts recently announced the 2016 recipients of the Davey Award, naming Curotec as a Website Gold Award winner.

The prestigious award, announced in December, is presented to agencies to recognize outstanding work in design in areas such as film and video, multimedia, mobile, content marketing and, of course, websites.

Curotec received the award in recognition of the work done on the development of the website for their client, Joie Baby. The British company, specializing in top quality baby products for new and young families, worked with Curotec to develop a bright and fun brand website that highlights their versatility and commitment to safety and style.

“On behalf of the Davey Awards and our Academy, we want to applaud this year’s entrants and winners for their dedication and commitment to their craft. We offer our congratulations once again for the exceptional work they submitted.” noted Linda Day, Executive Director of the Davey Awards.

About Curotec

Curotec is proud of being a technology company in the booming innovation region of Philadelphia, Pennsylvania. Providing web development and design, along with enterprise software, ecommerce solutions, mobile application development and IT system security and maintenance services, Curotec is a local company with a global client list.

Since 2010, Curotec has focused on the success of their clients and solving problems with modern technology. Committed to solutions that help their clients today and ready them for the challenges of tomorrow, Curotec begins every project by listening to their client’s needs. Only once they have an understanding of the business challenge do they look to apply the right solution, whether that’s custom development or CRM or SaaS integration.

About the Davey Awards

David was said to have slain Goliath with a sling and a stone, despite being much smaller than the monster he faced. In the same way, small agencies and firms are making big impacts in the world of interactive and visual design.

The Davey Award was developed by The Academy of Interactive and Visual Arts to recognize the work of these small but important firms and their contributions to the industry. The Davey Awards are the leading awards competition for smaller firms to compete against their peers and receive well deserved recognition for the amazing work they do.

The post Curotec Wins 2016 Gold Davey Website Award originally appeared on the Curotec Blog