Accellion blog has moved!

You should be automatically redirected in 6 seconds. If not, visit
http://www.accellion.com/blog/
and update your bookmarks.

Friday, July 28, 2006

FTP (In) Security in the Google Age

Summary: Data and information residing on FTP sites are indexed by Google. Do you know what is on your FTP servers?

----------------
Although I am a Google power user and a veteran of FTP, I still find it a touch scandalous, although logical, to know that FTP sites are being indexed by Google.

It really makes sense because FTP sites hold tremendous amounts of information and data and Google's stated mission is to crawl all the information fit to index. (To paraphrase the redoubtable New York Time's motto.)

The trouble is, do you really want Google to index information on these FTP sites and make them searchable?

Conversely, do you know what is in your FTP servers?

I have known of cases where companies routinely exchange large proprietary data sets using FTP for user to user file transfer because other traditional file transfer methods like email and CD delivery are inadequate to the task. In today's Google mode of operation, a great deal of IP (intellectual property) can be exposed to your favorite search engine.

Or, like this Search Engine Roundtable posting shows, you have to be very wary of (hidden) FTP logs being indexed.

So, here are three things that you should do:

1. Search Google (and other search engines) for your (company) information to make sure that there is no proprietary information not intended for public consumption floating around. (I find it's helpful to set up Alerts to automatically have search engines tell you what it is finding with a specific search criterion.)

2. Lock down FTP servers. This would make FTP unfriendly to users and administrators alike, but imagine the alternative...

3. Look for a secure alternative means to sending large files that will not be exposed to the prying eyes of Google.

ACA Guy

Friday, July 21, 2006

No Pain is Gain - What email focused VAR partners are doing for email size limits

Summary: Should IT impose file size limits on email users? While limits can help IT manage the beast that is enterprise email, they also can hinder business processes. Perspectives from those who deal with this issue everyday, email-focused VARs.

-------------------------------
"[Should] security and stability of an email infrastructure be a separate issue from whether Beth in accounting, or Pete in marketing, or Ed in Editorial can store 200 Mb worth of email or 2 Gb worth of email," asked Edward F. Moltzen of CRN on a July 14th article.

Ah, the conundrum of email size limits. Should it be set? What limit is reasonable? How would the limits impact actual business processes? What happens to the limits when the email (attachment) size gets larger, as it always does?

Stripping away all the rhetoric, the gist of the problem with message size and in-box limits comes down to the attachments. After all, nobody is going to compose a 10MB email purely in text; it’s the large attachments that hog the resources. Exacerbating the problem is the common moral hazard of not just sending attachments, but sending them with numerous CCs and BCCs, because the capability is there.

Theoretically, there is no technical reason why email cannot be designed to be robust enough to handle unlimited size. However, the problem of building an email solution that does it well is that it has to be architected specifically with this requirement in mind from the start. Adding to this Herculean goal is the IT truism that what is considered large size today is often the mere starting size tomorrow.

Now, let's face the facts here. Nothing is more core than email in most of today's business processes. The surest way for IT to rouse the ire of the bosses is when there is an email problem. Under the motto of if it ain’t broke, don’t fix it, no sane IT department of an enterprise with a keen sense of self-preservation is going to push the envelop on the email front. So, it is theoretically possible and technically feasible to allow unlimited size, but it is not going to happen, given the current code base for both Exchange/Outlook and Domino/Notes.

So, what do the email-focused value-added resellers (VARs), who are paid to confront and resolve such issues everyday, do? What our (Accellion’s) email-focused VARs are telling me is that looking at the issue as a purely email size limit problem is a myopic way of framing the problem. Namely, take a step back; email is nothing but a tool to get things done. And, the key thing that users are really asking for with large email size is the ability to easily exchange large file/attachments as the business process requires.

What we are seeing in actual field usage is that while limiting the size of messages and in-boxes is a common practice, these limits have the undesirable effects of restricting legitimate business processes that require large emails/attachments. Sure, there are the FTP sites, USB key Sneaker-Net, and the good old fashioned CD/DVD burners -- but nothing comes close to email's ubiquity and ease of use for end users. So, the question is not so much how/what size limits to impose. Rather, it is about how to let users operate in an efficient manner with increasing attachment sizes without requiring extensive and on-going contortionist trainings for both IT and end users.

We are seeing an increasing number of email-focused VARs adding Accellion Courier Secure File Transfer Appliance (SFTA) to their arsenal because it allows end users to use the familiar email application to get things done, while offloading attachments from email servers to a complementary secure file transfer appliance for IT's ease of management and ease of mind. As a result, happy users can go about their business without the frequent disruption of dealing with email limits, and IT (and the VAR) can look like a hero for solving an enterprise problem with a simple solution.

In life. No pain is gain, sometimes.

ACA Guy

Friday, July 14, 2006

Microsoft Exchange/Outlook Attachment Size: Best Practices, Limits, and Solutions

Summary: 5MB is the effective [email attachment] size limit cited as examples for Microsoft Exchange/Outlook on Microsoft Support. How to send large email attachments through Accellion SFTA without causing Exchange/outlook problems.

---------------------------

"Massive email accounts [are] killing our [E]xchange server" -- Louise H.

This was an actual quote that I got earlier today from an IT officer who requested information on Accellion's Courier Secure File Transfer Appliance.

I recall reading an Osterman Research study where 80% of the email traffic is in attachments. All these attachments end up at somebody's email inboxes. The trouble is that when these email accounts get too big - they can crash email servers.

Adding to the woe is the degradation of network performance when an email with a 15MB attachment is sent out to 20 recipients (spiking the effective email attachment load to 300+ MB with one click). While all those bits and bytes are making their way through the network, the entire email system will come to a near stand-still.

There are very few things that IT does that would get the CEO's attention immediately. But, trust me, when the email server crashes or when the email/network is crawling, the CEO will notice.

Fun, huh?!

That is precisely why IT uses attachment size limit settings in the email server.

The trouble is that there are legitimate cases where large files need to be shared and attachments via email is the most intuitive and convenient method for both senders and recipients. (Lawyers and advertising curative teams come to mind.)

I was recently told by a reseller who specializes in Microsoft Exchange/Outlook implementations that the Microsoft Exchange 2003 best practice for maximum email attachment size limit is between 5MB and 10MB. Consequently, they are using Accellion SFTA to complement their Exchange/Outlook deployments so that the users can have a high-performance email infrastructure while preserving the ability to send very large attachments as part of the everyday business process.

This kind of got us thinking and we dug around the Microsoft support site for examples of effective [email attachment] size limits. Of the two examples found (shown below), I think what is glaringly obvious is that a 10MB limit as suggested by the reseller is, if anything, on the generous side.

Examples of effective size limits

Example 1
• The global setting is set to 5 MB.
• The Exchange SMTP connector is set to 3 MB.
• The SMTP virtual server is set to 4 MB.
• The user mailbox setting is set to 2 MB.

Example 2
• The global setting is set to 2 MB.
• The Exchange 2000 SMTP connector is set to 5 MB.
• The SMTP virtual server is set to 2 MB.
• The user mailbox setting is set to 3 MB.

I then looked at my own folders full of PowerPoint presentations. I am - after all - Accellion's "marketing guy," and 20MB sized files are dime a dozen.

So, here is a question with an obvious answer. Why fight a battle on controlling email attachment size limits that nobody has a clear solution for when you can use the field-proven Accellion Courier File Transfer Appliance that would seamlessly integrate into your Microsoft Exchange/Outlook and give users the ability to send really large files without overwhelming the messaging infrastructure?

Granted, the CEO may not notice the change. But, as the saying goes, "no news is good news" as far as limiting email attachment sizes and allowing daily business processes are concerned.

Or, as I like to think, you should have the "email + unlimited large attachment size" cake and eat it too.

ACA Guy

Click here to request more info on Accellion Courier SFTA

Friday, July 07, 2006

World Cup, virus, worms, and Accellion

Like many Silicon Valley firms, people at Accellion are a pretty international bunch. Translation: World Cup fever is gripping all of our offices in Asia, North America, and Europe.

So, here is a short list of five things that, fingers crossed, will fade in a few more days.

1. Longer meetings: impact of Ronaldo's heft this year vis-a-vis his 2002 World Cup appearance is a recurring topic of passionate debate in most meetings.

2. Office envy: people who have attended a 1994 World Cup game in person become instant object of awe and envy.

3. Skewed working hours: the Asian team keeps very odd hours.

4. Singing: muted, but you can almost hear people humming La Marseillaise (for the French) and Inno di Mameli (for the Italian) in preparation for the final.

5. Nudist World Cup game: I am not making this one up. According to a BBC report, the Sixem-A worm is inviting people to click on a link to download those Nudist-in-action pictures. (Naturally, if you use Accellion Courier Secure File Transfer Appliance to send digital assets, nude or otherwise, you would not have to worry about worms and viruses. But, this is probably a different topic for another time.)

In the meantime, be you one of the "[les] enfants de la patrie" or "fratelli d'Italia," may the best team win on Sunday. As for me, I wonder what is Trinidad and Tobago's national anthem...

ACAGuy