24.02.2015 Views

Integrated Marketing Communications— An Effective ...

Integrated Marketing Communications— An Effective ...

Integrated Marketing Communications— An Effective ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>Integrated</strong> <strong>Marketing</strong> <strong>Communications—</strong><br />

<strong>An</strong> <strong>Effective</strong>, Comprehensive Approach<br />

By Raul Danny Vargas, President, VARCom Solutions<br />

Acritical part of marketing is communications—and<br />

the most effective and<br />

productive way of managing this effort<br />

is through concept called <strong>Integrated</strong><br />

<strong>Marketing</strong> Communications (IMC).<br />

But before we get too deep into the IMC process,<br />

it is important to remind ourselves where it lays in<br />

our overall marketing effort. We all remember the<br />

four “Ps” from <strong>Marketing</strong> 101, but it is worth seeing<br />

how they relate to the four “Cs” from the customer’s<br />

perspective. The first “P” is product, but really this<br />

is all about the customers’ needs and wants. Which<br />

goods and services customers are looking for, what<br />

are the features/benefits in demand, what might be<br />

unfulfilled needs? The second “P” is price, but in fact,<br />

this has more to do with the cost to the consumer.<br />

What is their perception of value, how much are<br />

they able/willing to spend? The third “P” is place<br />

(or distribution), but what this means is the convenience<br />

to the customer to obtain the product. Where<br />

will it be sold, are there distribution channels, is the<br />

process simple and secure? <strong>An</strong>d last but not least, is<br />

promotion, and you probably guessed, this is how we<br />

communicate with our customers. To promote yourself<br />

effectively, you need to understand your customers<br />

and their perspectives.<br />

There are many possible objectives for promoting<br />

your organization—create awareness, stimulate demand,<br />

identify prospects, retain customers, combat<br />

the competition, etc. Whatever the objective,<br />

a good rule of thumb is to remember that<br />

your promotional efforts should capture the<br />

customers’ attention, create interest, generate<br />

a desire and define an action to satisfy<br />

that desire—also known as<br />

AIDA.<br />

Price<br />

(Cost)<br />

<strong>Integrated</strong> marketing<br />

communications is<br />

a way of looking at the<br />

whole marketing process from the<br />

viewpoint of the customer. It involves<br />

the coordination of all promotional<br />

Product<br />

(Customer)<br />

Promotion<br />

(Communication)<br />

activities—media advertising, direct mail, personal<br />

selling, sales promotion and public relations—to<br />

produce a clear, unified, consistent and compelling<br />

customer-focused message about the organizations<br />

and its product. Databases, the Internet, and other<br />

sources have enabled us to gather powerful information<br />

quickly. Therefore, marketing communications<br />

are less mass-market oriented (broadcast) and more<br />

segment-oriented (narrowcast).<br />

<strong>An</strong> effective IMC process comprises the following<br />

steps:<br />

• Identify the target audiences—This requires a<br />

well thought out market segmentation and targeting<br />

process which may include secondary and/or<br />

primary market research.<br />

• Determine the communications objectives—As<br />

stated previously, this can range from generating<br />

awareness to countering the competition.<br />

• Design the messaging content—This is an absolutely<br />

critical component. <strong>Effective</strong> messaging can<br />

make or break a promotional effort.<br />

• Select the means for communications.<br />

• Define the mix of media, budget and priorities.<br />

• Measure the effectiveness of the efforts.<br />

<strong>Marketing</strong> communications comprises five broad categories:<br />

personal selling, advertising, public relations,<br />

direct marketing and sales promotions. Each has its<br />

own set of pros and cons and can be accomplished<br />

in a variety of ways. However, the key is to look<br />

at the available options in a comprehensive way<br />

and to ensure consistency throughout the<br />

selected media.<br />

Place<br />

(Convenience)<br />

The selection of communications<br />

methods<br />

is subject to a variety<br />

of factors. The factors<br />

that influence the selection and effectiveness<br />

of a promotional mix include:<br />

BUSINESS VENTURES Fourth Quarter 2005<br />

NETWORKING<br />

Top 10 Networking Mistakes ........................................................................................................................ 2<br />

FYI ............................................................................................................................................................ 2<br />

FINANCIAL FOCUS<br />

Zen and the Art of M&A .............................................................................................................................. 3<br />

TECHNOLOGY<br />

Employees—Leave Your Gadgets Home! ....................................................................................................... 4<br />

Sponsorship<br />

Interactive<br />

Media<br />

Direct<br />

<strong>Marketing</strong><br />

Public<br />

Relations<br />

Sales<br />

Promotion<br />

Advertising<br />

Customers<br />

Branding<br />

Publicity<br />

Etc., etc.,<br />

etc.<br />

Personal<br />

Selling<br />

Trade<br />

Shows<br />

Product<br />

Placement<br />

• Nature of the market (market size, geographic<br />

scope, type of customer, etc.)<br />

• Nature of the product (complexity of the product,<br />

service requirements, etc.)<br />

• Stage in the product life-cycle (earlier versus later<br />

stages of the life cycle)<br />

• Price (high versus low unit price)<br />

• Funds available for promotion<br />

This funding point is very relevant to all companies. Budgeting<br />

is an essential function of the IMC process. The<br />

following items impact the budget determinations:<br />

• Percentage-of-sales method (a specified percentage<br />

of either past or forecasted sales)<br />

• Fixed-sum-per-unit method (predetermined dollar<br />

amount for each unit sold or produced)<br />

• Meeting competition method (match competitor’s<br />

promotional outlays)<br />

• Task-objective method (amount and type of promotional<br />

spending needed to achieve promotional<br />

objectives)<br />

Execution of the IMC plan also involves an evaluation<br />

process to ensure the effectiveness of the effort.<br />

There are two basic measurement tools. One is direct<br />

sales results in which you measure the effectiveness<br />

by identifying the specific impact on sales revenue<br />

for each dollar of promotional spending. The other<br />

is an indirect evaluation where you focus on certain<br />

measurable indicators of effectiveness.<br />

Studies confirm that brand equity can be enhanced<br />

by pursuing a strategy that integrates the various marketing<br />

communications tools. While an IMC effort<br />

requires some work up front, the benefit will make it<br />

worthwhile. ■<br />

Danny Vargas is president of VARCom Solutions (www.<br />

varcom.com), a full-service marketing and sales consultancy<br />

and training firm. For more information, contact him at 571-<br />

434-8466 or dvargas@varcom.com.<br />

The views expressed in this publication are those of the writers and do not necessarily reflect the opinions of the Fairfax County Economic Development Authority. Copyright © 2005 FCEDA.


NETWORKING<br />

Top 10 Networking Mistakes<br />

By Melvin Murphy, Founder, Institute for Partnership Solutions, Inc.<br />

One of the fundamentals of developing<br />

strong business relationships is how well<br />

you communicate with people—whether<br />

it is verbal, written or face-to-face.<br />

Whatever the form of communication,<br />

there are myths, mistakes, and misconceptions about<br />

the do’s and don’ts of communication when trying to<br />

build business relationships.<br />

When meeting someone for the first time, one should<br />

be very conscious of their behavior before, during and<br />

after the conversation because your approach and<br />

demeanor will be noticed second only to your appearance.<br />

What, why and how you say something will<br />

often determine the basis of your future relationship,<br />

so try to avoid the top 10 networking mistakes.<br />

1. Being too quiet<br />

The worst mistake anyone can make when meeting<br />

someone for the first time is being too quiet. Though<br />

it’s often awkward to meet complete strangers, be confident,<br />

make eye contact, give a firm handshake and<br />

don’t appear nervous. If you seem like someone they<br />

can trust, they may want to conduct business with you.<br />

Remember, building alliances is about communicating,<br />

so take part in the conversation.<br />

FAIRFAX COUNTY<br />

ECONOMIC DEVELOPMENT AUTHORITY<br />

8300 Boone Boulevard, Suite 450<br />

Vienna, Virginia 22182-2633<br />

Voice 703-790-0600 • Fax 703-893-1269<br />

E-mail info@fceda.org<br />

URL www.FairfaxCountyEDA.org<br />

The Fairfax County Economic Development Authority<br />

(FCEDA) is an independent authority created under<br />

state law, operating under the direction of seven<br />

Commissioners appointed by the Fairfax County<br />

Board of Supervisors. Its activities are funded<br />

by Fairfax County.<br />

COUNTY BOARD OF SUPERVISORS<br />

Gerald E. Connolly, Chairman<br />

Sharon Bulova, Vice Chairman<br />

Joan DuBois • Michael R. Frey<br />

Penelope A. Gross • Catherine M. Hudgins<br />

Gerry W. Hyland • Dana Kauffman<br />

Elaine McConnell • Linda Smyth<br />

ECONOMIC DEVELOPMENT AUTHORITY<br />

COMMISSIONERS<br />

Steven Davis, Chairman<br />

Michael S. Horwatt, Vice Chairman<br />

Ron Johnson • Mike Lewis • <strong>An</strong>n Rodriguez<br />

Sudhakar Shenoy • William Soza<br />

ECONOMIC DEVELOPMENT AUTHORITY STAFF<br />

Gerald L. Gordon, President and Chief Executive Officer<br />

Robin Fenner, Vice President, Management<br />

Catherine W. Riley, Vice President, <strong>Marketing</strong> &<br />

Director, International <strong>Marketing</strong><br />

Barbara Cohen, Director, Administration<br />

Alan Fogg, Director, Communications<br />

<strong>An</strong>ita Grazer, Director, National <strong>Marketing</strong><br />

Ivy G. Richards, Director, Market Research & Real Estate<br />

Karen Smaw, Director, Small & Minority<br />

Business Development<br />

BUSINESS VENTURES PRODUCTION<br />

Lucy Arrington, Editor<br />

Vicki L. Serraino, Graphic Designer<br />

The FCEDA assists businesses interested in locating,<br />

relocating or expanding their commercial office or<br />

industrial operations in Fairfax County. FCEDA’s<br />

services are available on a confidential, no-cost basis.<br />

2. Talking too much<br />

It’s customary to contribute to the conversation at<br />

networking events, but there is no need to share your<br />

entire life’s history. Be just interesting enough to encourage<br />

people to want to ask questions. Talking too<br />

much often communicates that you care more about<br />

yourself than in meeting others. Ask good questions,<br />

reflect what others are talking about, and seem genuinely<br />

interested in them as people.<br />

3. Being too pretentious<br />

Let’s face it: many people like to be seen with the<br />

“who’s who” crowd. There are those people who are<br />

always interested in associating with very important<br />

or affluent people. We learn this through peer pressure<br />

in grade school. Don’t feel the need to compete with<br />

others or their peer groups. Interact with those around<br />

whom you feel comfortable and confident and who<br />

share similar personal and business interests.<br />

4. Conducting a cross-examination<br />

If you’ve ever watched television shows like Law and Order<br />

or The Practice, then you’ve seen how trial lawyers drill<br />

witnesses with questions. However, this is not a good<br />

idea in a social environment. A rule of thumb is to ask<br />

three questions of interest to whomever you’re conversing<br />

with. This will allow the conversation to continue without<br />

awkward periods of silence and confirm that you are<br />

interested in them and not just talking about yourself.<br />

5. Interrupting<br />

We all know that interrupting shows bad manners. If<br />

you want to talk with someone who is currently talking<br />

with others, the best thing to do is stand near them<br />

so that they may see you waiting. They will choose<br />

whether and when to end the conversation. Excuse<br />

yourself for interrupting and state your question or<br />

introduce yourself. Never interrupt someone and then<br />

pull him or her to the side to ask a question.<br />

6. Having a bad attitude<br />

So, you had a bad day? We all have them once and<br />

awhile. Don’t take your bad attitude with you to a<br />

social event or business meeting. It will show, and it<br />

won’t work in your favor. If your temperament is going<br />

to distract you from making valuable contacts, then<br />

it is best not to attend the event at all. People always<br />

remember when they have been mistreated regardless<br />

of the circumstances and first impressions are lasting.<br />

FYI . . .<br />

. . . The Fairfax County Economic Development<br />

Authority (FCEDA), in partnership with the Virginia<br />

Department of Business Assistance (DBA) and the U.S.<br />

Small Business Administration (SBA), conducts a monthly<br />

workshop for individuals interested in starting a business<br />

in Fairfax County. The workshop provides an overview<br />

of start-up basics (licenses and permits); DBA workforce<br />

service and training programs; and SBA resources,<br />

financing and certification programs. Workshops are<br />

held the first Tuesday of each month from 8:00–10:00<br />

AM. There is no cost to attend, but pre-registration is<br />

required. The 2006 schedule is: January 10, February 7,<br />

March 7, April 4, May, 2, June 6, September 12, October<br />

3 and November 7. To register, contact the FCEDA at<br />

7. Refusing to pay<br />

Say you have networked and landed an opportunity<br />

to have lunch or dinner with a person you have been<br />

trying to meet. Lunch has been scheduled, it goes<br />

smoothly, and then the bill comes. Who pays? To make<br />

a positive impression on your new alliance, make an<br />

offer to pay for lunch. Though usually the person who<br />

requested the meeting should offer to pay, if this doesn’t<br />

happen you should at least offer. Always be prepared to<br />

pay in case the other person has as a different practice<br />

than you (or is from a different culture).<br />

8. Defaming others<br />

Even if you have news about someone that you and<br />

a business acquaintance are talking about, don’t be<br />

tempted to gossip. It’s a small world, and badmouthing<br />

someone can only come back to haunt you. Follow the<br />

rule of thumb your mother taught you, “If you can’t<br />

say something nice, then don’t say anything at all.”<br />

9. Bringing up argumentative topics<br />

We all have opinions—some we feel very passionately<br />

about. Be careful what you offer an opinion on, especially<br />

during initial meetings with people you don’t know well<br />

and especially if you don’t know where they stand on certain<br />

issues. In general, avoid controversial subjects such as<br />

morality, politics and religion. When it comes to stating<br />

opinion in business settings, usually less is better.<br />

10. Neglecting to follow-up<br />

You’ve made the commitment to attend the event. You’ve<br />

done your homework. You’ve made a connection. Now,<br />

follow-up: This is where many people fail to conclude<br />

their process of building productive relationships. Always<br />

follow-up with a call, email or thank-you letter.<br />

The Lesson<br />

These pitfalls are easy to avoid with a little preparation<br />

and savvy. In general, always think on your feet, follow<br />

your intuition about what is appropriate conduct and<br />

always be positive and energetic. These simple tips<br />

can make the difference in how you are perceived<br />

and whether you establish and expand on a group of<br />

beneficial and profitable alliances. ■<br />

Melvin Murphy is a speaker, seminar leader and author of<br />

It’s Who You Know! Creating Mentor-Based Alliances and<br />

Partnerships through Networking! For more information,<br />

call 703-352-9114 or visit www.partnershipsolutions.net.<br />

703-790-0600 or visit www.fairfaxcountyeda.org/<br />

workshop_form.htm.<br />

. . . The FCEDA provides business counseling services<br />

through an arrangement with the Service Corps of<br />

Retired Executives (SCORE), an SBA initiative. Victor<br />

Brown, the FCEDA resident SCORE counselor is available<br />

the first, second and third Friday of every month at FCEDA<br />

headquarters. Sessions are one hour in length, but follow-up<br />

appointments may be set up as needed. For more<br />

information or for an appointment, call 703-790-0600.<br />

. . . The Fairfax County Department of Purchasing<br />

& Supply Management Agency, Office of<br />

Small Business sponsors a free monthly workshop,<br />

“Selling to Fairfax County.” Attendees meet staff from<br />

the county’s purchasing department, learn about the<br />

county’s procurement process and discuss upcoming<br />

contracting opportunities. The workshops are held at<br />

the Fairfax County Government Center. For 2006 dates<br />

and more information, call 703-324-3201.<br />

2<br />

BUSINESS VENTURES • Copyright © 2005 FCEDA


FINANCIAL FOCUS<br />

Zen and the Art of M&A<br />

By John Casey, Director, Small Business Development Center, Mason Enterprise Center, George Mason University<br />

Mergers and acquisitions—or M&A—<br />

can be a very confusing process to<br />

small business owners looking to<br />

sell their companies. What are the<br />

different kinds of transactions? How<br />

can you negotiate from a position of strength? What<br />

is “due diligence” anyway? Below are a few frequently<br />

asked questions, and answers, about mergers and<br />

acquisitions.<br />

What are some of the considerations<br />

at the beginning of the process?<br />

Set your goals early in the process and establish expectations.<br />

Identify your top priorities and understand<br />

what you want from deal. Position the transaction to<br />

your advantage before the deal dynamic gets started.<br />

Immediately correct the buyer if a portion of the<br />

proposal is way out of bounds. Don’t agree to a predeal<br />

“no-shop” clause unless an incredible preemptive<br />

price is offered.<br />

Focus on integration issues early on in the process. Ideally<br />

there is “mutual integration” where the combined<br />

entity keeps best practices, best people, best systems but<br />

this is a rare occurrence. Often the end result is “dominant<br />

integration” where the bigger gorilla drives the<br />

integration. The results can sometimes be painful.<br />

What do I need to know about the prospective<br />

buyer?<br />

Study and understand the needs of the buyer—do the<br />

research. Is the acquiring company interested in your<br />

company for diversification, expansion or a market<br />

beachhead? Find out what motivates the CEO. Explore<br />

the prospective buyer’s market vision, marketing<br />

experience, technology, R&D interest and distribution<br />

channels. Look at the company’s cash flow, profits<br />

and sales. Find out what board/shareholder/investor<br />

approval is required on the acquirer’s side and what is<br />

their desired timeframe for completing deal.<br />

How long does it take to consummate<br />

an M&A deal?<br />

Selling a company is difficult, extremely time consuming<br />

and stressful. It requires serious focus. The amount<br />

of time to close a deal varies, but remember that a deal<br />

is not done until it is final and the check clears. Forty<br />

percent of deals fail after a letter of intent (LOI) has<br />

been signed and the mortality rate between LOI and<br />

closing is nearly 50 percent. Everyone talks about synergies,<br />

but 60 to 70 percent of acquisitions are considered<br />

failures.<br />

How do I negotiate from a position of<br />

strength?<br />

When dealing with a potential buyer it is important<br />

to negotiate from a position of strength. Let the buyer<br />

know if there have been other potential buyers in the<br />

wings and that the decision to sell is a choice on your<br />

part. Establish time limits on response periods for offers<br />

and counter offers. Try to make progress at each<br />

stage of the negotiating process. Make compromises<br />

when you can and ask for concessions you don’t really<br />

want or expect as a negotiating tactic. Rarely should<br />

you accept the first offer or counteroffer. Finally, be<br />

aware of unethical buyer strategies such as “walk away<br />

Selling a company is difficult,<br />

extremely time consuming and<br />

stressful. It requires serious<br />

focus.<br />

artists” who contact you with a material change hours<br />

before closing.<br />

What materials should I pull together<br />

when I decide to sell?<br />

<strong>An</strong>y prospective buyer will want a wide-range of<br />

information about your company. Prepare a packet<br />

that includes a company history, an organizational<br />

chart, promotional materials, a sampling of media<br />

articles and senior employee bios. Potential buyers<br />

will also want to see a client list, price list and a list of<br />

stockholders/debt holders. <strong>An</strong>y agreements regarding<br />

employment, licensing, leasing, joint ventures, private<br />

label deals or royalty agreements will need to be made<br />

available.<br />

Financial documents needed can include a current<br />

balance sheet and income statement, bank statements<br />

(for at least three years), personal financial statements<br />

for company executives, liabilities/debts, cash flow and<br />

contingent and unrecorded liabilities.<br />

The purchaser will also be interested in your company’s<br />

business plan, market/competition analysis, intellectual<br />

property owned by the company, any potential<br />

lawsuits and current contracts.<br />

What is needed to get the best possible<br />

letter of intent?<br />

The Letter of Intent is one of the most important<br />

documents in the M&A process. It is vital to get allimportant<br />

issues nailed down in the letter, especially<br />

concerning valuation. Other items to have in the letter<br />

include price and terms, form of consideration (cash,<br />

stock, note), contingencies, and an earn-out clause.<br />

Although an LOI is non-binding and some firms don’t<br />

take it seriously, you should!<br />

What is due diligence and how do I prepare<br />

for it?<br />

Due diligence basically is a thorough investigation of<br />

the operation, management and finances of your company.<br />

Audit your readiness for due diligence. Are there<br />

any balance sheet or operational exposures? Perform<br />

a business review and critique your own projections.<br />

Strive to have only positive surprises. Be forthright but<br />

don’t be forthcoming. Other tips include maintaining<br />

a single point of communications, using a specific “war<br />

room” for due diligence work and keeping three copies<br />

of all paperwork.<br />

Why should I read the acquisition<br />

agreement carefully?<br />

The acquisition agreement (AKA the Definitive Agreement)<br />

can contain some heart-stopping surprises so<br />

you should read and understand every provision<br />

including the purchase term; due diligence/closing<br />

period; warranties; covenants; conditions to closing<br />

and indemnifications.<br />

How much attention should I pay to<br />

tax consequences?<br />

The after-tax consideration you receive post-sale<br />

should be a very, very high priority. Be sure to get some<br />

expert advice on tax ramifications before you sign the<br />

LOI. Different deal structures vary dramatically, so<br />

you must have a clear focus on net proceeds out of the<br />

proposed deal from the beginning. For example, if the<br />

acquirer purchases your assets, they get a tax benefit. If<br />

you own an S Corporation the picture is mixed—some<br />

gains are taxed as ordinary income, some as capital<br />

gains. Be aware of the type of acquisition: asset versus<br />

stock. There are widely varying tax results depending<br />

on the type of acquisition. Keep after-tax results in<br />

mind at all times.<br />

What is the difference between asset<br />

sale versus stock sale?<br />

In a sale of assets you, the seller, have certain advantages.<br />

You can maintain some assets such as selected<br />

patents, trademarks and licenses. You keep the corporate<br />

name and preserve the corporate status for future<br />

endeavors. Some of the disadvantages are double<br />

taxation (corporate at the time of liquidity and then<br />

individually as shareholders), a more complicated<br />

deal as specific assets must be transferred and the<br />

calculation of gain/loss is more involved, depending<br />

on asset category.<br />

If the proposed sale is stock only, the seller gains many<br />

advantages, including a clean break from the old<br />

company. All liabilities, known and unknown, pass<br />

to the new owner. Calculation of capital gain on the<br />

stock is less cumbersome.<br />

Disadvantages include losing use of net operating<br />

losses against future income elsewhere. Usually all the<br />

assets are included in the deal and you lose use of the<br />

corporate name and all trademarks.<br />

What advisers should I enlist for my<br />

side of the negotiation?<br />

One of your primary advisers should be someone<br />

with plenty of M&A experience who can help you<br />

maximize deal velocity, deal value and deal success.<br />

Most professional M&A advisers will ask for a retainer<br />

plus success fees. Be sure the adviser doesn’t get success<br />

fee until you receive the compensation from buyer.<br />

You’ll also need an attorney and an accountant who<br />

understand potential tax consequences.<br />

How do I mitigate employee concerns<br />

over change and instability?<br />

A potential merger or acquisition can be an unsettling<br />

time for many employees. Try to be open and communicative<br />

as much as possible. Give employees an<br />

honest assessment of the situation and try to involve<br />

them in the integration process. Offer them assurances<br />

and, if need be, incentives.<br />

For more information, contact John Casey at<br />

jcasey1@gmu.edu.<br />

Copyright © 2005 FCEDA • BUSINESS VENTURES<br />

3


TECHNOLOGY<br />

Employees—Leave Your Gadgets Home!<br />

By Joseph D. Grandinetti, Jr., Founder, Technology Counselor<br />

In this age of digital information, the electronic<br />

files and records of a business have become one of<br />

its most important assets. Thus, the organization,<br />

retention and security of business records and documents<br />

should be essential goals of a business.<br />

Information security (InfoSec) professionals sum up their<br />

objectives as “C-I-A” which stands for “Confidentiality—Integrity—Availability.”<br />

“Confidentiality” requires<br />

that only those persons authorized to access information<br />

can do so. “Integrity” requires that only those persons<br />

authorized to modify information be permitted to do<br />

so. <strong>An</strong>d, “availability” requires that every person who<br />

is permitted access to information can do so without<br />

interruption. The connection to document organization<br />

and retention is obvious. For example, if documents have<br />

unauthorized alterations, they have no integrity and are<br />

of no value as records or as evidence in litigation.<br />

What does this have to do with employees and their gadgets?<br />

The integrity of a business’s computer network can<br />

become compromised by employees’ use of seemingly innocent<br />

electronics. Gadgets represent any electronic device<br />

that can connect to a work PC and/or to the company’s<br />

network. The ubiquitous USB connection allows devices<br />

such as cell phones, digital cameras, digital music players,<br />

and “thumb drives” to connect to work PCs and to each<br />

other. Even the new Xbox360, whose primary purpose is to<br />

play videogames, comes equipped with USB ports and can<br />

accept connections with music players and digital cameras.<br />

Even the digital cable box on the top of your TV is likely to<br />

have a USB port. <strong>An</strong>d I haven’t even mentioned the many<br />

devices using Bluetooth technology to connect wirelessly.<br />

Every year, these gadgets get more powerful, their operating<br />

systems (software) get more complex and susceptible to<br />

malicious code, their storage capacities increase and their<br />

ability to interact with PCs and networks gets easier.<br />

Many of these devices are designed to be small and portable<br />

substitutes for PCs. It is natural that criminals and hackers<br />

will try to access the information contained on them.<br />

Hackers can plant code that can later be “awakened”<br />

and used to exploit weaknesses in operating systems and<br />

applications. For example, keystroke logger programs<br />

can record a user’s keystrokes and send the record to the<br />

hacker, who then looks for passwords and other personal<br />

information. Reston-based iDefense, a Verisign company,<br />

reported on November 15, 2005, “that hackers are on<br />

pace to unleash a record-setting 6,191 keyloggers in 2005,<br />

a 65 percent increase from the 3,753 keyloggers released<br />

in 2004 and significantly more than the 300 in 2000.”<br />

Other types of attacks may come from seemingly<br />

innocuous activities such as playing music CDs on<br />

the company computer. In November 2005, Sony<br />

embarrassingly admitted that its “XCP copy protection”<br />

encoded on 49 different music CDs had exposed<br />

purchasers who had played the disks on their PCs to<br />

serious security risks. The program embeds itself deep<br />

into the hard drive and uses “rootkit” techniques to<br />

hide itself. To compound the problem, the removal<br />

tool provided by Sony reportedly worsened the risk.<br />

These security risks create an unnecessary expense in<br />

wasted IT personnel time that could be better used<br />

elsewhere. Hackers are in a constant battle with InfoSec<br />

personnel, and InfoSec personnel don’t always<br />

win. A hacker needs only one victory to be successful.<br />

<strong>An</strong>ything less than 100 percent for the InfoSec personnel<br />

is failure. We also know that the “new” hacker is<br />

no longer some lonely teen in his room looking for a<br />

thrill, but is most likely a criminal looking to benefit<br />

financially. Just like the burglar who looks for unlocked<br />

doors, the criminal hacker looks for easy and unnoticed<br />

entry. Many businesses protect against external intrusions<br />

with firewalls and intrusion detection devices,<br />

but sometimes the most vulnerable attack is from the<br />

inside. Most systems are not looking for malicious code<br />

planted via a work PC. That is where the employee<br />

gadget comes into play.<br />

Employees are the unlocked door. Employees do things at<br />

the office they know they shouldn’t, like opening e-mails<br />

from unknown sources. How else can one explain the<br />

reprise of the Sober worm on November 21, 2005, hiding<br />

in e-mails purportedly from the FBI or ones promising<br />

photos of Paris Hilton. It is being called the worst attack<br />

of the year. It has spread because e-mails containing prior<br />

versions of the Sober worm were previously opened. The<br />

already infected computers sent e-mails that were then<br />

opened by curious recipients. If the offense does not occur<br />

in the office, many times it will happen at home—where<br />

the users make the rules. Then, when employees attach<br />

their mobile devices to their personal PCs, the code can<br />

migrate. Malicious “mobile” code has been reported and,<br />

as mobile device operating systems get closer to that of<br />

PCs, the likelihood of migration will increase.<br />

Where does this leave us? Supervisors and managers<br />

should be willing to set strict limits on gadget usage<br />

in the office. Will that make us unpopular? Only if<br />

we do not explain the reasons for the ban. In fact, a<br />

little employee education may save the company and<br />

its employees a lot of heartache (see “Employee Training—The<br />

Most Important Security Measure,” “Business<br />

Ventures,” 3rd Quarter 2005).<br />

A strong document retention and security policy can<br />

mitigate some of these concerns.When drafting policies,<br />

take into account security considerations, including<br />

employee training. It is currently popular to direct the<br />

legal department to draft a document retention policy,<br />

but lawyers usually base their policies on recent cases<br />

and legal trends. More often than not, the interplay<br />

between information security (C-I-A) and document<br />

retention is overlooked. ■<br />

Joseph D. Grandinetti, Jr. teaches information security principles,<br />

law and ethics at Keller Graduate School of Management<br />

and is the founder of Technology Counselor. For more<br />

information, visit www.technologycounselor.com or contact<br />

Joe at 703-218-4199 or joe@technologycounselor.com.<br />

Fairfax County Economic Development Authority<br />

8300 Boone Boulevard, Suite 450<br />

Vienna, VA 22182-2633<br />

Presorted Standard<br />

U.S. Postage<br />

PAID<br />

Permit No. 6353<br />

Merrifield, VA 22116

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!