Do I need an app?

This is the question I hear from many organizations these days. Whether they’re selling a product or whether they’re offering a service or even just as a way of getting ahead of the competition, they all ask whether they need an app for smartphones and tablet users. And although, at first glance, the answer would seem to be yes – it is 2013 after all – it’s important to drill down to find out exactly what each organization really wants.

So, let’s think about what question having an app is the answer to. For some organizations, it’s simply ticking the box saying people can download our app. But that begs the question about what are they going to use the app for, and, perhaps more importantly, will they ever use the app? We’ve all got apps that we excitedly downloaded and just sit there unused on our smartphones and tablets! And that isn’t good PR.

For other organizations, an app is a way of saving money. Think about it, if a client comes into your office and speaks to someone, let’s say that interaction costs £15. If they phone up, let’s say that costs £7.50, but if they do everything online, that costs, say £1. So an organization that moves its customers and potential customers online will save huge amounts of money. Having an app allows people to buy an item, book a visit, or whatever from their phone as easily as from a laptop.

For many people, online banking, online shopping, booking something, Facebooking, Tweeting, texting, etc are very familiar and, these days, second nature. People who aren’t quite so mobile-savvy are more likely to pick up a phone and ring than they are to use other alternatives such as choosing from a menu on their TV and trying to type a message using the TV remote control.

The next question for organizations to ask is whether they want to develop an app and continue with their Web site, or whether they want just a mobile Web site. People familiar with CS6 Dreamweaver will know that the software allows ‘fluid’ design, so users can create a style sheet that applies to smartphones, tablets, and standard Web pages. The same text appears on all three devices, but the layout adjusts – depending on how the designer wants it to look. One thing to bear in mind at this stage is that whether you choose an app or mobile Web site, users will expect a very high standard. And if their transaction doesn’t work first time, they will probably not bother trying again. So whatever a company chooses, they need to get it right.

If you do choose the app route, then your organization will need at least two of them – one for Android and one for Apple devices. And then you may want a Windows app, and a Blackberry app, and who knows how many other variants may be required.

Although an app designed for a device will probably be easier to use, using a mobile Web site means the look-and-feel will be the same on every device and will be available on every device (even the more obscure ones) immediately. This is called being platform agnostic. Another advantage of an app is that data could be browsed offline. But with the prevalence of wifi hot spots these days, that’s not such a big deal. Of course, regular users might be happy with an app, but a casual browser may not want to download an organization’s app for a single use. For the organization, they can push out information using the app, which they can’t with a Web site – unless people sign up for the e-newsletter.

A simple compromise is to build an app that takes people to a useful landing page on your mobile Web site. And make sure it works

SharePoint 2007 site collection auditing

We start the year with another in our series of SharePoint hints and tips from our expert Darren Pritchard. This time he’s looking at how to sucessfully audit SharePoint site collections.

To enable/disable SharePoint auditing:

1. Open the site that you wish to audit
2. Click ‘Site Actions’
3. Select ‘Site Settings’
4. Click ‘Modify All Site Settings’
5. Under ‘Site Collection Administration’ you have ‘Site collection audit settings’
6. You would see Figure 1.
7. Here you can select what you wish to audit
8. Be very careful, SharePoint will not automatically purge these audit logs. They will continue to grow as long as they are enabled. I have seen content databases with 80GB of audit files!

Figure 1: Configure Audit settings page

To trim audit files:

1. Create the batch file shown in Figure 2. Note: CONTENTDATABASE is the name of the database within SQL.
2. Save it as ‘Purge Audit Logs.bat’
3. This will need to be run on your SharePoint Web frontend server as an Administrator. Do not be alarmed if it takes a little while to run. The time it takes depends on the amount of audit logs you are trying to trim.

SET STSADM="c:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\bin\STSADM.EXE"

%stsadm% -o trimauditlog -date -databasename

Pause

Figure 2: Purge Audit Logs.bat

I would suggest running this on a system without users because it may have an impact on performance.

If you have large amounts of audit log files, I would recommend running the trim command on a month’s worth of audit logs at a time. The SQL transaction log file will grow very large during the trim process.

Once you have trimmed the audit logs you will need to run a shrink database task within SQL to reclaim the space used during the trim process.

I'd like to thank Darren for his continuing contributions, and a happy New Year to everyone.

Create custom permissions – for SharePoint

It’s been a while since we’ve published one of iTech-Ed Associate Darren Pritchard’s SharePoint 2007 beginners’ guides. This time he’s explaining custom permissions and how to create them.

Let’s start off by defining what we’re talking about. Specifying custom permission levels give you more control over the degree of access users can have to SharePoint sites, site collections, or site content. In effect, you create a new security group.

So, let’s run through the steps:

1. From the site collection click ‘Site Actions’ 
2. Click ‘Site Settings’
3. Under ‘Users and Permissions’ click ‘Advanced Permissions’ 
4. You will then see a list for permission level group
5. Select the ‘Settings’ drop down
6. Click ‘Permission Levels’
7. Click ‘Add a Permission Level’
8. You will then be able to create your own security group.

It’s worth remembering that only this site and all its sub-sites will have access to your new group.

Below is a list of permissions that can be set. Please note that selecting one may also result in others being selected because they are required as part of your selection.

List Permissions:

• Manage Lists – create and delete lists, add or remove columns in a list, and add or remove public views of a list.
• Override Check Out – discard or check in a document that is checked out to another user.
• Add Items – add items to lists, add documents to document libraries, and add Web discussion comments.
• Edit Items – edit items in lists, edit documents in document libraries, edit Web discussion comments in documents, and customize Web Part Pages in document libraries.
• Delete Items – delete items from a list, documents from a document library, and Web discussion comments in documents.
• View Items – view items in lists, documents in document libraries, and view Web discussion comments.
• Approve Items – approve a minor version of a list item or document.
• Open Items – view the source of documents with server-side file handlers.
• View Versions – view past versions of a list item or document.
• Delete Versions – delete past versions of a list item or document.
• Create Alerts – create e-mail alerts.
• View Application Pages – view forms, views, and application pages. Enumerate lists.

Site Permissions:

• Manage Permissions – create and change permission levels on the Web site and assign permissions to users and groups.
• View Usage Data – view reports on Web site usage.
• Create Subsites – create subsites such as team sites, Meeting Workspace sites, and Document Workspace sites.
• Manage Web Site – grants the ability to perform all administration tasks for the Web site as well as manage content.
• Add and Customize Pages – add, change, or delete HTML pages or Web Part Pages, and edit the Web site using a Windows SharePoint Services-compatible editor.
• Apply Themes and Borders – apply a theme or borders to the entire Web site.
• Apply Style Sheets – apply a style sheet (.css file) to the Web site.
• Create Groups – create a group of users that can be used anywhere within the site collection.
• Browse Directories – enumerate files and folders in a Web site using SharePoint Designer and Web DAV (Distributed Authoring and Versioning) interfaces.
• View Pages – view pages in a Web site.
• Enumerate Permissions – enumerate permissions on the Web site, list, folder, document, or list item.
• Browse User Information – view information about users of the Web site.
• Manage Alerts – manage alerts for all users of the Web site.
• Use Remote Interfaces – use SOAP, (Simple Object Access Protocol) Web DAV, or SharePoint Designer interfaces to access the Web site.
• Use Client Integration Features – use features that launch client applications. Without this permission, users will have to work on documents locally and upload their changes.
• Open – allows users to open a Web site, list, or folder in order to access items inside that container.
• Edit Personal User Information – allows a user to change his or her own user information, such as adding a picture.

Personal Permissions:

• Manage Personal Views – create, change, and delete personal views of lists.
• Add/Remove Personal Web Parts – add or remove personal Web Parts on a Web Part Page.
• Update Personal Web Parts – update Web Parts to display personalized information.

Armed with that information, you’re now in a position to try to create a new security group and give a person or a group of people a different level of access from what they had previously.

Steganography

I’ve been variously involved in securing mainframe data over many years. I’ve looked at encryption of data, External Security Managers (ESMs), certificates, and public key encryption at various times. I’ve only recently become aware of steganography and how that can be used to send covert information in plain sight!

Steganography means concealed (the “stegano” bit) writing (the “graphy” bit), and there was a book about it written in 1499 by Johannes Trithemius – although not published until 1606. Trithemius was Abbot of Sponheim, but, even so, the Catholic Church banned the three volumes of his book (called Steganographia) for almost 300 years. So that must give you a clue as to how difficult it would be to control the use of hidden messages by ordinary people – you and I really!

Here’s an example – this week’s shopping list:
Allspice, lemon, banana, avocado, peanuts, strawberry, pomegranate, sweets, anchovies.
 

You’d look at that and think there’s nothing hidden in that list. Now look at it again:
Allspice, lemons, bananas, avocado, peanuts, strawberry, pomegranate, sweets, anchovies
 

It says LEAVE TOWN. Obviously more complicated messages could be included if I had a longer shopping list – but you get the idea.
 

But there’s an even better and more modern method of steganography – and that’s using images. You can hide messages in the least significant bit in an image. I have hidden a message in the photo below. Can you read it?

 If you want to create your own hidden message, you can have a go at http://mozaiq.org/encrypt/. You can also read hidden messages by clicking on “tools” from the menu and “decrypt”.

The pixels in 24-bit images have their colour defined using three numbers. There’s one for red, one for green, and one for blue (RGB). Making a small change to a pixel alters its colour but not so much that the human eye will detect the change. These small changes can be combined to give the ASCII code for a letter – and those letters when put together give a word, a sentence, a complete hidden message. It would be completely plausible that the images in an innocent Web site could contain messages for banned organizations. Those pictures on the MI5 Web site could actually be coded messages to UK operatives (with Internet access) across the globe. But think how many other Web sites could contain coded messages – just who could those messages be for?
 

Almost any message that can be send – any picture, any digital message, any written or printed message – could contain a hidden message in it.
 

I’m not trying to make your paranoia worse, I just thought it might be worth checking those images, or reading every second character in a list (or third or fourth!), and making sure someone isn’t sending a message from your Web site that you don’t expect.
 

Sleep well!