The question was along the lines of reasons for deploying an extranet.  Whilst the question was targeting SharePoint, the technology platform is somewhat irrelevant in this response. Here goes…

The response:

Most organisations I work with have an extranet for working with third parties, be they customers, suppliers or partners. Extranets require Internet access but differ from normal web sites in that access is always restricted to a limited audience and always requires a login account.

The uses usually fall into two categories:

1. To collaborate on content: jointly edit items such as documents, web pages, list items etc.
2. To share content: Upload and download finished items for viewing

At least two key decisions are the same regardless of industry or size of organisation:

What type of extranet is needed?

• Shared content: content either exists on the intranet or, if third party access is required, exists on the extranet so that everyone can collaborate (make edits). The extranet is isolated from the Intranet so that third parties can only access extranet content.
• Copied content: content is copied from the intranet to the extranet for sharing (not collaborating) with third parties. As with Shared, the two systems are separate. The difference is duplication of content.
• Merged content: No differentiation between intranet or extranet, it is just one system. Your login determines what content you can see. At a basic level, it will identify if you are internal or a third party and apply restrictions as appropriate

That third option is a relatively new development and most organisations are not yet comfortable with the idea of merging their intranet into their extranet. Expect that to change a lot over the next three years.

I presented at an Ovum event last November on the topic of imagining future intranets (more on that, including slides, in another post). One great question afterwards was ‘Will we see the intranet go away and be replaced with an extranet style login accessed from the web site?’

In time I think it will be normal to have 3 levels of login to access web sites on the Internet, all visible in the usual login links area of a web page (top right corner is the most popular):

1. No login required – you see a limited set of data published for anonymous viewing, read-only. With legal issues arising around cookies to track user activity without the user realising, there will be less and less of this content available from companies…
2. Open login required – access to more data or to interact with content (post comments, upload/download stuff). Bit like logging into Twitter or Facebook.  Companies prefer it to improve tracking user activity. Any user can create a login account.  They agree to Ts & Cs and the account is automatically activated. In some instances, payment is required first…
3. Authorised login required – authorised to access company information, merged intranet/extranet content. The account creation process includes a review to approve/decline and, if approved, to assign the correct role (employee, partner etc.) as well as more granular group permissions (department and team memberships).

Where will the extranet be hosted?

• On-premise deployment – i.e. dedicated servers installed and managed, either at the organisation or outsourced. Some may call the latter ‘private cloud’. I don’t. It’s a bad name because it confuses people and ignores the difference between managing your own servers versus subscribing to an ongoing service. You will incur hardware, software and maintenance costs as a minimum.  You choose when to upgrade/replace the hardware and software.
• Online service / Cloud Computing – subscription(s) to services hosted over the Internet regardless of what servers are needed to run them. You incur monthly or annual subscription costs, usually per user but can also be per organisation.  Software running the service is automatically upgraded by the provider, you may get to choose when within a limited time period but the upgrade will happen.
• Hybrid – combination of the above two.

An on-premise extranet is usually an expansion to an existing deployment, either a dedicated farm or ring-fenced area within the same farm to be able to apply different security policies.  It is currently the most popular scenario…

…however, growing in popularity is to keep the Intranet on-premise but consider hosting the extranet online, i.e. the hybrid. In this scenario, it’s important to have a strategy – do you tend to keep with the same vendor (e.g. SharePoint Server installed on-premise, SharePoint Online subscribed to online), or do you use different vendors (IBM Lotus on-premise, Salesforce online).  The choice will affect the features available to you, training requirements and total maintenance costs.

Security concerns with online services/cloud computing are a mute point for extranets. The same as they are the minute you send emails to recipients outside your organisation. There are three main criteria when evaluating on-premise vs online for extranets:

• Cost comparison: including licences and server maintenance (online isn’t always cheaper…)
• Feature comparision: Most online services are not identical to on-premise software products, even when provided by the same vendor. Training will need to be a consideration.
• Strategic direction: If you already anticipate a future in cloud computing, the extranet and email services are the first two logical systems to start with, given content in them already flows in and out of the organisation.

And there you have it. A quick summary of the two key decisions that should be made when planning to deploy an extranet: what type of extranet do you need and where will it reside?

When looking to apply these tips to organisational web sites, it helps to jot down what the primary goal of the site is: is it to help share stuff, to get people to complete something like a form or task, to help find out what’s going on? Spot the common element in those requirements. How people are able to use the site will determine its success, not the colour of the tabs.

If you’d be interested in finding out more or using the templates to help with your own designs, please contact me for details.

My slides were created to support the talk, not prop me up so don’t work well on their own. Here are some notes about what I said on the day:

Disclaimer: it’s a summary

First of all, this talk was for just 40 minutes. Meaning there was only time for a very high level summary, most of which was based on my opinion. If you were looking to be convinced that SharePoint is terrible for records management, you will hear what you want to hear. (Originally, I was asked to compare SharePoint with open source for records management.)

The Good

There are a bunch of new features in SharePoint 2010 to support records management:

• Document IDs provide permalinks that will work even if you move the documents to different sites, perfect if you want to manage records in a centralised store rather than in-place within collaborative sites. They are configured per site collection, which needs to be taken into consideration when designing your SharePoint deployment.
• SharePoint includes some new workflow actions that can be used for managing documents and records. ‘Lookup manager for user’ will query the User Profile Service. Provided you have a well populated directory sync’ing with the User Profile service, you can actually look up any properties, but manager is great for automating approval processes. ‘Replace list item permissions’ can be used to automatically set item permissions during the workflow. Means you can set the user’s permission to read-only whilst the manager can still edit during that approval process.  And when the document is finished, you can now automatically declare the document as a record, locking it for everyone.
• Being able to configure a retention stage was available in SharePoint 2007. But now in 2010 you can configure multiple different stages, which provides a much more realistic solution. The example in the slide: review a document every 2 years, after 12 years send it to the archive.  New in SharePoint 2010 is a Content Organiser as part of the centralised Records Center. It can route incoming items and store them as part of a file plan. Users don’t need to know what retention settings are, provided they describe what the document is, e.g. a contract, or it’s status, e.g. confidential, the Content Organiser can be configured to automatically decide where to put the document. Placing in a certain folder can then automatically inherit additional metadata properties, such as retain for 6 years from date last modified if it’s in the Financial Documents.

New to SharePoint 2010 since July 2011 (requires SharePoint 2010 with Service Pack 1) is a big jump in scale options. Previously, life was happier if all site collections were kept to under 100GB and content databases kept to 200GB. In rare exceptions, you were allowed to grow a single site in a single site collection in a single content database to 1TB.  Now, the 100GB/200GB limit is still recommended for highly active sites and deployments with only basic disaster recovery/backup capabilities. But the new limits are up to 4TB for all scenarios, if you’ve got the right set-up. And you can even go unlimited for archive scenarios (where a tiny amount of content is accessed infrequently).

What didn’t make the list? Managed Metadata. I’m being a bit harsh, it’s a great introduction for information management in general. But there are to many limitations currently to get it beyond ‘OK’ for serious records management needs. For more details, see references at the end of this post.

The Bad

Licensing is an easy issue to pick on.  It applies to most Microsoft products deployed in organisations.  As well as choosing which server product to use, you also need to pick the type of CAL, and the options vary if being deployed internally versus externally.  External use has a special Server licence that is different (i.e. a lot more expensive) than the internal Server licence but doesn’t require a CAL whereas internal servers do.  If allowing external use, you’ll be needing ISA Server, ForeFront or other technologies to secure access over the Internet. You may be considering the full FAST product and chances are you will still be using Office for creating and editing documents. Which leads on to Office Web Access – enables Office documents to be opened in a web browser as part of a SharePoint site but isn’t part of the SharePoint licence, it requires an Office volume licensing agreement (no prizes for guessing why).

Getting started is the next challenge. SharePoint is a platform and building a records management solution using its features takes a fair bit of planning and configuration.  And comprehensive solutions usually require additional software from specialist partners. Microsoft’s own records management deployment uses partner solutions to manage the full records management process.

And, as with many Microsoft products, cross-platform support is currently weak. It’s a step-up from SharePoint 2007 in that you can now open SharePoint 2010 sites using non-Internet Explorer browsers. But try viewing on an iPad, it’s not just Flash that isn’t supported (SharePoint uses a fair bit of Silverlight, Microsoft’s equivalent to Flash) and SharePoint default user interface is definitely not touch-optimised. Almost certainly to improve in future versions, but for now a definite gotcha. And beyond devices, organisations that are primarily on Microsoft products will have a far easier time deploying than those using other servers, operating systems and applications to be integrated.

Options

As to whether or not organisations should be considering alternatives to SharePoint. There are a number of criteria to consider:

• Platform vs Niche: is records management the primary purpose of your organisation? Then you probably should evaluate niche solutions that specialise. If it needs to be considered as part of a wider remit of information and knowledge-based activities, then a platform is likely to have better value. SharePoint is a platform. It’s not the only one.
• Proprietary vs Open Source: If you’re anti-proprietary solutions, then you’ll answer this for yourself. From a solution perspective, the main difference is that proprietary solutions tend to have limited lifespans that require upgrades where as open source solutions can be self-maintained for as long as you want to. Whether that’s a good or bad thing depends on if there is a reason for the upgrade, such as changes in security needs.
• On-premise vs Cloud: Is still a very immature discussion at this stage.  And the cloud-options beyond basic file storage are very limited. SharePoint Online does not have the full feature set of the on-premise server – there is no Records Center, only in-place records management.

The Ugly

This section was less about SharePoint and more about the challenge of records management.

First up, are we talking about records management or information governance?  It’s important to define, very specifically, what you mean by records management because that should then drive the technology choice. The hypothetical example I used to demonstrate: (The slide is missing its animation build on Slideshare.) A lorry driver decides to do a friend a favour (agreed via email) and fit in an extra delivery on his route. The tachograph would record this and prove that he drove over hours (as would the unofficial email).  A tachograph must be kept for 28 days. If a court case started before the 28 days are up (hypothetical, remember), the lorry driver would commit an offence if he failed to produce the tachograph, even if the actual day in court is after the 28 days are up. Whilst the email may also become a record as part of the court case, that only happens if it hasn’t been deleted (emails don’t have a defined retention).  Failing to produce the email, if you still have it, would also be an offence.  If the court case starts after the 28 days, neither the tachograph or the email are required to be kept. If they’ve been deleted, they can’t be used in court. But again, it’s an offence if you just say they’ve been deleted when in fact they are still in existence.  And this is all separate to the facts of the case itself. Yes, the tachograph and email would prove the lorry driver drove for too long. But the facts are not the responsibility of records management. If they are, then you don’t have records management, you just keep everything for ever and accept the cost of retrieving all relevant items if and when they are required in a legal matter. Good luck with that.

When we started moving from paper to digital records, the volume of the problem began to grow because technically any piece of information can be considered a record during a legal matter.  Social networks have grown the challenge exponentially. You can only manage your own content, you have little or no control beyond your organisation’s walls.  An email always exists in at least 2 places. Are you making sure people are aware of what they can and can’t post on public web sites?  Once something exists on the Internet, you cannot guarantee it is ever removed.

Massive data is where we are heading – great globs of different types of the stuff with new tools appearing to mine and manage it.  Where does records management fit in this context?  The same can be asked of SharePoint. Whilst its scale is improving dramatically, can its current architecture handle massive volumes of information? We are seeing new storage methods being used by sites such as Facebook and LinkedIn, moving beyond the traditional hierarchical stores and relational databases.

And finally, the Achilles heel of any records management system is not the technology you choose to use, it’s the people you choose to employ.  Most news headlines don’t talk about a system failing to delete something or deleting something it shouldn’t have. They are usually about a human taking information out of the system and sharing it with someone they shouldn’t, or losing the device the information has been stored on. No technology is going to solve that problem without creating a bigger problem in the process.

Summary

Records management should be about two requirements: 1. keeping and disposing of formal documents, i.e. those that have a defined retention; and 2. ensuring any information (formal and informal) used in a legal matter is not deleted whilst that legal matter is in progress. Everything else is about information governance. Few organisations outside of a legal context do this well because it is still an immature solution and technology is only part. of that solution

People are likely to cause you more headaches than the technology. Some level of training is essential to remind people about how they manage their information. Still worried? Then invest in automation and autoclassification technologies to eliminate as much of the human element of the process as possible.

Decide on your deletion policy (or strategy).  If you want to be able to prove when someone is lying in court, then accept that you are going to spend a lot of money on keeping and classifying everything. For those with a budget, make sure you can manage what matters and get rid of everything else when you can.  Your job is not to try and prove or disprove the legal argument, it is to ensure you are able to provide all the relevant information you have kept.

SharePoint for Records Management?

To close, some tips on using SharePoint for records management.

• Don’t let people keep old documents in collaborative sites or folders.  If they are no longer being used in an active process but people still want to keep them, move them to a centralised records management site. Because if they are inactive, over time they will be forgotten making them harder to find should they become relevant in a legal matter.
• Consider using document IDs for formal documents if they are going to be moved to an archive at some point (note: this assumes they stay within SharePoint).
• Leverage the features to automate as much of the processes as possible. It will take time to configure but the effort will minimise errors and ease records management procedures
• Linking into the previous slide, if you investing in autoclassification, you need more than just SharePoint. Either the full FAST product, which includes autoclassification, or an alternative solution that integrates with SharePoint.

References

• Trillions video by Maya, Vimeo
• SharePoint Taxonomy Limits – blog post, Sep 2011
• SharePoint Performance and Capacity Limits – blog post, Aug 2011
• SharePoint and Office Web Apps – blog post, Jul 2010
• Rethinking the File Plan – blog post, Mar 2008

The emphasis of the latest one is on productivity enabled by interactive screens everywhere with easy real-time updates enabled by cloud computing. Whilst I doubt we’ll all be able to afford interactive table tops and fridge fronts in our kitchens for a while yet, it does remind me of a quote Bill Buxton (Microsoft Research) made a couple of years ago in a talk about the influence of technology on education:

In the future, interactive screens will be cheaper to buy than today’s whiteboards

Can’t remember the timescale he specified but the quote stuck, imagining how much better mainstream education could become.

Here’s the latest video

It follows on from one produced 2 years ago showing similar concepts:

But how accurate are visions looking 10 years into the future? Here’s an old one from 2001 that someone has posted to YouTube. Spot what’s in – speaking to your computer, oh so Siri like; and what’s not – no touch (just keyboard, mouse, stylus), not much improvement on the monitor front, tablets for travel only (home = PC) and memory cards not cloud storage for sharing files

But whilst most vision videos can be taken with a pinch of salt, they can help inspire improvements in how we use technology in the present as well as the not so distant future.

Catching up on podcasts, I was recently listening to ‘An hour with Bill Buxton’ recorded at Microsoft’s Mix conference in 2010. Bill Buxton is Principle Researcher at Microsoft Research and an early pioneer in human-computer interaction.

During the session, he talked about the need to compromise in design.  Describing the process of constructing a new building, he described three roles that must work together if the building is to be a success: the architect, the businessman and the structural engineer.

(Note: the focus on the talk was how software design could use a little more focus on structural engineering compared to the preference to focus on architecture – you can still listen to or download the talk, link at the end of the post. It includes some great discussions about the process of applying design thinking to technology solutions).
One of the examples Bill gave was how the structural engineer could advise on different materials that may influence what options the architect has to create a design. The architect may come up with a design that is too expensive but instead of changing it, the businessman could suggest adding floors that could be rented out to help pay for the extra cost.  Working alone would result in far bigger compromises than working together – a design that is so expensive it isn’t built, a building that isn’t safe or safe but unsuitable for the purpose. The image at the start this post is a Gaudi building in Barcelona. We are unlikely to see such elaborate buildings become common place. Its compromise is cost and functionality – imagine trying to put an extension onto any of his buildings.

Good design means the appearance of an object is created with consideration to, or in conjunction with, function and purpose. The goal should be more than being admired for looks. But that also goes both ways – is the demand for features forcing an ugly design, that impedes the usefulness (and ultimate goal) of the object?

An example of this is comparing Apple and Microsoft. Apple will remove features that people consider essential to ensure its products are beautiful and easy to use.  Microsoft will cram in every feature any customer ever wanted, but this can result in products that are complicated or suffer poor usablity.  In both cases, compromises are being made. It is a fine balance to create an object that is both beautiful and true to its purpose. Arguably, Apple has been the more successful to date in achieving this goal. See the end of this post for a funny parody of what might have happened if Microsoft had designed the iPod.

The makers of the film Wall-E describe the process of deciding whether or not Wall-E would have elbows. How could they convey emotions using his arms if he didn’t have elbows?  (hoping keeping within 30 seconds is fair use and doesn’t upset the copyright folk…)

Adding elbows spoiled the remit of the design (watch the clip in full for more details – it’s on the Wall-E extras DVD). So they found a compromise which was to make his arms move up and down his ‘body’. Arms are up when he is active or happy, doing stuff and waving. When his arms slide down, it looks like movement from the elbow and is used to show he is focused on something or worrying.

At a simpler level, PowerPoint is often getting a beating for making people sit through poor presentations – death by bullet point.  It’s not PowerPoint’s fault people try to cram too much content on too many slides to be delivered in too short a time.  Some people have started applying a bit more creativity. But are they designing their presentation or creating a piece of art? Replacing bullet points with stunning images only works if those images enhance the message being delivered. The fault isn’t always with the bullet points. The image above is of a slide from a recent Gartner presentation talking about the steps you need to take when considering a move to cloud computing. The image in the slide is basic clipart. And it is effective. Step one – look in the mirror, evaluate your organisation’s capability to move to cloud computing.

The reason for thinking about all this? I have had a couple of challenging conversations with clients recently. In both cases, the client had created a ‘design’ for their systems. But they were creating visual layouts without any consideration to the impact on functionality.  The designs looked great but would introduce unplanned cost (to implement and maintain – both require custom code), risk (that code) and impact key functionality in the system. A follow on post will look into possible guidelines to help balance form with function.

To close, that parody:

References

• An hour with Bill Buxton – Mix 2010
• Bill Buxton’s profile – Wikipedia

Last Thursday, students found out their A Level results that would, for many, determine if and where they were going to university. For those who didn’t quite make their grades, the first port of call is UCAS – the University and College Admissions Service – to go through the clearing process, i.e. find a university with places available that will accept their grades.

The UCAS web site crashed.

Everyone knew this year would be busier than normal due to next year’s rise in tuition fees. As well as the normal intake there were going to be those who chose to delay a gap year and those who managed to take their A Levels early, all to avoid starting next year and facing a hike in fees (potentially an extra £17,000 for a 3-year degree).  Yet UCAS decided to just double their capacity.

From The Times on Friday 19th September:

The organisation said that it was taken by surprise by the numbers attempting to log in. At one point, there were 450 hits per second – four times as many as last year.

Ms Curnock Cook [Head of UCAS] said that despite doubling its staff and website capacity the service was on the brink of being unable to cope with demand.

“I don’t think anyone anticipated [such high demand]. We were not ready for a quadrupling of our capacity…”

Was there ever a better example of why public sector web-sites should be running on a cloud computing platform?  Where resources can be scaled up and down to meet occasional peaks in demand.  It happens to HMRC each January 31st as people rush to get their tax returns filed online in time.  Schools web sites struggle each year when they allocate school places.  I’d guess the NHS has its share of demand during seasonal festivities. Each peak occuring at a different time of year, all could benefit from a shared ‘on demand’ platform.

And it’s not just been a bad week for public sector web sites.  HP made a rather massive announcement on Thursday, breaking news that they are pulling out of the consumer hardware business just weeks (and in some cases days) after launching their new tablet device. The new focus being on infrstracture, software and services.  By Saturday, rumours began to spread across the Internet of a ‘fire sale’ dropping prices from $399 to $99 to get rid of the stock.  And the HP web site crashed under the demand. As Larry Dignan pointed out, you’d think an infrastructure specialist would know better…

Some of the cloud computing vendors are doing nothing but talk about cloud. Cloud this, cloud that, cloud everywhere.  There’s a long road to travel before cloud computing becomes pervasive, just as mainframes didn’t disappear overnight when the PC arrived in the workplace.  But some scenarios would benefit more from cloud computing than continuing with traditional methods, in the same way some uses of mainframes dropped rapidly as PCs offered new cheaper and more flexible ways of working with information.  If you’re in a business that can suffer seasonal peaks in demand on your web site and it matters, think about how that site is hosted.

References

• Universities slam door on 90,000 applicants as competition intensifies – Joanne Sugden and Greg Hirst, The Times (iPad edition)
• HP’s TouchPad Fire Sale: The Fallout – Larry Dignan, ZDNet

Related blog posts

• When to walk in the clouds – Nov 2010
• Cloud computing priorities – May 2010
• Private Public Sector clouds – Mar 2010
• Change is coming – Jan 2007

Further reading in the notebook under Cloud Computing (about), Cloud Services (providers) and Cloud Cases (examples).