Light Speed IT Solutions blog posts

Outsourcing IT Services Within The Uk

Ruth Smith — Mon, 23 Jan 2012 16:00:00 GMT

Many UK companies are now considering outsourcing IT services within the UK. Some of them are doing it in addition to their offshore outsourcing developments, while others are simply supporting the economy by involving themselves with local suppliers. In the previous blog I was discussing about advantages & disadvantages of offshore IT Outsourcing. A few days back we interviewed some of our clients regarding their experience with offshore and onshore outsourcing providers. This blog will include some of those interview responses.

One of our clients Steve said “Driving from Surrey to Maldon is much cheaper than taking a flight to India. Sometimes we need to bring the developers onsite to show them what our other applications are like and what quality and style we prefer. We need to give them proper training before handing over the responsibilities. Companies which are relatively smaller like mine could never afford to do it with someone from overseas.”

According to another client Erick, it is very important to have feedback from the outsource providers. From his previous experience he observed that developers from overseas do exactly what they are told, they are never comfortable to give their own opinion if the client is wrong. This is due to the cultural difference and there’s very little which could be done to improve this.

“If we are allowing someone to work on our back office solutions, we have to be sure that they comply with the data protection legislations. I can never have peace of mind letting someone from a different country handle all our sensitive information. If we do not have the resource in house, I would rather hand over the work to someone who is bound by the same law as us.”- said one of our clients from a government agency.

“When I outsourced my first project to a company in New Delhi, I had really high hopes. The agents brainwashed me saying that the developments costing £300 a day can be done for £10 a day in India. It did sound too good to be true, but I fell for it. I was not aware of all the hidden costs at all. The exchange rate of Indian Rupee had a big impact on my profit. I was really disappointed as the quality of the work was not what I expected. I have a feeling that the biggest barrier was the language. Even though they were fluent in English, they had trouble understanding my English accent and I struggled to understand their strong Indian accent too. At the end of the day, I had to hire a local agency to clean up all the mess they created. If I could go back in time I’d outsource from a local company to save all the trouble I had.”

The truth is, no one makes 200% profit by outsourcing work abroad. Why not Share your offshore outsourcing stories with us. We might include them in our next blog!

Advantages & Disadvantages of Offshore IT Outsourcing

Ruth Smith — Thu, 19 Jan 2012 17:12:36 GMT

Following our recent white paper on Outsourcing, this blog series will discuss more about outsourcing of Information Technology. Previously the conflict was between doing the job in house or outsourcing. Nowadays, outsourcing has become such a hot trend that the conflict is between choosing onshore or offshore outsourcing.

Offshoring is simply the exporting of business functions to another country. Currently the major players in offshoring are India followed by Philippines and China etc. Offshoring has been very popular mainly because of reduced cost and tax. Some of the advantages of offshoring are-

Cost: Cutting cost and taxes is the main reason behind companies embracing offshoring. Companies can save on labour cost, employee supervision and management cost, office space and equipment cost and so on.
Exploiting the Time Zone Advantage: Offshoring gives companies the advantage of exploiting the time zone by receiving round the clock benefits.
Flexibility: Offshoring provides the companies with certain flexibilities including eliminating hiring and termination costs in the UK.

Lately Offshoring has been criticized due to jobs moving out of the UK resulting in job losses. Despite the advantages and cost benefits that offshoring offers, it involves risks which need to be considered in detail otherwise the disadvantages may dominate the benefits. Factors to consider-

Political climate: Political climate in foreign countries is a big source of uncertainty as these can be unstable at times. Changes in government policies can increase the expense.
Differences in work practices and culture- A huge difference always remains in the work practice and culture which are hard to overcome
Hidden costs: Often the hidden cost like fluctuating exchange rate and legal costs are difficult to calculate in advance. Differences in currency rates affect the profits.
Communication Barrier: It is often difficult to communicate with companies in other countries that speak a different native language. Face to face meetings are very expensive to conduct and video conferencing may not always be convenient due to time difference.
Finding good offshore partners: It can be hard to find a good IT provider based on the reviews on their websites and few teleconferences. It is not easy to make a good judgment without proven track record of working for other international companies and authentic references.

Despite of many challenges and drawbacks offshoring outsourcing will remain an attractive solution to many companies. We suggest companies develop strategies to overcome the risks to reap the maximum benefits of offshoring or consider onshoring for saving money and complimenting work flow.

The Dangers of Social Engineering

Craig Pilgrim — Thu, 22 Dec 2011 12:27:00 GMT

Asset Allocation by its nature is a risky business attempting to make money through investments such as shares, equities and funds. With this in mind it makes sense to ensure every other aspect of the company is as safe as possible to prevent further risks and dangers.With this in mind let me set the following scene:

'Imagine you arrive at work in morning and are just about to enter the building when you see a delivery person struggling with the door'

It’s human nature to try and be helpful (at least for most of us); in this situation it would mean holding the door open so they can get through easier. Of course in a perfect world this is fine but what if that delivery guy you let into the building was in fact a ‘Hacker’, you would have just given them access to the building and potentially the network of your business.

This type of attack is known as ‘Social Engineering’ and it preys on people’s good will. These sorts of attack go beyond the ‘Tail Gating’ example mentioned above and can actually become quite smart in the way they work. Someone confident in the art of Social Engineering might even attempt to directly contact a member of staff pretending to be in a position of authority to gain information on their target (an act known as ‘Reverse Social Engineering’). Obviously this works better in larger organisations where there is less personal contact between the lower and higher levels of the workforce.

As soon your network is compromised internally it no longer matters how much your company has spent on fancy Firewalls and advanced Intrusion Detection Systems because the damage is probably already done. Trojans might have been put in place to allow the hacker a Backdoor for easy access to the network again, Key loggers could have been installed on a target system or personal details might have already been taken from the database. These are things that you really don’t want to have to worry about when you are trying to focus on complex Asset Allocation procedures.

There’s nothing that can really stop these types of attacks from happening but you can do your best to prevent them. This amounts to one thing really; Training and knowledge sharing. You need to set out clearly in the operational procedure of the business the sort of things to be aware for; i.e. Do not let unauthorised personnel into the building, always lock your computer (with password protect) whenever you leave it for a prolonged period of time and never ever give your password out to anyone.

Fund Administration and the Security Triangle

Craig Pilgrim — Tue, 20 Dec 2011 12:43:00 GMT

Fund Administration is defined as “the set of activities that are carried out in support of the actual process of running a collective investment scheme”. If you strip this down to its most basic elements it basically leaves you managing someone else’s money for them. As soon as you start looking after someone else’s money priorities drastically change.

When you consider security with regards to development for Fund Admin applications it is difficult to not consider the ‘Security Triangle’ (shown below):

In an ideal world your project would sit dead in the middle of this triangle representing a perfect harmony of the 3 aspects; however this is rare because the sections do not always complement each other that well. When considering fund admin theme this becomes clear; obviously you want to protect the data as best you can from unauthorised access by malicious users and the best way of doing this would be to implement a strict multifactor login process. However by increasing security it means you are decreasing ease of use because the user has to go through all of this before they can even access to application.

There is always going to be a compromise between these factors and it’s down to the nature of the project you are working on that will determine how this is decided. For more information on fund administration click here.

Top 5 Security Tips

Craig Pilgrim — Tue, 13 Dec 2011 12:05:21 GMT

Having recently attended a course in Ethical Hacking it has made me dangerously aware of just how flawed some security systems can be. More specifically if you have ever found yourself working on a project developing financial software it is guaranteed that you will have to deal with (and in turn protect) delicate personal information. This said I thought I would try to compile a top 5 security checks you should keep in mind while developing such projects:

SQL Injection / Cross Site Scripting – this is the biggest problem that catches most people out. In all places where a user can input data it’s important to sanitise the inputs to ensure SQL strings cannot be generated due to a rouge quotation mark.
Passwords – one of the easiest parts to not enforce in the security process is that of a strong password. Dictionary words should really be avoided seeing as they can be brute forced in a matter of minutes (this includes words with letters replaced with similar symbols i.e. ‘a’ and ‘@’). Complex passwords should be enforced by default and then particularly sensitive applications (i.e. Financial Software) should implement a multifactor log in procedure using methods such as RDA.
Employee Education – you can set guidelines in official company documents but chances are that they will get glanced over whenever an employee is asked to go though the document. Hands on education is the key to avoiding attacks based on Social Engineering techniques (more about this in a separate blog).
URL – If you are passing sensitive data or anything that can help an attacker figure out details about the file structure of your website it is important to obfuscate this part of the URL to prevent file directory manipulation based foot printing.
Windows Update – there are tools out there that can determine your OS in a matter of seconds and then compare its results against a database of known vulnerabilities. These can then be used to compromise the system in a multitude of different ways at the click of a button. In two mouse clicks you can potentially have access to someone else’s system; this can be avoided by simply keeping Windows patched and up to date.

Adding a Custom 404 Page with Sitefinity

Alex Hewitt-Clay — Mon, 12 Dec 2011 09:00:00 GMT

It's always annoying when you mis-type a URL, or click on a long-dead link to be confronted with a horrible error message:

It looks unprofessional (especially if you are a web development company), scary and leaves the visitor with nowhere to go. Much better would be your own customised 404 page, gently directing the site visitor to a more appropriate place. To get this working in a Sitefinity site you need to do three things:

1. Create a 404 page in Sitefinity. You can just make a plain, unadorned page but this "not found" area is a great place to funnel customers back to where they need to go (or where you'd like them to go!). There's lots of articles around on how to make use of your 404 page, such as this 404 guide from GetElastic.

If you have no other ideas, just add contact links, top-level navigation links or links to social media. Call the page whatever you like but for the purposes of this guide I'll pretend you called it "404.aspx".

2. Change the web.config. Add the following line to the web.config file in the custom errors section:

<error redirect="/404.aspx" statuscode="404"></error>

This will capture some of the errors. Try visiting yoursite.com/SomeNonexistentPage.aspx and you'll be presented with your custom 404 page. Great!

No time to party yet though - if you knock the ".aspx" off the end of your address, you'll get yet another horrid message:

What's happened here is we've stopped the first kind of error message which is generated by .Net. It's now bounced down the line to IIS which has also thrown it's own error-handling page. To get round this one...

3. Redirect 404 errors to your Sitefinity page. Open your site in IIS and look for the following icon:

You should be presented with the following dialogue box:

In the Status Code type "404" and in Absolute URL the full link to your error page e.g. "http://www.yoursite.com/404.aspx".

OK this screen and try it again. You should be getting your custom 404 page in all situations now! Very handy.

Cycle Clipboard Ring

Dean Pepper — Thu, 24 Nov 2011 10:30:00 GMT

When developing web applications with Visual Studio and Iron Speed Designer, I often want to store multiple items in the Windows clipboard instead of being restricted to a single item.

Did you know a feature already exists inside Visual Studio to allow this? It’s called Cycle Clipboard Ring.

When you copy text inside Visual Studio, it adds the text to its first-in-first-out clipboard ring which stores the 20 most recent items you have copied.

To cycle through this ring, you can either use the keyboard shortcut Ctrl + Shift + V, or you can click Cycle Clipboard Ring under the Edit menu, as shown in the screenshot.

Don’t forget to check out the rest of my series for more Visual Studio Tips.

14 Million QR Codes Scanned in 1 Month

Gary Fenn — Tue, 22 Nov 2011 09:47:00 GMT

Following our blog last week regarding QR codes, Top SEO Liverpool have created a very cool infographic pulling together various statistics on the use of QR codes.

There's a number of interesting bullet points to take away:

53% of users are between the age of 18 - 34
14 million Americans scanned a code in July 2011
46% who scan QR codes do it for discounts

Head on over to their site now to see this interesting graphic.

Formatting Documents with Visual Studio

Dean Pepper — Mon, 21 Nov 2011 09:47:00 GMT

In my series of Visual Studio tips, I would like to share little shortcuts and tips I have picked up over the last few years of developing Iron Speed web applications with Visual Studio. You may already know several of the shortcuts I plan on sharing, but it’s always nice discovering a shortcut you didn’t know about before.

During development, the code or mark-up can easily loose the correct indentation which makes it difficult to find where sections begin and end.

To format and indent your document according to the pre-defined rules in Visual Studio, you can use the Format Document shortcut; Ctrl + K, Ctrl + D, which will format the entire file.

If you only want to format a section of code or markup, you can instead use the Format Selection shortcut; Ctrl + K, Ctrl + F, which will only format the selected code.

Both shortcuts can be found under the Advanced option of the Edit menu, as shown the in screenshot.

This also acts as a quick syntax check as the document will not be formatted if the structure is not correct (i.e. a line has not been ended with a semi-colon, or there is a mismatch between the number of opening and closing brackets).

When bug-fixing legacy code, it is recommended to only format the section of code or mark-up which needs to be updated and leave the rest of the document in its original form. When another developer later performs a compare, or diff, operation on the code for peer review or testing, they will then only see the code that has been changed and the rest of the document will not be flagged as edited.

Cracking the QR Code

Gary Fenn — Tue, 15 Nov 2011 12:00:00 GMT

Recognise the image on the right?

If this weird mess of blobs and dots means nothing to you, this is a QR Code (Quick Response). Some text is buried within this pattern and could contain almost anything though what they are most commonly used for is a quick way to give people a link to a website. Most smartphones come bundled with an app that lets you read the code using your camera or apps can be downloaded for free. If you have a smartphone handy, try scanning the code!

QR codes are all the rage in marketing at the moment as it's a handy and useful way to get a customer to use a link when all they have is their phone nearby, so it can be used on posters, billboards, signs... you name it. Some TV programmes have been using them as shortcuts to other information, such as cooking programmes providing links to recipes via the onscreen QR code.

As a software development company we've recently finished a project for a customer revolving around these distinctive designs. Using a freely available QR code library, our customer could import a batch of URLs, have QR codes generated for them, then were able to charge their clients through the same app for them to be distributed via print. It's a clever end-to-end solution hosted in an online app with full security for handling payment details.

If this sounds like the kind of thing you need, get in touch.

Google+ Pages for Companies

Ruth Smith — Mon, 07 Nov 2011 20:00:00 GMT

The latest kid on the Social Networking block, Google+ has just opened its doors to businesses.

If you go to the Create Page link now for your business you may be able to create your own listing for your brand or business. This gives the social marketer another way to connect with their potential audience, along with Facebook pages, Foursquare checkins and all the others.

There are a few caveats to creating a page: not everyone has access to do so yet, but should be available by the end of the week (that's why there isn't a Light Speed one yet at the time of writing!). Also like a Facebook page they have to be created by someone who already has an account. However watch out - at the moment each page can only have one admin. You can't spread the responsibilities around yet.

How will you use your Google+ page to reach your audience?

Update: we managed to make our page! Find it here

Underwriting Support Specialist Vehicle Quote and Buy

Dylan Lewis — Mon, 24 Oct 2011 23:41:00 GMT

Here's a few words on a recent project we completed, to give you an idea of the some of the work we do here.

Graham Sykes of Underwriting Support was keen to exploit the power of the web to enhance his business. Graham’s company wanted an online insurance Quote & Buy system developed to initially handle specialist vehicles. He approached us with his ideas which were well thought out and on the ball. Graham had scoured the markets, but was unable to find anyone offering the service he needed to bring his ideas to the market. He then made immediate contact with us and we were able to listen to his ideas and put them into action.

Graham had already done the hard part when we'd started. He knew exactly what he wanted and how he wanted the site to work. We were able to take his ideas and from the basic outline and shape a solution that would integrate well with his existing business practises. He entrusted us to design, develop and deliver the first phase which was very well received and worked as expected. Documents were produced in PDF format on the fly and emailed to clients, back office staff and insurers as soon as the payment was taken streamlining the process considerable.

Further enhancements were made to provide multiple comparative quotes from different insurers giving the customer more choice in the buying process.

Further schemes were introduced covering breakdown cover, car boot and exhibitions.

The main website and database were all based on Microsoft technologies. The database was based on SQL Server 2000 and the web development was .Net with Visual Studio. The site was hosted on a pair of Dell servers and the database and admin facilities were hosted on separate servers all with Windows Server 2003.

Top 5 Features of Portfolio Management Software

Ben Demes — Mon, 24 Oct 2011 22:36:00 GMT

We've designed different portfolio management systems for our clients at Light Speed IT Solutions. Looking at customer needs it's easy to distill their requirements down to a few key features that make financial software just work:

Excellent filtering. By their nature these applications contain a lot of data and need versatile drop-downs to help restrict the view to only the information you need right now.
Variety of assets. To be flexible the app must allow for different investment types, such as shares, funds, properties and allow enough detail for each.
Reports. One feature requested again and again surround reports, so that the data can be summarised and presented in a variety of formats.
Exports. It's useful to be able to get the data or report out in a format that can be emailed or printed for easy reference, so exporting to PDF, Word or Excel is vital.
Responsive interface. Time is money after all, so you don't want to be hanging around waiting for the software to respond.

We've a wealth of experience in building apps with these core features, so get in touch today and see how we can help you.

A Method to Our Madness

Gary Fenn — Fri, 21 Oct 2011 22:23:00 GMT

Hofstadter's Law: Any computing project will take twice as long as you think it will -- even when you take into account Hofstadter's Law.

There are frequent newspaper articles and new reports of government or large corporate projects running late or massively over budget showing that there is some truth to Hofstadter’s Law.

Why is this case? Software development is highly complex undertaking requiring skilled people to design, implement the application and to manage the process. It is also a relatively new field of engineering. In the early days of programming, programs were small and could be written in a few days by a single person. As computers become more powerful, the size and complexity of software grew proportionally. More and more people were required to develop and manage the applications and thus the first generation of development methodologies were born. A software development methodology is a process that is used to organize, control and plan a software construction project. Ideas were taken from other fields of engineering and melded together. These proved to be flawed and there was little interest in improving them.

In recent years more and more emphasis has been placed on improving the process of development. Here at Light Speed we have invested heavily in our staff, the technology we use to build software and in enhancing our development processes.

Before describing our processes and their strengths it is useful to know the weaknesses of the most commonly used methodology.

The waterfall model on first appraisal seems quite logical and sensible but it is deeply flawed. Waterfall traditionally has five phases:

Requirements – gathering the needs of the users
Design – deciding on the structure if the application and its subsystems
Implementation – writing the code
Verification – testing the code for bugs and ensuring requirements are met
Maintenance - fixing errors after release and modifying the application to changing needs.

By looking at the stages it is clear that there is a lengthy period of time from gathering requirements to the end user testing the application ensuring that what is built is suitable. A leading cause of failed projects is that user requirements were not clearly understood and an application which did not meet their needs was delivered.

Gathering requirements is a difficult task. A software developer is an expert in his own field and the users of software are experts in their own. Each domain has its own jargon and implied knowledge. It is challenging for software developers and designers to gain a good understanding the users domain especially at the very start of the project. Requirements are likely to change. If the project has a lengthy duration, the requirements at the start can be quite different to those at the end of the project since the business world is in a state of accelerating change. With the waterfall model it is difficult and expensive to update the code as these needs change. A change in requirements in the testing phase is far more costly to implement than a requirements change in the design phase.

As each project is unique there is no methodology that is ideal for all types of projects therefore we adapt our processes to the needs of each individual project. I will briefly describe are most frequently used approach.

We do initial requirements gathering but we understand that these are likely to change and plan accordingly. The fine details of requirements are deferred until they are about to be implemented. We also do an initial design to guide the development process but at a much less detailed level than is seen in the Waterfall model. Requirements are prioritised by the client with assistance from us so the most important needs are completed first. Requirements most likely to change are completed as late as possible to minimise rework.

We typically use an evolutionary and iterative approach to design and development meaning that the application will be built incrementally. A project can consist of many iterations. Often each lasts a few weeks only. At the start of each iteration, the requirements to be implemented are selected and fleshed out with the client. Then the detailed design work is carried out. After this, the requirements are implemented and tested in detail. An iteration is not considered complete until it has met all of the client’s acceptance criteria.

Testing occurs throughout implementation and not just at the end. This permits the client to evaluate that the requirements are being met during development and not at the end when it is too late. The impact of changes to requirements is greatly reduced since detailed requirements gathering and design is done just before the requirement is to be implemented.

Many of the problems that face software development projects can be mitigated by using the correct process while choosing the incorrect process can easily doom any project. At Light Speed we take great pride in the effectiveness of our own methodologies. We review the performance of our processes during and at the end of each project to learn lessons and to improve for future projects.

Alternatives to Hand Coding

Dean Pepper — Thu, 20 Oct 2011 22:01:00 GMT

It is very possible to create real .Net web applications that do not need coding by hand with LightSwitch. We at Light Speed IT Solutions have created dozens of web applications to support internal processes for ourselves and our clients. We have created simple apps to track time spent on a project, to complex reporting systems. They all hook up to powerful SQL Server databases that provide vital information in a quick, simple and reliable fashion. Get the schema right and you can have the app created in one hour from start to finish.

From the 60 minute app things start to get more complex as requirements get more demanding and require more thought and more planning. What LightSwitch does for you is to take away the drudgery of hand coding the same old data access, plumbing and user interface code over and over, it does in a reliable way. The code works time after time and is consistent and predictable. Almost all data-driven web apps are CRUD-based and this is the out-of-the-box functionality that LightSwitch provides.

Of course the database design that LightSwitch takes as its starting point is crucial for an efficient code generation process, getting the database design right will pay dividends in the long run – more on that later. If you decide you want additional functionality in your design or need to add some custom coding then you are starting from a well-known and established platform.

To save time and money we want to keep hand coding to a minimum. Don't reinvent the wheel - only use custom code where needed.