Architecting Connected Systems Blog
As part of an internal training effort I’m a part of for Microsoft, I threw together a quick set of slides (well, 200+ quick slides) on GDPR and how it relates to Microsoft Technology.
Check it out here on my GitHub:
https://github.com/givenscj/GDPRPresentation
Also check out my review of the new Office 365 Compliance Manager here:
Enjoy!
Chris
A new REST endpoint will be coming to SharePoint Online soon. This end point will allow you to fire a “setup script” that will execute all kinds of actions upon a new or existing site. You can get a feel for how it works from this slide:
As you can see, it is targeted at site creation and templating, but it can happen at any time. The site script itself will be json based and allow you to define “actions”. These actions have a “verb” and then all the properties that support that verb:
Actions that will be supported when its released include the following (notice the “more to come” comment:
One of the more exciting features of the site script is the ability to call “Flows” or even send messages to queues which could then fire Azure Functions!
This really starts to make things interesting in that your imagination is now the limit as to what you can do. 3rd party vendors reactions will be on both sides of the fence with this (“ah crap, now they can do it”, or, “ohh, what can we do with that?”).
I think is it one of the biggest game changers to come along in SharePoint Online and SharePoint land in a long time. Kudos to Sean Squires (@iamseansquires)
Chris
After two months of reviewing, finally, here is my Microsoft Ignite Review!
This is all the stuff I gleaned from the various slides (over 800) from Microsoft Ignite. The conference’s overall focus based on all the sessions\slides centered on the following major topics in what I deem to be in order of importance:
Here’s how things eventually broke down (as of the time I downloaded everything). As you can see out of the total PPTs, I only gave the best of the best nod to 6%, and gave another 18% the “you must see” nod. This will significantly speed up your review process.
You may take a look and wonder, uhh, where is your ranking? Yeah, I used to rank them all 1-5, but I just didn’t have the time (believe me, some did deserve a 1). And since I have caused enough fireworks already for 2017, it was better I just ignore the bad ones. So here ya go…
The best of the best:
If you just don’t have the time to look at even my reduced set of “good” ones, then I simply suggest you take the time to look at these, they represent the top of the technical content in great formats with lots of information you can use or learn from…very simply, they are “the best of the best” from Ignite!
The best technical session powerpoints that you MUST review are the following:
“Odd and interesting” mentions:
Here are product focused items with various announcements:
Things that WERE great:
More Product Engineering Group (PEG) vs Product Marketing Group (PMG)presentations. You can see this based on presenter titles Program Manager vs Product Manager. This can be a good and a bad thing, PEG sessions tend to be very technical, but lacking in the presentation skills, whereas PMG is the opposite (with a few notable exceptions). This year, the PEG presenters were on their game and only a couple sessions showed the lack of presentation skills. This shows that Ignite was highly technical in nature this year vs highly marketing based in the past.
I love to see MVPs have the oppty to present (real world consulting is way better than just a simple technical presentation any day), and there were certainly a few that got on stage for break outs, but this year had a few small set. Most seemed to fall into the Theatre sessions, which makes sense.
Things that weren’t that great:
Over the past week, I have spent my extra time reading over every article in the GDPR and how it maps to technology (or the lack thereof).
Today, Microsoft has released the Compliance Manager tool for individuals and organizations to use to “assess” their readiness for the upcoming GDPR articles that are supposed to go into effect on May 25th, 2018. The interesting thing, or not, about this tool is. it is simply a check list of the articles from the GDPR. In the future it will cover, NIST 800-53, ISO 27001, and ISO 27018. It doesn’t not actually do any checks against your tenant like the Office Security Score tool does to tell you if you are in violation of anything…and nor should it. This means…
You still have to do the compliance work!
In the absence of any other compliance management focused tools, this is a great start to helping you track most of the things you need to do. Not only that, but being able to know when a particular article was last checked via the reports is a great way to ensure that a Data Protection Officer (DPO) is not forgetting their responsibilities to “data subjects”. It should be noted that the Compliance Manager tool will not suffice for the “Certification” in article 42 of GDPR. So you should still be prepared to pay an outside auditing firm to review your code of conduct, data flows, etc. And if you want the full disclosure with T&Cs, you can review what Tina Ying (Office Marketing) wrote here. You can even watch a quick video on YouTube.
Some things I’d like to see added to the Compliance Manager:
As I’m sure you are painfully aware, there is a *huge* sales and marketing push by Microsoft and other tech vendors to take advantage of GDPR. Funny thing is most of the people that bring it up haven’t even read the thing and really don’t know anything about it! Which brings me to my next item to point out:
Office 365 is (will be) GDPR Compliant
The first thing you need to know about the phrase “Office 365 is GDPR compliant”, is that it means “Microsoft” will be covered, not you! Office 365 cannot fix or make you compliant through a simple check list. Microsoft is attempting to make all of their cloud services and products GDPR ready, and at some point they will be sharing everything they learned about their internal journey with us (hmm, I wonder what their Compliance Manager report looks like). Don’t hold your breath here, by the time they share it with us, it will be too late for you! If you are already familiar with Compliance Manager, you are probably saying “but they provide all these helpful actions for each article”. Ok, some of these are valid and some are not. The reality is that they only apply to Microsoft 365 cloud services and will not help you with all your systems outside of Microsoft 365.
So back to GDPR. Have you read it? I have…top to bottom and vice versa, 3 times, both versions.
What most people don’t realize is that each Member state can override certain articles to make them more strict (like national security, public interest, etc). The date above is for all the changes that a Member State would like to be made to be integrated into their countries legal system. What does that mean?
There could be 28 different versions of GDPR after May 25th, 2018!
The compliance manager will help you with the high level articles, but the details for each country will be a toss up and I’m pretty sure you won’t see 28 versions of GDPR in the compliance manager.
So that all being said…
What do you need to do to be GDPR compliant?
A check list\tool can help, taking the time to read the articles is better, or, if you prefer not to put your legal hat on, having a consultant like me teach you what’s in it and how to mitigate potential violation(s) is best!
After you have an understanding of it, you will realize:
Its a lot.
Development re-work, notification systems, records management…a lot. And yes, I said Records Management. When you look at the GDPR, it really is enforcing you to:
Implement a “case-based” system for “data subjects” across *all* your platforms.
Just as a side note, “Case-based” records management is a feature long absent from SharePoint or Office 365 “content services”. And no, “Labels” will not help you whatsoever with GDPR.
So, net net, if you haven’t started yet, then you won’t make the deadline of May 25th, 2018 (which I’m guessing some countries won’t have the full set of articles legally integrated on that date so you may have more time depending where you or your data subject lives).
I will be posting a presentation soon (about 80% done) that reviews every article and what you should do (if anything) and how a Microsoft product or service “may” help you. The more in-depth version of the presentation will go into development patterns and show you some simple things you can do to implement what I am coining as the “Data subject action pattern”
I will be speaking at DevIntersections about GDPR and how all these articles map to the various Azure technologies and how you must redesign your apps and your thinking to be able to support my new “Data subject action pattern“.
Enjoy!
Chris
So in addition to the .NET Framework 4.6, it turns out that 4.7 will also cause the same issue. You can utilize this script to remove them both to proceed with installation:
function UninstallKB($kbNumber)
{
$setup = Start-Process -FilePath "wusa" -ArgumentList "/uninstall /kb:$kbNumber /quiet" -Wait -PassThru
if ($setup.ExitCode -eq 0) {
Restart-Computer;
}
}
function CheckForKB($kbNumber)
{
$list = wmic qfe list
foreach($line in $list)
{
if ($line.contains($kbNumber))
{
UninstallKB $kbNumber;
Restart-Computer;
}
}
}
#output .net frameworks…
ls -r ‘HKLM:\software\microsoft\NET Framework Setup\NDP\v*’ | foreach { $_.getValue(‘Version’) } | sort -unique
CheckForKB “3102467”; #.net 4.6
CheckForKB “3186539”; #.net 4.7
So you decided to install Microsoft Teams eh?
Did you know it is an Electron app?
Do you know what you just did?
Probably not. Electron is a platform to run node.js and any other supported JavaScript frameworks across multiple platforms. This means any application that utilizes electron will be made up of many different “inherited” technologies and core components. Each application is required to provide a license file that defines all the “used” 3rd party components.
So have you checked to see what you have installed when you installed Microsoft Teams? Its a pretty massive set of frameworks, most open source and available from github. The list is long and “somewhat” distinguished.
If you weren’t aware of what you just did when you installed Microsoft Teams, this blog post puts it into perspective for you. This blog post is also used as a reference for a Teams Desktop App deep dive post later this year. I’ll be updating the usage of each of these components over the next few months and updating as the list changes, so here ya go:
Working on some security stuff over the next few weeks and decided to write up a blog post on all the Microsoft Security features. Aka, what they are and what uses them and how you actually find them! You will also realize that the same name is used a couple of times (“Advanced Threat Protection”) and some things aren’t really products but a marketing term for a “set of products”. In some cases, the names have changed so Google/Bing search results are crazy!
Someone needs to manage product names with SEO in mind at Microsoft!
Recently had a customer with an issue with accessing Office 365\SharePoint site. They were complaining that the performance was not great. So I needed to see what issues they might be having with their network. Results were really interesting, they were being routed (via ATT) from SJC to CHI to NYC to DUB then back to LAX and finally to the US West data center in SJC. Woah…that’s definitely not good!
Decided to write down all the tools I use and the script commands I execute to test a sites connectivity to Office 365.
Services to ping:
Services to tracert (use the db-ip.com service to find their locations):
Look up each ip along the way…to see if unnecessary routing is occurring. If it is, then ISP needs to configure route to data center or customer needs to setup ExpressRoute.
https://db-ip.com/{IPADDRESS}
Painful Example:
Helpful references:
You may run into an issue with your Nintex Services not starting on your non-central administration servers as in this image:
You can attempt to browse the web and Nintex support pages, but they will be of little help:
It turns out that the services did not get installed as part of the solution deployment. In otherwards, the Nintex Services are missing on your SharePoint server.
In this case, you have to install the services manually in order to start them and have your server be compliant. The three services are:
You can manually install these services to the other servers by running the .net installutil utility (Except in the case for two of them you have to use the “sc” tool). Note that there are two versions of this tool, 32bit and 64bit. If you use the wrong one, you will get the dreaded “System.BadImageFormatException”, and if it does successfully run, the service won’t be visible to SharePoint due to Nintex “programming practices”. The install tool is located in:
The series of commands in an administrator command (cmd.exe) window would be:
Why do you have to use “sc create”? Because the internal name of the Queue Service is actually “Nintex Connector Workflow Queue Service Recycle”. For the other, the name ends up being “NWStart”…SharePoint doesn’t like it when services don’t match what they expect!
Once you run the install commands, the services will display in your Services applet:
Once they are installed, switch back to Central Administration, click “Start” on the servers. They should now start without error and your servers will be in “compliance”!
Enjoy!
Chris
You always wondered why, but then you were never in the healthcare industry or work at an exec level to know how the tech systems work at a typical hospital…
Here’s a quick education into the healthcare disaster!
When you go into the hospital, a chart is written up based on your comments and the doctors evaluation and actions (draw blood, tap your knee, whatever). This chart is then translated into a series of medical codes so they know how to charge them to you or your insurance. The charts are evaluated by a series of medical “coders”, no, they don’t know C# or Java or JavaScript, they just match the words to “codes” (ICD9/ICD10).
Each chart is “coded” to a specific set of codes. The codes are then sent off to the billing system. The billing system will match the codes to the patients insurance (or lack thereof) such that the base charge rate is multiplied times a discount (or again, a lack thereof) or “forced” charge amount for that particular insurance contract (Blue Cross, Medicaid, Medicare, etc).
Most insurance companies want a “discount” on your particular services\codes. They can negotiate or force (depending how big they are) just about anything for a set of codes.
The crazy part about this is that the base rate that the hospital charges (the “charge master” database system) is pretty much a let’s run a sql query against the database and increase everything by 7% EVERY YEAR (or some rate adjustment, possibly matching inflation or exec\board discretion).
You should be saying…”wait what”?
Yup, every year, a non-qualified individual will increase the pricing of stuff because the execs tell them too. Remember the movie “Independence Day” when the jewish guy says something about the price of the hammer…yeah…$400 for a hammer.
Aka, $20 for a bandaid!
Why? Because the charge master simply gets incremented by a percentage every year in a blanket fashion!
Ok…so the charge master is broken. Yup. That’s where the government comes in. Obama actually kicked some serious ass with this. He forced certain codes to be charged at a base rate that is run by the government (and you have to follow them for any ACA insurance policies). If you send in a bill with a code that has a price over the base, REJECTED! It forced everyone to reevaluate their charge masters (at least for government stuff).
I applaud him for that.
But…here’s the kicker. The “coders” that “code” your chart. Those people are instructed to interpret the words in such a way that they can set the chart to match the most expensive codes! Even though those codes may not even really match! It’s up to the patient and the insurance company to do a review of the worded chart to see if the codes have been applied appropriately!
This review happens very rarely.
Now that I know how this works, believe me…every time I go into the doctor’s office I ask for my chart and the codes that were sent for it. I actually got $250 back for this last visit!
What else happens? Oh, execs and doctors are “spiffed” for overdoses of various items. Example, you get bit by a snake and need the anti-venom, guess what, you only need one dose…but how many do you actually get? Anywhere from 1-5 doses! Each dose (back in the day) can be up to $20K each. Where does the money go? The doc, the hospital and the execs get a kickback! What?!?! Yup…there is shadiness that occurs for all kinds of things.
And that is your 10 min run down of how corrupt the medical system in America is and why we don’t have universal health care, everyone has a different charge master that no one can agree to the price of anything!
Enjoy!
Chris