Category Archives: SaaS

Got Cloud? I Got Mail. Your Mail!

And that’s just the beginning. I’ve warned you before that you can’t control the clouds and that they are inherently insecure. But did you listen? Nope. Clouds are gaining in popularity, and, consequently, every day more and more data is there for the taking, by experienced AND novice hackers alike.

As per this recent article in the (MIT) Technology Review, on “How to Steal Data from Your Neighbour in the Cloud”, a recent study (by researchers at the Universities of Wisconsin and North Carolina) has proven that software hosted in one part of the cloud can spy on software hosted nearby.

This study conducted an experiment in which malicious software was run on hardware designed to mimic the equipment used by cloud companies such as Amazon. The software was able to steal an encryption key that was used to secure e-mails from software belonging to another user. This allowed the researchers to decrypt e-mails sent by the user (which are easily captured by packet sniffers on a compromised machine attached to the cloud).

As per the article, the new attack undermines one of the basic assumptions underpinning cloud computing: that a customer’s data is kept completely separate from data belonging to any other customer. This separation is supposedly provided by virtualization technology. However, because virtual machines running on the same physical hardware share resources, the actions of one can impinge on the performance of the other, an attacker in control of one virtual machine can snoop on data stored in memory attached to one of the processors running the cloud environment (that is used as a cache in a trick known as a side-channel attack).

Remember this before you go for a full-fledged cloud solution. SaaS from a private data centre run by a single vendor is probably okay if they maintain separate database instances for each client (with their own, separate, encryption keys). But shared services on a cloud are probably not a good idea. At least not from a security perspective.

Hiperos – It’s So Hip To Be Square with 3rd Party Management! Part II

Hiperos provides a SaaS platform that allows an organization to manage the entire 3rd party lifecycle, which consists of registration, data collection, segmentation, control automation, assessment, management, and collaborative issue resolution.

Hiperos includes your standard SIM (Supplier Information Management) functionality that allows for supplier self-service registration and profile maintenance and data integration from third party sources. On top of that it implements a user-configurable rules-based workflow that allows third-parties to be segmented into different buckets that represent the different programs that they need to be subjected too – be it FCPA, REACH, WEE, HIPPA, or some other type of compliance or monitoring program. Each bucket has its associated monitoring rules that notify the third party when more information is needed and that automatically alerts the user when a violation is detected or when information is not provided by the third party in a timely fashion. Assessments are automatically run every time new data becomes available and can be run by a user at any time. The fact that all relevant third party information is available at all times allows users to pro-actively manage third parties, and associated risks, and then either work with third parties to mitigate risks, if the potential infraction can be corrected, or cut them loose if the risk of association is too great (because they showed up on a denied party list or use child labour in their supply chain).

The application, which loads the default user-defined dashboard, allows a user to manage third parties, engagements, relationships, products, and programs and to define programs, vendor communities, reports, and analytics.

The dashboard is multi-tabbed and allows a user to define relevant views on each of the application areas defined above, as well as a default dashboard that allows the user to see the information most relevant to him or her. At the top of the dashboard is a link to current action items that allows a user to quickly see what needs to be done in third party management, engagements, programs, etc. The dashboards can be configured using hundreds of pre-defined (reporting) widgets or the user can define their own widgets by defining appropriate reports in the reporting module. And the user can bring in real-time news and data feeds from sites of interest.

The application can track any compliance, performance, sustainability, or risk data elements of interest and, like any good SIM platform, is preconfigured to track hundreds of relevant data items, depending upon the programs you define as relevant for a given compliance, performance, or risk program (which minimizes the amount of configuration required to track custom fields). And not only is all relevant data available from any view that is program or user defined, but it’s all interlinked so a user can click on a third party included in a program, see the relevant report(s), and then dive into the third party data management screen to examine the raw data elements, and then run a report on just a data subset.

Program definition is flexible and allows for any type of compliance, risk, sustainability, or performance program you can think of. In addition, the fact that Hiperos also supports contract meta-data and third-party data feeds allows financial impact reports to be generated. That way, a user always knows what the impact of a third-party falling out of compliance is to the organization. Knowing that a tier-one supplier might be buying from a tier-two supplier that might be using child labour is one thing, but knowing that the organization is spending 20 Million across 5 categories on that tier-one supplier is something else. In the first case, the supplier is put on the “investigate” list and someone gets around to it when they get around to it. In the second case, the user knows that it is a high priority and an investigation has to be started immediately as the public backlash will be extremely damaging to the organization if it gets out that 20 Million is being spent on products and/or services that were partially produced by child labour.

Hiperos has also included extensive color-coded geo-mapping capabilities so that you can quickly see, for any program, where the highest risk areas are globally and dive in. While Hiperos is not the first company to do this, they have latched on to the fact that the visual representation of risk or non-compliance by region allows one to quickly see what regions have to be monitored. This allows resources to be properly applied, especially since proper monitoring will typically require subscriptions to appropriate data feeds for those regions.

The Market Intelligence capabilites are quite extensive too, and they have pre-configured watch-lists, diversity monitoring, parent-subsidiary monitoring, subcontractor monitoring, REACH/WEE monitoring, and dozens of other feeds of interest which can be enabled as required by the client.

And the analytics piece supports the full suite of slice-and-dice capabilities found in most sourcing products today, so that you can dive into the data and find out which suppliers, categories, or programs represent the highest risk to your organization.

There’s quite a bit of data, and the application can be quite busy at times, but Hiperos has one thing right, where compliance is concerned, it’s Hip to be Square.

Iasta: Smart Source-Style! Part I.

Iasta: Smart Source-Style! Part I.

It’s 2012 and your fiscal year is coming to an end.
It’s time to get a handle on organizational spend.
Because if you don’t, you will find that the Mayans were dead on.
And in 2013, your organization will be gone.

But there’s no need to worry because, Iasta’s got (To the tune of Gangnam Style)

Sourcing Smart-Source Style.
Smart-Source Style.

Sourcing platform for users and bosses too. Sweet.
SaaS on the cloud, always on, real-time reporting complete. L33t.
Analyze this. Auctions, Performance. Real time data.
Optimize It. Contracts, and vendor schema.
One. Two. Smart-Source Success!

So what’s changed since we last covered Iasta in depth in 2008/2009? Especially since the solution footprint looks the same from a cursory review of their web site? If you’re taking a thirty-thousand foot view, not much. But if you take the time to get down in the weeds, everything!

The biggest changes are:

  1. Native Analytics Capability
  2. Improved (Native) Contract Management Capability
  3. Better, Integrated, SIM and SPM Capabilities
  4. Extensive Support for Third Party Data Feeds
  5. P2P Integration Capabilities
  6. Customizable Reporting and Dashboards for Users and Executives
  7. A Broader Services Offering

Native Analytics Capability
A few years ago, Iasta was dependent on third parties like BIQ, now part of Opera Solutions and Spend Radar, now part of SciQuest for their spend analytics capability. And while they still make use of third parties for initial cleansing and classification in new initiatives, they now have the same slice-and-dice reporting capability that you’ll find in any other sourcing suite on the market. (And while it doesn’t have the data analytics power of best-in-class solutions like BIQ, it is the 80% solution for most sourcing departments, especially in the mid-market, which typically have very little insight into spend.)

Improved (Native) Contract Management Capability
A few years ago, Iasta’s contract management capability was limited to the definition of a few meta-data elements. Now, it’s a fully featured contract management offering that allows for storage and indexing of all your contracts, authoring of new contracts, and automated reporting for SOX (Sarbanes-Oxley) to keep you out of stripes like Fox.

Better, Integrated, SIM and SPM Capabilities
You wouldn’t know it from their web-site, but Iasta has developed some fairly extensive built-in SIM/SPM capabilities that your organization can use to track compliance, performance, sustainability, and risk data elements that can have an impact on your sourcing events. In addition, this is integrated with the supplier data that has always been collected in the RFX module and the contract data in the contract module and all of this data can be sliced and diced by Iasta’s built-in analytics and reporting modules.

In Part II we’ll cover the remaining significant changes.

Technology Trials 2012 – Part IV.ii

In Part III, where we assumed that you needed to find a new solution, be it a partial best-of-breed (BoB) or a full supply suite (FuSS), we discussed the critical question that you needed to answer – do you need a point solution to fill a gap or do you need suite to modernize your process and capabilities?

In yesterday’s post, we assumed that you answered the question and determined that you needed a point best-of-breed (BoB) solution to fill a gap in your solution foot-print. In today’s post, we assume that you determined that you need an end-to-end full supply suite (FuSS) to deal with your supply issues.

(04) What are the critical functions that the solution must have?

In particular, as we are dealing with FuSS, we need to ask:

  (04.1)Are there any integration points?
  (04.2)If integration is required, who can do the integration and what is the timeframe?
  (04.3)What data formats need to be supported for supplier collaboration?
  (04.4)Is the solution a foundation for another solution? Can it be extended / integrated as needed?
  (04.5)Are there any known advantages or disadvantages to hosted or SaaS?
  (04.6)Who should support the solution?
  (04.7)What are the training and support options?
  (04.8)What are the normal use-cases that cover normal, and 80% of, expected usage?
  (04.9)Is the vendor likely to be around supporting this solution in the long term?

  (04.1)Are there any integration points?
Do we need to integrate with an ERP, MRP, or suite solution for another supply chain process? E.g. A sourcing platform may need to suck in the transactional data from an e-Procurement platform for spend analysis and spit the contracts out into the platform so that m-way matching can occur against each requisition before it is made and each invoice before it is paid. Similarly, a logistics platform may need to suck in requisitions and spit out inventory levels / goods receipts.

  (04.2)If integration is required, who can do the integration and what is the timeframe?
Can it be done in-house, by a vendor, or will a third-party be required? How long is it likely to take? (If integration will take 3 months, then a solution MUST be selected 3 months before the suite is needed.)

  (04.3)What data formats need to be supported for supplier collaboration?
What formats are you currently accepting supplier data in? What formats do you need to accept to get more suppliers online? Where is the electronic marketplace going?

  (04.4)Is the solution a foundation for another solution? Can it be extended / integrated as needed?
Are you on the market for a procurement suite with the intention that you will be supplementing it with a sourcing suite at a later time, or vice versa? Are you planning to build your entire supply chain foot around a market-leading e-Sourcing platform? Know the answers to these questions up front — don’t be asking them after the fact!

  (04.5)Are there any known advantages or disadvantages to hosted or SaaS?
As with the BoB discussion, if your organization employes enhanced security protocols, does not have the resources to support a system in-house, etc., these restrictions should be known in advance of system selection.

  (04.6)Who should support the solution?
You? The vendor? A third-party? Or does it not matter?

  (04.7)What training and support options are availble to you or will be required?
If there is no in-house expertise on the type of solution the organization is searching for, expertise on the process and the platform will be required. If there is in-house expertise on the process, then only expertise on the solution will be required. In addition, are there individuals who can be trained as trainers, or will external resources be required to train new users on a regular basis? If the latter case, you will need a vendor with a consulting/training team, or one that is big enough that third parties offer that trainig.

  (04.8)What are the normal use-cases that cover normal, and 80% of, expected usage? And what are the abnormal use-cases that cover high-ROI scenarios in the remaining 20% of scenarios?
Just like you should never go to market for BoB solution without knowing the typical and atypical use cases you need to support, you should never, ever go to market for a FuSS solution without knowing the typical and atypical use cases you need to support! Otherwise, the ROI that you expected may not materialize.

  (04.9)Is the vendor likely to be around supporting this solution in the long term?
Whereas this is not that critical for a BoB solution, as you can always replace it in a few years if need be, this is very critical for a platform solution as you know you will be stuck with the solution for at least 5 years, if not 7 or 10 — even if it’s SaaS, because the bigger the solution footprint, the longer it takes to get it replaced in an organization. So you better make sure that the vendor is stable and likely to be for years to come.

Technology Trials 2012 – Part IV.i

In our last post, where we assumed that you needed to find a new solution, be it a partial best-of-breed (BoB) or a full supply suite (FuSS), we discussed the critical question that you needed to answer – do you need a point solution to fill a gap or do you need suite to modernize your process and capabilities?

In this post, we’re going to assume that you answered the question and have determined that you need a point best-of-breed (BoB) solution to fill a gap in your solution foot-print. In tomorrow’s post, we will assume that you determined that you need an end-to-end full supply suite (FuSS) to deal with your issues.

Once you’ve decided that you need BoB to help you fill a critical issue, because the need was contained and the ROI analysis indicated it was the best approach, the next (set) of question(s) you need to answer is:

(04) What are the critical functions that the solution must have?

In particular, as we are dealing with BoB, we need to ask:

  (04.1)What are the integration points?
  (04.2)What data formats need to be supported?
  (04.3)Are we limited to hosted or SaaS?
  (04.4)Can the solution be supported in-house?
  (04.5)What additional training will be required?
  (04.6)What are the use-cases? What is the expected ROI??

  (04.1)What are the integration points?
Specifically, what data do you need to get into the best-of-breed point solution from your existing platform / suite, and what data needs to be pumped back into the platform / suite when you are done with the best-of-breed solution?

  (04.2)What data formats need to be supported?
In particular,
    (04.2.1)What data formats are used by the platform / suite you need to suck data out of and spit data into?
    (04.2.2)What data formats are used by your suppliers / partners / third parties that provide data you want to get into the best-of-breed solution?
This is typically all of the data formats that you need to support for BoB.

  (04.3)Are we limited to hosted or SaaS?
If the current platform is hosted, and strict security requirements would make a SaaS solution almost impossible to deliver, or if the current platform is SaaS, and the integration or support requirements would make a hosted solution unnecessarily expensive, or if there is an edict from above that all solutions must be hosted for security or control reasons or must be SaaS due to lack of technical support, this must be known before potential solutions (and vendors) are selected.

  (04.4)Can the solution be supported in-house?
If it can’t, then the organization will either have to go SaaS (if it has the option), or contract a third-party to maintain a hosted solution.

  (04.5)What additional training will be required?
Even if the selected solution is “plug-and-play”, there’s no guarantee that your talent will have the training required to “play” with the solution as soon as it is available. You can’t just give a man a hammer and a chisel and expect him to magically transform into a master artisan.

  (04.6)What are the use-cases? What is the expected ROI of each use-case??

Before you go looking for a solution, and more importantly, vendors to support that solution, you have to know what the typical daily needs are and the atypical use-cases that you need to support (because they have high ROI) are. Software isn’t about features (and selection is not about feature check-lists, and any vendor who insists they are should be transported back to the middle ages and given free accommodations in the Tower of London where they knew what to do with people who preached blasphemy) – it’s about functionality. Any vendor can add a dozen new features into the next release, but if they don’t enable your process and save you money, what’s the point?