Monthly Archives: December 2012

When Sourcing Goes Wrong Part II

Editor’s Note: Today’s post is from Dick Locke, Sourcing Innovation’s resident expert on International Sourcing and Procurement. (His previous guest posts are still archived.)

Jon Stewart said it all already:

The Employees Strike Back
(Video was only available in the U.S.)

(And it starts with a Jack in the Box ad that is pretty satirical in itself considering the US obesity rate.)

and continuing on…

The Employees Strike Back Part II
(Video was only available in the U.S.)

More seriously with respect to Hostess, management was unable to

    • build a “we’re all in this together” spirit in the company due to voting themselves high pay and
    • strategize beyond making chemical garbage and staying entirely in a declining market

Thanks, Dick. (Global Supply Training)

Got Cloud? I Got Mail. Your Mail!

And that’s just the beginning. I’ve warned you before that you can’t control the clouds and that they are inherently insecure. But did you listen? Nope. Clouds are gaining in popularity, and, consequently, every day more and more data is there for the taking, by experienced AND novice hackers alike.

As per this recent article in the (MIT) Technology Review, on “How to Steal Data from Your Neighbour in the Cloud”, a recent study (by researchers at the Universities of Wisconsin and North Carolina) has proven that software hosted in one part of the cloud can spy on software hosted nearby.

This study conducted an experiment in which malicious software was run on hardware designed to mimic the equipment used by cloud companies such as Amazon. The software was able to steal an encryption key that was used to secure e-mails from software belonging to another user. This allowed the researchers to decrypt e-mails sent by the user (which are easily captured by packet sniffers on a compromised machine attached to the cloud).

As per the article, the new attack undermines one of the basic assumptions underpinning cloud computing: that a customer’s data is kept completely separate from data belonging to any other customer. This separation is supposedly provided by virtualization technology. However, because virtual machines running on the same physical hardware share resources, the actions of one can impinge on the performance of the other, an attacker in control of one virtual machine can snoop on data stored in memory attached to one of the processors running the cloud environment (that is used as a cache in a trick known as a side-channel attack).

Remember this before you go for a full-fledged cloud solution. SaaS from a private data centre run by a single vendor is probably okay if they maintain separate database instances for each client (with their own, separate, encryption keys). But shared services on a cloud are probably not a good idea. At least not from a security perspective.

One Size Does Not Fit All – That’s Why You Need User Configurable Workflows

Andrew just posted a great post over on CPO Rising on how One Size Does Not Fit All where e-Sourcing and e-Procurement is concerned. As Andrew astutely notes, process standardization is very important within Supply Management, but having only one option for e-Sourcing or e-Procurement events is certainly not the way to go.

One has to remember that even in the simplest classification scheme, you will break your events into quadrants based on dollar value and business impact (or supply challenge and business impact). For low value, low impact events, you’re not going to use a process that requires a lot of time and effort, because you need that on high-value, high impact categories. Similarly, you’re not going to use an automated e-Auction for a high-value, high-impact category and essentially throw the category to the wind. As Andrew notes in the first example in his post, if the process is set up for large, high-value, multi-stakeholder process, it’s not going to work for small, low-value, single stakeholder processes as it will be too cumbersome and your buyers will do everything they can to bypass or ignore it.

In order for your solution to work, it needs to support multiple project configurations that can be defined by the client. For example, the client should be able to configure simple, automated e-Auctions for low-value, low-impact categories; automated e-RFXs for low-value, high-impact categories and high-value, low-impact categories where Procurement personnel only need to get involved in final review and award; and full-fledged multi-round RFX and Decision Optimization for high-value, high-impact categories. (Now, every category should run a baseline optimization scenario before an award is made, but extended analysis does not need to be done for all categories.)

And, further more, it needs to be easy for a Director or CPO to grant exceptions to the process when they are appropriate. For example, as per Andrew’s 3rd example, it should not take months of back and forth to remove a “mandatory” automobile insurance provision when no automobiles are being used! So make sure your solution is configurable, or it might not last long in your client’s Supply Management department.