Category Archives: Technology

Risk – The More Things Change, The More They Stay the Same V – Technology

In our last post, we indicated that the World Economic Forum had recently released its 7th annual “Global Risks” report, it’s 2011 edition. This report was filled with risk, dozens of risk divided into five categories to be precise. Today, we are going to discuss the top technology risks from a Supply Management perspective.

Two of the biggest Risks Haven’t Changes Since Last Year:

Online Data and Information Security, specifically the risk of a
Massive Incident of Data Fraud or Theft

Every week we hear about another data breach at another retailer. What we don’t often hear about, because consumers aren’t directly affected, is yet another network intrusion at a Global 3000 or Global Financial Institution. While the average hacker might want your credit card, the average hacker employed by organizations that resort to corporate espionage wants your data — and your Supply Management related data in particular — or all of your corporate customer’s data. What are you making? What are the specifications? Where? With who? When are you shipping? From Where? With what carrier? And who is buying? And where are their bank accounts located? If any of your confidential data finds its way to your competition before you’re ready to release a new product, the losses could be crippling. What if your competitor is able to use your plans to jump-start their development of a better version and beat you to market? What if thieves intercept your critical shipments and sell your product on the black market? And if your customers data is exposed, and their accounts are hacked, good luck staying in business if all you have is inventory no one else wants but the company’s that just went bankrupt thanks to your lack of security. While a consumer’s financial solvency depends on her credit card information being kept secure, your organization’s financial solvency often depends on your Supply Management data and your customers’ financial data being kept secure.

Critical Information Infrastructure Breakdown /
Critical Systems Failure

Face it. It’s impossible to manage a global supply chain without modern supply management systems and the information infrastructure that supports them. What happens if your primary data centre gets taken out? What happens if your headquarters loses power for 48 hours? What happens if the land lines fail and the one satellite that carries cellular signals for your (remote) location stops responding? The minute your internet goes down, your business stops. Literally. And since your information infrastructure could breakdown as the result of a (power) grid overload, a data centre failure, an environmental disaster, or a terrorist action, all of which can not be predicted (or prevented in many situations), this is a significant risk that requires risk mitigation plans be in place and ready to go at a moment’s notice.

These two risks have become an even greater threat to your organization and round out the top 4:

Cyberattacks
Cyberatttacks and Cyberwarfare is on the rise, and the chances of it significantly disrupting your business and your supply chain are on the rise. As early as 2009, reports appeared that indicated that China and Russia had infiltrated the U.S. electrical grid and left behind trojans that could be used to disrupt the system. If the entire power grid can be taken offline, there goes your data centre. And even if the grid is safe, a concentrated attack on top level internet domain name servers can take down the internet for days. The recent GoDaddy outage, which some blamed on the Anonymous Collective, but which GoDaddy stated was a DNS upgrade error, took down thousands of sites for almost a day. McAfee might be hoping that the Anonymous Collective will decline in 2013, but I wouldn’t bet on it. And given the state of the current economy, I would bet that incidents of cyber-ransom, where thieves hijack your internet domains and electronic data and demand money for their safe return, will be on the rise.

Mineral Resource Vulnerability

China dominates the rare earth metals marketplace, controlling 90%+ of the supply of some of the critical rare earth metals needed for modern electronics. What will happen if they decide to cut off supply from the rest of the world? What will happen if the Somali pirates and the organized crime cartels figure out that these mineral and metal shipments are even more valuable than drugs, guns, oil, and finished iPads and turn their attention to these shipments? Are you prepared for supply shortages that will shut down your electronic and information technology hardware production lines?

I Got Your Mail. And I Don’t Even Need A Side-Channel Attack.

How? I just used your password. As recently reported by CNN.com, SplashData just released its “Worst Passwords” list compiled from common passwords posted by hackers. I can’t believe how stupid the top 25 are. It’s insane. I don’t even need a brute-force dictionary to have a good chance of breaking into a random account if this is what still passes for a password these days! If you have one of these, you might want to consider changing it. But if you’re going to use a dictionary word, at least mis-spell it, or it won’t be much harder for a hacker with a brute-force dictionary-based script and a bit of patience.

1. password

2, 123456

3. 12345678

4. abc123

5. qwerty

6. monkey

7. letmein

8. dragon

9. 111111

10. baseball

11. iloveyou

12. trustno1

13. 1234567

14. sunshine

15. master

16. 123123

17. welcome

18. shadow

19. ashley

20. football

21. jesus

22. michael

23. ninja

24. mustang

25. password1

Let’s be Clear. Logistics Services and Logistics Technology Services Are NOT the Same!

And while the technology they use is important, the initial focus should be on the logistics services and whether the logistics services they offer are sufficient enough for the provider to even be under consideration.

Recently, I came across the headline that offered 5 Essential Technology Questions to Ask Any Logistics Service Provider and, as logistics services are not the same as logistics technology services, I assumed it would focus on judging the logistics provider’s general level of technical competence online and off, but the questions were entirely oriented around the technology solution used by the provider. While a good solution is good, because you need visibility, integration, etc., the first thing you need is to get your goods delivered. The second thing you need is sustainability. Then you need technology – and if the provider is deficient, there’s always the possibility that you can provide the technology. In other words, while the questions were good, I think they were off track. Here were the questions:

  1. What does visibility really mean to the provider?
  2. Can they customize their tools to meet your needs?
  3. What process integration options do they offer?
  4. How many current providers are integrated with their technology?
  5. How mature is their system availability process?

These are important, but I’d start with:

  1. What technology do they use to manage their fulfillment operations?
  2. How sophisticated is the schedule capability? Can it handle last-minute shipment changes?
  3. How much visibility can they give you into their schedules, capacity, and your shipments?
  4. Is the integration format standard and supported by your systems, or will you need some custom integration work?
  5. What is their ability to support their system, or yours if their system does not have the requisite visibility?

    Basically, you want to know that:

    1. They are using a fairly modern tool and have a firm, efficient grasp on their operations.
    2. They can handle dynamic schedules and expedited shipments when needed.
    3. You can get the visibility you need, even if someone has to do some development work.
    4. The integration can be accomplished efficiently and effectively.
    5. They, and you, are not dependent on a third party to manage, support, and query the system.

    A logistics services provider is not going to be an expert in software and systems. That’s not their core strength, so you shouldn’t be asking them questions like they are. That being said, you should make sure they are technologically literate and able to make use of appropriate technology. Find the balance, or you might end up eliminating some potentially great partners.

Got Cloud? I Got Mail. Your Mail!

And that’s just the beginning. I’ve warned you before that you can’t control the clouds and that they are inherently insecure. But did you listen? Nope. Clouds are gaining in popularity, and, consequently, every day more and more data is there for the taking, by experienced AND novice hackers alike.

As per this recent article in the (MIT) Technology Review, on “How to Steal Data from Your Neighbour in the Cloud”, a recent study (by researchers at the Universities of Wisconsin and North Carolina) has proven that software hosted in one part of the cloud can spy on software hosted nearby.

This study conducted an experiment in which malicious software was run on hardware designed to mimic the equipment used by cloud companies such as Amazon. The software was able to steal an encryption key that was used to secure e-mails from software belonging to another user. This allowed the researchers to decrypt e-mails sent by the user (which are easily captured by packet sniffers on a compromised machine attached to the cloud).

As per the article, the new attack undermines one of the basic assumptions underpinning cloud computing: that a customer’s data is kept completely separate from data belonging to any other customer. This separation is supposedly provided by virtualization technology. However, because virtual machines running on the same physical hardware share resources, the actions of one can impinge on the performance of the other, an attacker in control of one virtual machine can snoop on data stored in memory attached to one of the processors running the cloud environment (that is used as a cache in a trick known as a side-channel attack).

Remember this before you go for a full-fledged cloud solution. SaaS from a private data centre run by a single vendor is probably okay if they maintain separate database instances for each client (with their own, separate, encryption keys). But shared services on a cloud are probably not a good idea. At least not from a security perspective.

One Size Does Not Fit All – That’s Why You Need User Configurable Workflows

Andrew just posted a great post over on CPO Rising on how One Size Does Not Fit All where e-Sourcing and e-Procurement is concerned. As Andrew astutely notes, process standardization is very important within Supply Management, but having only one option for e-Sourcing or e-Procurement events is certainly not the way to go.

One has to remember that even in the simplest classification scheme, you will break your events into quadrants based on dollar value and business impact (or supply challenge and business impact). For low value, low impact events, you’re not going to use a process that requires a lot of time and effort, because you need that on high-value, high impact categories. Similarly, you’re not going to use an automated e-Auction for a high-value, high-impact category and essentially throw the category to the wind. As Andrew notes in the first example in his post, if the process is set up for large, high-value, multi-stakeholder process, it’s not going to work for small, low-value, single stakeholder processes as it will be too cumbersome and your buyers will do everything they can to bypass or ignore it.

In order for your solution to work, it needs to support multiple project configurations that can be defined by the client. For example, the client should be able to configure simple, automated e-Auctions for low-value, low-impact categories; automated e-RFXs for low-value, high-impact categories and high-value, low-impact categories where Procurement personnel only need to get involved in final review and award; and full-fledged multi-round RFX and Decision Optimization for high-value, high-impact categories. (Now, every category should run a baseline optimization scenario before an award is made, but extended analysis does not need to be done for all categories.)

And, further more, it needs to be easy for a Director or CPO to grant exceptions to the process when they are appropriate. For example, as per Andrew’s 3rd example, it should not take months of back and forth to remove a “mandatory” automobile insurance provision when no automobiles are being used! So make sure your solution is configurable, or it might not last long in your client’s Supply Management department.