Building App Layer Security Into the Supply Chain

 

Hailey Lynne McKeefry
2/24/2014   

Today's complex and complicated supply chain translates into
quick communication with partners. At the same time, it creates huge opportunity for data leakage and security issues that need to be addressed proactively in supply chain
systems.

"Every enterprise is connected in some way to its partners in the supply chain and must allow access to communicate back and forth," Bala Venkat, chief marketing officer at the applications security vendor Cenzic, told us. "That exposes third-party applications. Unfortunately, we see a high level of confusion about what application security is. Too often, it gets confused with network layer or secure socket layer security. "

Partners in the supply chain may serve as a back door to a desired target. "Hackers often try to find the weakest link of the network they want to attack," Venkat said. "Connection-related attacks are becoming increasingly popular, so it's become very compelling to solve."

Today, the electronics supply chain faces a daunting number of potential security flaws, including form caching issues, JavaScript vulnerabilities, SQL injection attacks, and web server configuration vulnerabilities. Each makes critical information, from product designs to price lists, vulnerable to attack. The rise of mobile supply chain apps will only increase the potential application vulnerabilities of the supply chain.

The answer, then, is a proactive look at the security of supply chain software being used by the organization and its partners. "You simply can't tell a partner that you can't connect with their systems, but you can ask for independent verification that the applications in question are free from all the possible vulnerabilities that exist."

Today, Cenzic introduced its Partner Application Security Certification Testing Program, which offers this type of certification. The Cenzic Partner-Application Security Scanning(Cenzic PASS) service uses a combination of consulting and cloud-based vulnerability scanning-as-a-service to test and certify integrated applications. Venkat said it can identify and help remediate more than 6,000 vulnerabilities.
Knowing how to launch a process around application security can be daunting. However, Venkat recommends a three-step assessment process.

1. Define the security standards: Understand what applications are being used to connect partners across the supply chain. What standards do they meet? What level of vulnerability scanning is needed? Financial, logistics, and accounting applications, for example, are likely targets and should be rigorously protected. "As part of step one, there needs to be an automated workflow, so application owners are guided through the process of managing associated applications."
2. Ask partners to take responsibility for scanning their apps: After classifying applications as high, medium, or low risk, partners should scan each one for security holes and remediate them.
3. Appoint an administrator to monitor and manage app certification: Since software is constantly upgraded and updated, someone has to monitor and verify that all critical applications are being secured. "This person would monitor the dashboard report on what applications are certified and which have not."

Too often, application security becomes a reactive activity; it takes center stage only after a breach has occurred.

Measuring the effectiveness of your security awareness program

Organizations that maximize the efficacy of their security awareness programs stand to benefit not only from better incident prevention, but many other benefits as well, including improved reputation and customer loyalty, says John Schroeter

                                                     

By John Schroeter

                   

February 12, 2014 — CSO — As Yogi Berra put it, "If you don't know where you're going, you'll end up someplace else." Do you know where you're going with respect to your privacy and security awareness programs? How will you know when–or if–you get there?

How to use Syrian Electronic Army attacks to improve security awareness

"But wait just a minute," you object. "Everyone knows that security is a process, not a destination. Is there really any such thing as arriving?" Well, of course there is. Just because a process is dynamic doesn't mean it's left without any measurable aspects. Besides, if any process is to be improved, it must also be measured.

There are many benefits an organization will enjoy when it makes those improvements, not the least of which is the budget justification for creating a security awareness program that help will boost security effectiveness overall. Martin Sadler, Director of Security at HP Labs, summed them up thusly: "

Organizations that have achieved a high level of security effectiveness are better able to identify major data breaches, secure confidential information, limit physical access to data storage devices, and achieve compliance with legal and self-regulatory frameworks. They are also in a better position to attract and retain high-quality security personnel and enforce corporate policies."

Those benefits have ripple effects throughout the organization—benefits that span protecting the company reputation to increasing customer trust and loyalty. And those translate directly to the bottom line.

Granted, measuring security effectiveness is not as straightforward as measuring a manufacturing process. There are many variables that are simply outside of one's direct control. In fact, a recent ISACA report conceded, "...security is contextual and not an isolated discipline; it depends on the organization and its operations.

Furthermore, effective security must take into account the dynamically changing risk environment within which most organizations are expected to survive and thrive." All the more reason that improvements be addressed wherever possible!

In any case, this variability may explain the disparity of results Dr. Kenneth Knapp discovered when he investigated the effectiveness of security programs. He found that while the majority of infosec professionals surveyed believed they were able to secure their information effectively, only 22 percent of them believed so with a high degree of confidence.

Punish careless employees to reduce security breaches, vendor says

Moreover, the survey showed that more than a third did not believe that their organization effectively secures its data. And this is likely understated. Sounds like room for improvement.

                                                                                                  

How B2B companies talk past their customers

 

 

 

New research shows there’s a surprising gap between the brand messages that suppliers offer to customers and what their customers really want to know.

October 2013 | byTjark Freundt, Philipp Hillenbrand, and Sascha Lehmann

Although the digital-marketing revolution’s clearest ramifications and earliest impact may have come in the consumer arena, it’s also roiling the world of business-to-business (B2B) brand building. Business customers, like consumers, engage with companies through search, online communities, and Web-based video, so these are potentially powerful tools for delivering B2B brand messages and amplifying their impact. Our research suggests a potential stumbling block, though: a marked apparent divergence between the core messages companies communicate about their brands and the characteristics their customers value most.

In our research, we examined publicly available documents of Fortune 500 and DAX 30 companies to develop a list of 13 themes and topic areas that companies use to position their brands. These were broad ranging, from the extremely practical (low prices) to the more elevated (corporate social responsibility). We then selected the top 90 global B2B companies by market capitalization across six surveyed sectors.¹ 1.The selected companies were publicly traded, with dominant share deriving from B2B activities. These 90 companies (by 2012 market cap) compete in six sectors: banking and insurance; machines and components; utility services; IT-related products and services; chemicals, commodities, and basic materials; and telecommunications products and services. The survey questionnaire also included a seventh sector, logistics services, which had to be excluded from this analysis as a result of insufficient answers for brand-strength ratings. We reviewed the public documents of the companies to verify how many of their brand messages were clearly linked to the 13 themes that emerged from the broader sample (3 of them didn’t appear among the 90 companies). Then we assessed the degree to which the companies aligned their brand messages with the remaining 10 themes.

To discover how customers viewed these same themes, we surveyed more than 700 global executives² 2.Executives chosen for the survey, conducted in mid-2012, had a substantial influence on the choice of their companies’ suppliers. across the six sectors, asking how important each theme was to the way they evaluated the brand strengths of their primary and secondary suppliers. We used multiple regression analysis to determine the extent to which a theme influenced the correlation.

The results were revealing (exhibit). Themes such as social responsibility, sustainability, and global reach, which many B2B companies cast in a leading role for brand imaging, appeared to have a minimal influence on buyers’ perceptions of brand strength. The inverse was true, as well: two of the most important themes for customer perceptions of brand strength—effective supplychain management and specialist market knowledge—were among those least mentioned by B2B suppliers. Honest and open dialogue, which customers considered most important, was one of the three themes not emphasized at all by the 90 companies in our sample. In addition to these disconnects, our analysis showed a surprising similarity among the brand themes that leading B2B companies emphasized, suggesting a tendency to follow the herd rather than create strongly differentiated brand messages.³

3.In additional research, we found that companies with brands that survey respondents considered strong often had higher EBIT (earnings before interest and taxes) margins than those with weaker brands. Here are three questions whose answers may point to opportunities for improvement.

Exhibit

The themes that many B2B companies consider important for brand imaging appear to have minimal influence on buyers’ perceptions of brand strength.

 

Are you telling the same story as your competitors?

Given the prevalence of similar messages, this is an important checkpoint for many companies. For example, if both you and your rivals claim that your (and their) products derive from renewable sources, this probably won’t move the needle when customers consider your brand. Contrast that with IBM’s Smarter Planet branding effort, which tells a story emphasizing the company’s special capabilities in the digital economy and guides not just external communications but also product development and other forms of employee engagement.

Does your sales force say it is facing headwinds?

Even in the digital era, our surveys show that personal interactions with sales reps remain the most influential factor—across touch points—for B2B customers.⁴ 4.Face-to-face and phone contact with sales representatives ranked highest among B2B customers considering, evaluating, and purchasing products, as well as in product-loyalty decisions. This was true across all industries and regions in our sample. That makes salespeople a great source of information about the degree to which customers see your products as differentiated or worth a premium. Have an honest dialogue with your sales staff. If you hear about consistent pushback on pricing or an inability to articulate a compelling argument for the value of your products, you’ve got a problem. It could be your product or service, of course. But it also may involve disconnects between what your customers value and the messages you send them in your broader (digital and more traditional) marketing activities. Use your sales force to inform these strategies. Leading companies make extensive use of frontline interaction and market research to stay in tune with customer needs and perceptions. For example, Hilti, a maker of professional construction tools, has its salespeople do double duty as distributors and hands-on market researchers at customer construction sites.

Do you deliver your brand in a consistent way?

Especially at a time when opportunities to deliver brand messages are proliferating as never before, consistency is crucial. If anything, today’s increasingly fragmented environment calls for a more disciplined communication of values and messages across a wider range of channels, including some quite traditional ones, for a longer period of time. DHL’s rebranding effort after its acquisition by Deutsche Post is one example. More than a hundred planes, tens of thousands of trucks, and countless uniforms were repainted or replaced to boost brand visibility. Internal company-wide training was designed to turn employees into brand ambassadors, and a set of binding rules for corporate identity and design govern all campaigns and materials.
Don’t mistake consistency for inertia, though: changes in the market environment should influence brand-messaging priorities. To stay abreast of market shifts, American Express, for example, created Open Forum, a virtual platform that helps small-business owners connect with the company and with one another. Amex acts as an adviser, helping its small- and midsize enterprise customers understand the constant variations in the retail marketplace—and learning, in the process, how it can best differentiate its own offerings. Consistently gathering information such as this and evolving in response are valuable ways of closing any gaps that may be opening up between your brand messaging and your customers’ needs.

 

World Cup, Olympics and royal baby could = supply chain strain

What do the World Cup and the Royal Baby have in common? Supply chain disruption, according to one industry insider, who says that while experts predicted that the birth of the royal baby this year would kick-start a two month retail boom for UK companies, such events can also cause significant strain across international supply chains

 

Written by Denise Oakley, international marketing manager at GXS, an award winning, international B2B e-commerce and integration services company.

Major events such as the Olympics, the World Cup or even the birth of a royal baby capture attention around the globe. These positive world events can result in a tremendous boost for local economies as well as the wider global economy. Companies begin to plan months or even years ahead to ensure that they are prepared. There is one area that businesses often forget though - their supply chain.
An inevitable side effect of increased, changing demand is the impact it has in the supply chain. Most companies do try to prepare for changing demand, but few think carefully enough about the impact of a serious disruption, particularly in the extended supply chain, in areas that are outside their control.

Many companies believe that there is nothing that they can do beyond managing their end-to-end supply chain as best they can. The reality is that most supply chains will experience disruption from time to time, sometimes for reasons that could have been anticipated, but often such disruptions are totally unexpected and a failure to plan can have serious consequences. Many supply chains and transport networks are more global than we realise, forming the backbone of a global economy, fuelling trade, consumption and economic growth. When supply chains get disrupted there can be major repercussions for individual companies as well as the global economy.

When world events capture the attention, the focus is naturally on those events themselves. But in order to adequately prepare for major events, whether something on the scale of the Olympics, or something smaller, more local but still major for an individual company, a shift is needed from reactive to proactive supply chain risk assessment and management. Even planned for events have unexpected consequences, some good, some not so good. That’s the nature of the supply chain, but with the increasingly global supply chain, unexpected events may have an impact even if a company isn’t aren’t directly involved.

The list of such impacts becomes longer every year; some of the obvious ones include extreme weather or changing weather patterns, social unrest, changing CSR requirements, new legislation, supplier failures, and inflation plus ever changing consumer demand. When an event impacts just one part of a supply chain, there can be unforeseen, unintended consequences and the effect can be felt much more widely than anticipated.

Companies need to take control and create their own plans, thinking through all of the possible disruptions and how they would continue to run their business as a result.  With luck, they will never need to face any of these problems, but they need to be prepared regardless.  However, there are ways to make this less painful than it seems.

Firstly, this is a subject that many are now looking at - supply chain resilience was on the agenda of the World Economic Forum meeting this year and should also be on every CEO’s agenda.  As global economies start to recover from an economic downturn, they need to ensure that they have supply chain recovery plans in place.

There is growing concern around cyber risk, rising insurance and trade finance costs, which is leading supply chain experts to explore new mitigation options. Recent research by Accenture indicates that more than 80 per cent of companies are now concerned about supply chain resilience. Risk management needs to be an explicit, integral part of supply chain governance. Companies should consider taking the following steps:
          Implementing a multi-stakeholder supply chain risk assessment process.
          Introducing a more adaptable, agile supply chain strategy to improve resilience throughout
          their extended supply chain.
          Outsource (or have ability to move w/o notice) critical elements of your B2B integration
process.

 Look to a provider with a global platform and capability for help here.

Supply chain directors need to turn detective and thoroughly investigate their IT infrastructures as well as their operational management.  Implementing changes here can provide significant gains in resilience via improved analytics, data and information sharing and pre-programmed responses. One suggestion here is that the corner stone of IT based resilience is usually data and information sharing.
Business continuity is usually enabled through access to real time data followed by rapid dissemination of data driven supply chain fixes, but information sharing infrastructures depend on a resilient core network and appropriate communication tools.

 These in turn require an IT infrastructure that is flexible, scalable, secure and re-routable if they are to minimise disruptions across supply chains. Cloud based B2B integration solutions can provide a key ‘cornerstone’ towards developing a highly resilient end to end supply chain and this is certainly an approach adopted by many Japanese multinationals in the last couple of years.

However, it’s one thing being able to deploy B2B tools to help with increased resilience, but when disruption strikes in a supply chain there is a need for a co-ordinated approach. Professional networking web sites such as LinkedIn or Xing have noted the emergence and rise of the business continuity manager. This person becomes the go-to employee during a period of disruption, and is responsible for steering a company through a period of supply chain disruption. Sometimes referred to as the ‘Masters of Disaster’, these people are responsible for making today’s supply chains operate efficiently and seamlessly.

But they will only be successful if they have the tools to reach their community and a flexible, re-routable IT platform available. The ability to proactively monitor supply chains during planned and unplanned events has become a key competitive weapon that companies are increasingly becoming aware of. In the same way that a conductor controls an orchestra, the Master of Disaster needs B2B resources to take appropriate actions before major disruption impacts the business.

This is where some of the newer hosted services can facilitate better, faster and easier B2B collaboration between a company’s employees and individuals in the different organisations with which they do business. The ability to centralise and warehouse critical information is essential, and hosted information on your customers, suppliers, logistics providers and financial institutions can ensure that businesses retain access when it’s most needed. Collaboration tools are now available that provide the necessary information to remain in control, with up-to-date partner information to reduce those supply chain risks, enabling informed decision-making, and averting business disruption. Data that’s held can also include details related to e-commerce readiness, regulatory compliance, consumer product safety, and environmental responsibility.

Sometimes companies get plenty of warning of likely supply chain disruption, as with the Olympics and the World Cup, and (some) notice for the birth of a royal baby. But in many other situations there is little or no warning, and either way disruption needs to be planned for. In order to build increased resilience across a supply chain, companies need to address both their physical and digital supply chain issues. They need to ensure that their B2B platform is scalable, flexible, secure and continuously available and deployed proactively for significant competitive advantage. The mere thought of being unprepared for major world events or just responding to disruptions as they occur
will prove catastrophic, so it is time to take ownership and control.

 

U.S.A. August manufacturing growth fastest   in 26 months

 

 

NEW YORK, Sept 3 | Tue Sep 3, 2013 7:30pm IST

       

NEW YORK, Sept 3 (Reuters) - The U.S. manufacturing sector grew last month at its fastest pace in more than two years, bolstering expectations for faster overall U.S. growth in the second half of the year, an industry report showed on Tuesday.
 The Institute for Supply Management (ISM) said its index of national factory activity rose to 55.7 in August from 55.4 the prior month, comfortably beating expectations for 54. It was the highest reading since June 2011.

A reading above 50 indicates expansion in the sector.
New orders also marked their best level in more than two years, with that sub-index jumping to 63.2 from 58.3. Employment, however, slipped to 53.3 from 54.4.

The government will release its August employment report on Friday. Economists forecast employers added 180,000 new jobs last month after hiring 162,000 workers in July.

Manufacturing has been hurt this year by cuts in government spending and weaker global demand, causing the sector to shrink in May. But sizable increases in activity in July and August are adding to economists' views that U.S. goods-producing companies are finding their footing as the year wears on.

Data last week showed the economy grew at a quicker-than-expected pace in the second quarter and should continue to gain momentum.

(Reporting By Steven C. Johnson; Editing by Chizu Nomiyama)

 When Apple bought AuthenTec for its biometrics technology — reported as one of its most expensive purchases — there was a lot of speculation about how the company would incorporate biometrics in its product line. Many speculate that the new Apple iPhone to be announced tomorrow will come with a fingerprint authentication system, and there are several ways it could work, such as swiping your finger over a slit-sized reader to have the phone recognize you.

Apple would be smart to add biometric technology to the iPhone. Fingerprint authentication is a good balance between convenience and security for a mobile device.
Biometric systems are seductive, but the reality isn’t that simple. They have complicated security properties. For example, they are not keys. Your fingerprint isn’t a secret; you leave it everywhere you touch.

Bruce Schneier

Bruce Schneier is a security technologist and author. His latest book is Liars and Outliers: Enabling the Trust Society Needs to Survive.

And fingerprint readers have a long history of vulnerabilities as well. Some are better than others. The simplest ones just check the ridges of a finger; some of those can be fooled with a good photocopy. Others check for pores as well. The better ones verify pulse, or finger temperature. Fooling them with rubber fingers is harder, but often possible. A Japanese researcher had good luck doing this over a decade ago with the gelatin mixture that’s used to make Gummi bears.

The best system I’ve ever seen was at the entry gates of a secure government facility. Maybe you could have fooled it with a fake finger, but a Marine guard with a big gun was making sure you didn’t get the opportunity to try. Disney World uses a similar system at its park gates — but without the Marine guards.

A biometric system that authenticates you and you alone is easier to design than a biometric system that is supposed to identify unknown people. That is, the question “Is this the finger belonging to the owner of this iPhone?” is a much easier question for the system to answer than “Whose finger is this?”

There are two ways an authentication system can fail. It can mistakenly allow an unauthorized person access, or it can mistakenly deny access to an authorized person. In any consumer system, the second failure is far worse than the first. Yes, it can be problematic if an iPhone fingerprint system occasionally allows someone else access to your phone. But it’s much worse if you can’t reliably access your own phone — you’d junk the system after a week.
If it’s true that Apple’s new iPhone will have biometric security, the designers have presumably erred on the side of ensuring that the user can always get in. Failures will be more common in cold weather, when your shriveled fingers just got out of the shower, and so on. But there will certainly still be the traditional PIN system to fall back on.

So … can biometric authentication be hacked?
Almost certainly. I’m sure that someone with a good enough copy of your fingerprint and some rudimentary materials engineering capability — or maybe just a good enough printer — can authenticate his way into your iPhone. But, honestly, if some bad guy has your iPhone and your fingerprint, you’ve probably got bigger problems to worry about.

The final problem with biometric systems is the database. If the system is centralized, there will be a large database of biometric information that’s vulnerable to hacking. A system by Apple will almost certainly be local — you authenticate yourself to the phone, not to any network — so there’s no requirement for a centralized fingerprint database.

Apple’s move is likely to bring fingerprint readers into the mainstream. But all applications are not equal. It’s fine if your fingers unlock your phone. It’s a different matter entirely if your fingerprint is used to authenticate your iCloud account. The centralized database required for that application would create an enormous security risk.

Enjoy Summer More by Outsourcing

Written by: Melanie Rembrandt August 8th, 2013

 

 

 

 

Hire Outside Experts to Boost Sales
Summer is flying by and August is here. With this in mind, what are you doing to make your life easier during these warmer months?

As a business owner, it’s easy to want to control every aspect of your business. But you can actually save time and accomplish more by outsourcing some of your activities. For example, are you doing your own bookkeeping, transcription, data entry, accounting, SEO copywriting, or other, administrative activities?

These are all tasks you can outsource to professionals. And while you may think you don’t have the funds to do this, can you really afford not to?
If you are entering your receipts, balancing the budget, writing your Website copy, and doing other things like this, are you really spending adequate time focusing on growing sales and customers?

By handing activities over to others, you can focus on what you do best.

Hire a virtual assistant for your administrative tasks. Look for a certified bookkeeper or CPA to help you with your accounting. Find a professional SEO copywriter or content strategist to write your sales messaging, blogs and newsletters. You get the idea.

And if you’re not sure about this, write down exactly how much time you spend each day on different activities. You may be surprised to see how many hours you spend entering numbers into an accounting database, fixing a graphic on a Website page or writing your weekly blog.
If you spent this time on finding new customers and focusing on your core, business strengths, would your business be in a better place?

It’s definitely something to review. And note that it will take some time to find the right people to fit your specific needs and train them accordingly. But once this initial phase is out of the way, you’ll have more time to grow your business. And even more important… more time!