Enterra Insights

Supply Chain Optimization

Robert J. Bowman, managing editor of SupplyChainBrain, writes, "Before companies can apply state-of-the-art technology to that crucial exercise [of optimizing their supply chain], they need to redefine exactly what it is they are trying to optimize. It's not just about cost and time." ["Rethinking the Concept of Supply-Chain Optimization," 19 October 2011] Clearly, a company needs to know "what" it is trying to optimize; but, Bowman's point is different. He's insisting that companies should reexamine the very meaning of the term "optimization. "Sometimes the path to innovation," he writes, "lies in finding a new meaning for an old word." He continues:

"Take 'optimization.' That's been the goal of supply-chain managers for decades. But what exactly have they been seeking to optimize? Most have centered their efforts on cutting cost and time, says Katharine Frase, vice president of industry solutions and emerging business with IBM Research. That narrow view misses some critical, if intangible elements of a modern, best-in-class supply chain. 'In the past,' says Frase, 'people tended to view supply-chain optimization a bit one-dimensionally. They wanted to do routing of trucks, or logistics in the warehouse, or the attributes of vendor management. That was all very important, but it tended to be a bit piecemeal.' It's not a question of tossing out traditional metrics, she says. Companies still need to keep a close watch on supply-chain costs, while minimizing the time it takes to get product to market. But they ought to be taking other considerations into account as well, as part of a much broader view of global supply chains."

Bowman's (and Frase's) point is well made. There is certainly a difference between optimizing the supply chain (i.e., making it the best it can be) and simply reducing supply chain costs. The first characteristic of the supply chain that Bowman and Frase examine is one segment of its sustainability dimension (i.e., "a company’s carbon footprint or total energy bill").

"A focus on this aspect of operations might raise the cost of moving goods, yet yield big advantages in other areas, such as brand image. For example, a food company might want to use more locally grown produce in its supply chain, to position itself as a 'green' organization. Implementing that policy while attempting to hold down costs involves a delicate balance, where one key metric has to give way to another. The trick, says Frase, lies in coming up with a formula that's ultimately most beneficial to the supplier."

I'm not sure that I totally agree with Frase on this point. In several past posts, I've made the point that the only sustainability programs that will endure are those for which a business case can be made. Trading higher transportation costs for better PR doesn't sound like a good bargain to me. It sounds more like greenwashing. For more on this subject, read my post entitled Regional, Local, and Sustainable Sourcing. I'm in fuller agreement with Frase on her next comments, which involve supply chain visibility and flexibility.

"Other elements to take into account include the impact of weather, as it impacts both product flow and customer demand. Often a high-level optimization strategy must be set aside to address the needs of the moment. A sudden snowstorm, for example, might motivate a retailer to increase its supply of snow shovels. Agile providers need to make 'on-the-fly' decisions about where and how they can obtain more product at a moment's notice."

For me, that is essence of optimization -- the ability of a supply chain to respond in near-real time to emerging events to enhance resilience and profitability. Frase told Bowman that "public image can trump top-line considerations in areas that go beyond environmental responsibility." She provides an inventory example.

"A chain of bakeries might be focused on minimizing the amount of bread it has left over at the end of each day. In the process, though, it angers late shoppers who can't find product on the shelves. A smart retailer might up its inventories to please customers, then burnish its image by giving away any leftover loaves to charity. In the end, it reaps a double advantage that wouldn't have been possible with an approach based purely on cost."

Again, I'm a bit skeptical of her example. Profits still drive business. Technology should be able to help the bakery chain optimize its inventory and become more profitable. It is much more important to make one sale of an item with a $10 profit than it is to make ten sales with a $0.10 profit per item. By optimizing on-shelf availability of products, both the chain and its customers benefit (and, of course, the brand's reputation is enhanced). Bowman continues:

"Modern-day supply chains need to be viewed in the context of 'ecosystems,' says Frase. She uses the term to describe a web of supply-chain partners that do not always relate to one another in a linear or serial fashion. Moving up and down the supply chain from a consumer-products company, one encounters a plethora of suppliers and distributors, all of whom must be taken into account when optimizing critical business processes. Companies need to visualize this entire universe of participants in real time, Frase says. Information technology systems that help to achieve this ambitious goal are still in development."

Frase and I are on the same page here. Her "ecosystem" conforms to my thinking about intelligent supply networks. Some consultants like to talk about value chains; but, as I've noted before, they are really value networks that involve much more than linearly-connected links. Like Enterra Solutions' offerings, IBM's offering "pulls data from a number of sources, including point of sale, logistics operations and enterprise resource planning (ERP) systems, to help make sense of the total picture." This data comes from both structured and unstructured sources and optimization solutions must be capable of dealing with both. Only then can you really obtain "the total picture." Frase told Bowman, "By pooling that data outside of everybody's silos, you can get to functions that weren't available before. You're allowing the system to extract approved forms of data so that other people can see it."

Frase is right to emphasize the importance of breaking down silos and sharing information. For more about the reasons why, see my post entitled The Curse of Silo Thinking. The reason that you want to share data is so that corporate alignment can be more easily obtained. When different departments back their arguments using different data, confusion and conflict are more likely to result. Supply Chain analyst Lora Cecere insists that data should be written once and read many times. That is exactly what the solutions described above are aimed at doing. Frase next talks to Bowman about another of my favorite topics "what if" scenarios. Bowman writes:

"Central to this new concept of inventory optimization is the use of 'what-if' scenarios to review all possible options, prior to putting the best one into play. Another IBM Research initiative, this one out of its offices in Zurich, employs this technique. Called AXIO, it draws on years of historical sales data in order to determine optimum stocking levels in a variety of situations. IBM is using the tool in-house, as well as deploying it on behalf of customers such as BMW and several European 'do-it-yourself' retailers."

The only quibble I have with Frase is that it is literally impossible "to review all possible options." The reason is simple; life is too complicated to determine "all possible" scenarios that could emerge. The past is not always prelude to the future. Utilizing "what if" scenarios, however, can train decision makers to respond better and quicker even to unforeseen circumstances. The use of historical sales data is part of what I was referring to above when I discussed the fact that technology can help optimize on-shelf availability. Enterra Solutions offers its customers solutions similar to IBM's. Like IBM's approach, Enterra's reaches "down to the execution level, where the realities of everyday business can play havoc with a carefully thought-out operational plan." Ulrich Schimpel, manager of inventory analytics with IBM Research in Zurich told Bowman, "The normal theory that you see in textbooks about supply-chain optimization ... is not sufficient. You have to take into account a lot of restrictions." Another IBM analyst, Eleni Pratsini, manager of IBM Research’s Mathematics and Computational Sciences Department, told Bowman that "the gap between theory and practice is especially wide in spare parts fulfillment." Bowman explains:

"Demand in that area can be highly erratic. ... In the end, [Pratsini] says, what really matters is service level, but to maximize that metric companies might need to depart from traditional assumptions in economic order quantity (EOQ) theory. Under a contract with IBM Global Services in Germany, automaker BMW is using AXIO to support its IT platform for spare parts delivery. Known as ATLAS, for Advanced Parts Logistics in After Sales, the system operates out of a central warehouse in Dingolfing, Germany. It manages more than 270,000 parts and accessories from some 1,900 suppliers. A pilot version of AXIO reduced BMW's U.S. parts stocks by 10 percent, according to IBM."

Schimpel told Bowman that "'the big idea' behind AXIO is the notion that 'the world is getting more and more connected.'" That "big idea" is certainly not a new revelation. There are all sorts of discussions being held about the era of "big data" and how it can be used to greatest effect. Bowman notes, "Companies don't lack for data and the necessary sensors to track supply-chain performance." He continues:

"They can devise any number of forecasts using complex algorithms and simulations. What they must be able to do is filter that massive amount of information into a coherent picture that conforms to reality. Outside influences that are beyond the control of supply-chain managers, such the buzz of social networks and shifts in weather patterns, must be married with hard data to create an accurate picture."

One of the reasons that Enterra Solutions uses an ontology is because an ontology can help establish relationships that might otherwise be overlooked. When trying to make sense of massive amounts of data, a system that senses, thinks, learns, and acts is absolutely critical for staying ahead of the game. Analysts predict that even greater amounts of data are going to have to be analyzed in the future. The spreadsheet era is quickly ending. Only cutting edge technologies are going to be capable of meeting the challenges that lie ahead; that is why Bowman recommends that companies redefine what is meant by supply chain optimization.

Liability and Risks in Cloud Computing

In a post entitled Business Heads for the Clouds, I briefly touched on the subject of liability and promised to explore the topic further in a later post. The subject was raised by two Gartner analysts, Drue Reeves and Daryl Plummer, who ask several important questions: Is Cloud Computing too big to fail? [Financial Times, 17 October 2011] They wrote:

"Liability – it's a word you don't hear in most cloud discussions, but you might want to start introducing the topic. In the cloud world, questions of who's liable for business failures and how much compensation can be expected are often overlooked. So, how do you know if you're covered or not? The issue is concentration risk and stacked liability. What if one cloud provider got so many big companies (or companies in an industry) and then failed? Could this affect us all? Could it affect the economy? Could a cloud provider become 'too big to fail?'"

Interesting questions all. They went on to write, "A wise man once said, 'Be wary of providers willing to take on any amount of liability because they actually guarantee none.'" They continue:

"Some providers act like they have nothing to lose, but, as the saying goes, you can't get water from a rock. And as we all know, rocks are notorious for not volunteering information — similar to how cloud providers won't (or can't) share how much liability they are taking on or can afford."

If Gartner analysts are thinking about liability, you can bet that a number of high-priced lawyers also have the topic on their minds. Both providers and clients would be smart to give the matter a little thought. Along with Reeves and Plummer, you might be asking, "Liability for what?" They explain:

"Consider lost business opportunities, lost data and lost customers – and that's just a start. Cloud providers take on a great deal of responsibility when they ask you to give up yours. Someone has to be accountable in the end."

Reeves and Plummer report that, in common practice, there are essentially two approaches that are being used to address liability. The first approach limits the liability of the provider. They write:

"First is the provider that states its limit of liability. These providers generally offer very little financial guarantee in the event of failure, but at least they set a benchmark for what to expect."

David Rosenbaum, senior editor for technology at CFO Magazine, puts it this way, "You want your cloud provider to share security risk. Your provider wants to limit its liability. The result is a negotiation." ["Cloud Control," 1 September 2011] We'll return to Rosenbaum's thoughts later. If your provider doesn't want to negotiate, you're left with the second approach used by some cloud service providers -- stony silence. Reeves and Plummer write:

"Second are the providers that make no clear statement of their liability or your own. This means the consumer is on the hook for almost all liability, while the provider fancies itself a 'trustworthy protector of consumer interests.'"

Many businesses find themselves in a "damned if you do and damned if don't" situation. They want better security for their data (which many believe can be obtained by using cloud services); but, on the flip side, the biggest thing they fear about the cloud is security. John Bussey reports that many small- and medium-sized businesses are migrating to the cloud because they are "attracted chiefly by cost savings and service but increasingly by security as well." ["Seeking Safety in Clouds," Wall Street Journal, 16 September 2011] At the same time, he reports that "72% of small businesses ... and 63% of mid-sized companies ... [indicate that] security [is] their chief worry." He explains why some companies believe their data is more secure in the cloud:

"Basic security tasks that often don't get done at a small enterprise—updating antivirus programs or applying patches to software—are usually part of the plain-vanilla package in the cloud. The more you pay, the more you get: firewalls around your data, high-end encryption, 'private clouds' that let you isolate critical information and still access extra processing muscle when you need it, hacker-attack notification and mitigation, and 24-hour tech support."

Bussey acknowledges that "the cloud is no Fort Knox and can cut both ways on security." He explains:

"Multiple users of a given server can create multiple entry points for hackers. If the cloud provider's security is weak and if basic Internet hygiene is sloppy at businesses whose files cohabitate with yours, then you may get infected too. Hackers also love multiple targets in one setting, which the cloud provides. A cloud host could actually make your data more vulnerable."

Returning to the topic of liability, Reeves and Plummer raise another concern: chained liability. They write:

"Chained liability ... happens when cloud service providers use other providers in a chain of dependency to deliver a service. Sometimes these chains extend six or seven service providers deep, and this long lineup is sometimes hidden from the end consumer. As a result, issues like location of the service, security, and terms and conditions of the underlying service aren't easy to see. And that means that any one of these 'hidden' service providers could cause the overall service to fail. If that happens, who would be held accountable - the original service provider? Maybe, but ask yourself this: Are rocks likely to get a lot more talkative tomorrow? In the case of an acquisition, is the acquiring provider required to honor the acquired provider's service-level agreement (SLA)? Or if you've negotiated better terms than the boilerplate, is the acquiring cloud service provider required to honor that contract? You could make the case, or even write into a contract, that the acquiring provider should honor any existing terms, but, then again, the provider may simply decide not to renew it. Here’s the rub: On any of these issues, when there's a conflict between the consumer and the cloud service provider that can't be resolved, the matter may end up in a courtroom."

That's a scary thought. Before discussing what could happen at trial, let's return to what Rosenbaum has to say about negotiating with cloud service providers. He reports that "a significant majority of 127 cloud-computing service providers surveyed believe it is their customers' responsibility to secure the cloud, not theirs." Why? The answer, of course, is liability concerns. He provides, as an example, Amazon's statement of liability. He writes:

"Amazon Web Service's Terms and Conditions, for example, state that it will 'have no liability…for any unauthorized access or use, corruption, deletion, destruction or loss of any of Your Content or Applications.'"

Not very comforting is it? Rosenbaum claims that "the ramifications could be huge." He explains:

"That's because the cloud — which enables companies to outsource everything from e-mail to ERP and then access it all through a browser — is inherently insecure. The same ease of access that makes it appealing also makes it vulnerable. Yet many non-tech-savvy buyers of cloud services are not adequately aware of the security issues, says James Reavis, director of the nonprofit Cloud Security Alliance."

Rosenbaum then asks the $64,000 question: "How can you protect your company in this new, risky business?" As an interesting side note, Rosenbaum provides a case study involving a company called RightNow. RightNow was deciding between two cloud-service providers: NetSuite and Oracle. The company selected ;NetSuite and went through a lengthy negotiation with the company over liability. The company's CFO told Rosenbaum, "You want your vendor to have skin in the game." The case study is interesting because, since the article was written, the company that wasn't selected, Oracle, acquired RightNow. Getting back to the question at hand, Rosenbaum discusses some basic security measures that any good cloud service provider should have in place. To read more on that subject, see my post entitled The "Big Data" Dialogues, Part 8: Cybersecurity. He then discusses legal issues involved. He writes:

"In terms of vetting cloud providers, [Andrew W. Klungness, a partner at law firm Bryan Cave,] advises CFOs to make sure their provider is solvent and carries insurance. 'A financially sound vendor is likely to be there when you turn on the lights Monday morning,' he says. 'Check breach incidents and lawsuits against them, and ask for customer references.' And 'make sure the contract provides for disaster recovery,' adds Klungness. 'If your provider goes down, you should have a plan for getting your data out, and a backup provider ready to go. Make sure the vendor is aware of your auditing obligations. Even if you're only hosting e-mail, if you mention Sarbanes-Oxley and get a blank stare, it's time to ask more questions. The more it's clearly documented that you're telling a vendor what to do, the better your position if a regulator starts asking questions. It shows good faith and due diligence.' Klungness also recommends that clients 'get contracts where there are meaningful credits or refunds. If service goes down, you want to get a portion of your money back or a proration of your fees."

On that last point, Klungness admits that getting "a vendor to compensate you for business loss" is very difficult. "The risk-reward profile of that type of indemnification," he writes, "is very poor." Just as importantly, "if a vendor is willing to stick its neck out to that extent, you may be dealing with an unstable vendor." Rosenbaum indicates that there is another legal issue that companies should consideration that involves the issue of discovery. He explains:

"Daniel Garrie, managing director of ARC E-Discovery Dispute Resolution, and a court-appointed Special Master in governance and e-discovery cases, notes that, 'global corporations have to deal with complex issues of data retention in the cloud. For example, how long do you have to keep e-mails? If you don't plan strategically for adopting cloud, you may fail to realize that they're keeping your e-mails for a year instead of, say, 90 days. Then you get sued and you have e-mails popping up you thought were gone. And then you have to provide them.' That can get very sticky. As Garrie explains, 'Can you ask your provider for 20 million e-mail messages spread out over hell and gone? And what about the metadata [data about data; for example, the revision history, whether it was printed out, all the times it was viewed, and so on] coming with the e-mail? If the provider can't supply it, that could be a big problem. In adversarial litigation processes, destruction of metadata is considered spoliation of evidence, and you can't just say to the judge, "The cloud ate my evidence."'"

Rosenbaum concludes his article with some advice from Larry Ponemon, chairman of the Ponemon Institute.

"'First,' he says, 'make sure the provider has the right security environment in place. Do they have good data-loss prevention technology? How are encryption keys managed? Does the company vet its custodians? Does it do background checks? Does it train its employees in security, and what is that training? The vendor may think training is just sending out an e-mail. Find out what their training consists of. You should be able to audit your provider whenever, wherever,' he says. 'You should visit the data centers. If you see printouts scattered everywhere, that's not good. Find out who's in the cloud with you. If the provider has an insecure customer, that makes you less secure. If the provider has an insecure provider, that also makes you less secure.' And bear in mind, he says, that 'your provider should have written policies — a fire drill — for how they respond to a data breach, and how they inform you about one.' The cloud is new, and it's risky. But the very fact that it's new and risky, Ponemon believes, should give CFOs the upper hand in cloud negotiations — and the ability to walk away if they feel their needs are not being met. 'There are a lot of sellers of cloud services out there,' says Ponemon. 'It's a buyer's paradise.'"

The issue of liability is important for a number of reasons. Clients, of course, don't want to absorb all of the costs of a security breach and neither do the providers. Earlier Reeves and Plummer indicated that liability cases could end up court. The worst case scenario, they believe, is a liability case that awards a client such a settlement that it "breaks the cloud computing model." They write, "Providers would then be forced to accept so much liability that they can’t stay in business without raising prices dramatically, or consumers may be forced to live with too much risk that it’s not worth the trouble to use the cloud at all." They then ask, "So, what can you do about it?"

"One answer might be to acquire cyber risk insurance, which covers cyber events such as loss of service, data confidentiality breach and cyber extortion. However, cyber risk insurance isn't a panacea either. For one thing, it's expensive. A $10m policy costs $100,000 to $300,000. Yet, even with the high cost, the policy limits are too low to cover IT liability for large companies. So, one choice is to stack insurance to achieve enough liability coverage to protect yourself from a cyber risk event. ... But be forewarned that cyber risk insurance policies are steeped in 'legalese' that is often hard to interpret, especially for small to midsize businesses. ... What happens if the insurer doesn’t mitigate its own risk (e.g., takes on too many policy holders to maximise profits)? What if the insurer fails or defaults on a policy holder making a claim? The answer is that the consumer has to deal with a failed policy and insurers that won't sell a policy to anyone at a reasonable price."

Reeves and Plummer conclude, "For today, cloud computing is a liability risk for providers, consumers and insurers. The question is, how much risk are you willing to absorb, and how much risk to a provider becomes risk to us all? Is cloud computing too big to fail? Perhaps it's too big not to." Most analysts agree that cloud services are going to become an increasingly important part of the business landscape. They believe that the benefits far outweigh the risks. Nevertheless, risks do exist and companies need to do everything they can to mitigate the consequences when bad things do happen. Good solutions will only emerge if clients and providers collaborate with, rather than confront, one another. For good or ill they are in the cloud together.

Supply Chain Resiliency Still an Issue

The Business Continuity Institute, a UK-based organization that was established "to promote the art and science of business continuity management and to assist organisations in preparing for and surviving minor and large-scale man-made and natural disasters," recently released a survey that concludes "the sources of supply chain failure are deeply rooted." ["Supply Chains Need to Be More Resilient as Disruptions Are Widespread, Survey Finds," SupplyChainBrain, 9 November 2011] According to the article, "Respondents from 62 countries revealed that 85 percent of organisations recorded at least one supply chain disruption in 2011 with 40 percent of analysed disruption originating below the immediate supplier." The survey's results further highlight the need for more supply chain visibility. Supply chain analyst Lora Cecere has recommended that, at a minimum, visibility should be pursued from a supplier's supplier to a customer's customer. The article continues:

"The survey, now in its third year, emphasises the need for a higher priority to be assigned to developing resilient supply chains in the face of systemic vulnerabilities and unpredictable disruptive events. Supply chain and business continuity management techniques are available and offer the opportunity to better understand supply chain continuity risk and provide methods for managing continuity of key supply chains. ... The survey report concludes that effectively managing supply chain continuity is critical not just because of the immediate costs of disruption, but also the longer term consequences to stakeholder confidence and reputation that may arise following a supply chain failure."

That conclusion is certainly not new or surprising. Apparently, however, companies need to be continually reminded that supply chain resiliency is a serious matter. Other findings from the survey include:

• 51% cited adverse weather as being the main cause of disruption, maintaining its prominence from the 2010 report. Unplanned IT and telecommunication outages were the second most likely disruption, affecting 41%.

• Cyber attack has risen to become a top three source of disruption in the financial services sector.

• Supply chain incidents led to a loss of productivity for almost half of businesses along with increased cost of working (38%) and loss of revenue (32%).

• Longer term consequences of disruption in the supply chain included shareholder concern (19%), damage to reputation (17%), and expected increases in regulatory scrutiny (11%).

• The earthquakes and tsunami experienced in Japan and New Zealand this year, affected 20% of responding organisations, which were headquartered in 18 countries and 12 industry sectors.

• For 17% of respondents the financial costs of the largest single incident totaled a million or more Euros. This figure almost doubles to 32% where less resilient supply chains are evident in the research.

As supply chains have become extended, their complexity and their exposure to risks have increased. The survey was conducted prior to the flooding in Thailand which may have increased respondent exposure to disruption. The point is that events that were once considered black swans are no longer uncommon. Companies that fail to have robust contingency and business continuity plans are going to continue to suffer the consequences of aperiodic disruptions. The article concludes:

"Lyndon Bird, technical director at the institute, commented: 'While just-in-time efficiencies and outsourcing strategies are here to stay in some form, this survey shows it is more critical than ever to strike a sensible balance between the need to drive down costs and the need for these cost savings not to be wiped out through disruption or unacceptable risk exposure, especially in the context of the longer term reputational damage. Business continuity management can help in gaining a better understanding of likely supply chain behaviour when faced by disruption and help build confidence in an effective response and continuity of supply.'"

Time and again the issue of balance between "lean" and "resilient" supply chains is raised by risk management experts. In his doctoral dissertation entitled Supply Chain Resilience: Development of a Conceptual Framework, an Assessment Tool and an Implementation Process, Timothy J. Pettit, included a graphic that, in a very general way, illustrated why balance is the key.

Pettit's point is that resiliency does come with a price that can erode profits. A lack of resiliency, however,  can also affect profits and even expose a company to total failure. Hence, finding what Pettit calls the "Zone of Balanced Resilience" is essential. In his abstract, Pettit writes, "The business environment is always changing and change creates risk. Managing the risk of the uncertain future is a challenge that requires resilience – the ability to survive, adapt and grow in the face of turbulent change. ... Findings suggest that supply chain resilience can be assessed in terms of two dimensions: vulnerabilities and capabilities." As a result of his research, he "identified seven vulnerability factors composed of 40 specific attributes and 14 capability factors from 71 attributes that facilitate the measurement of resilience." Much of the focus of his dissertation deals with an assessment tool that was developed at the university he was attending. He explains:

"The Center for Resilience at The Ohio State University (OSU) has developed a new supply chain resilience framework to assist businesses deal with change: resilience is 'the ability of an enterprise to survive, adapt and grow in the face of change and uncertainty.' We created a tool for measuring resilience in a business enterprise – Supply Chain Resilience Assessment & Management (SCRAM™) – to assess supply chain resilience in terms of two major dimensions:

• Vulnerabilities – fundamental factors that make an enterprise susceptible to disruptions

• Capabilities – attributes that enable an enterprise to anticipate and overcome disruptions

"We define the Zone of Balanced Resilience as a balance between vulnerabilities and capabilities, where firms will be the most profitable in the long term."

If you want to read more about how uncertainty can affect the supply chain, read my post entitled Uncertainty, Confidence, and Catch-22 in the Supply Chain. Pettit concludes:

"Although further validation is required, managers should be encouraged to make the minimal investment required to determine their current state of resilience and compare their strategy with the resilience fitness space."

If you're interested, you should download and read Pettit's entire dissertation. Robert J. Bowman, Managing Editor of SupplyChainBrain, also believes that making an assessment of your capabilities is a good idea. "Some kind of early-warning system for supplier stability," he writes, "is essential – now more than ever. When it comes to the solidity of the typical supplier base, retailers and original equipment manufacturers these days are skating along on thin ice." ["Do You Have a Stable Supplier Base? Are You Sure About That?" 18 April 2011] According to Bowman, one of the reasons that the ice has been thinned is because so many companies have adopted lean practices. He writes:

"To cut costs, they've consolidated vendors down to the barest minimum – sometimes just one for a given component or region. That's a fine way to boost buying leverage, but it also raises the risk of a major supply-chain disruption in the event of natural or economic disaster. The kind of thing that seems to happen every other week. Making matters worse are the stretched-out lead times caused by outsourcing to Asia and other locations far from end markets. Companies that crossed the ocean in search of cheap labor are discovering how much tougher it is to solder a snapped link in the chain."

The primary focus of Bowman's article is on suppliers that are fiscally unsound and at risk of failing. He writes:

"So how can manufacturers do a better job of detecting future failures among their suppliers? Start by realizing the limitations of traditional financial data. 'It's one of the easiest things to [examine] – and the one that lets everybody down the most,' says Jon Bovit, chief marketing officer with CVM Solutions. And when you do request a supplier's financial statement, don't stop with one. The best practice, he says, is to demand three years' worth of financials and credit reports on a rolling basis. That's essential information, but it can be misleading. By the time bad news creeps into a financial report, it's often too late. Risk scores based on periodic statements provide a snapshot of the company's health several months or quarters ago. 'They don't give you a very forward-looking perspective,' Bovit says. ... Bovit recommends supplementing financials with a 'usage trust metric.' Simply put, that's a measure of whether a supplier is losing or gaining customers."

Bovit told Bowman that he also recommends listening to the "chatter" about suppliers that can be found on social networks.

"Social networks are an excellent place to get a sense of what companies are saying about their vendors. 'If there seems to be a lot of pure news counts on a certain supplier you have in Japan, chances are it's being affected,' says Bovit. Internal communications within a large buying organization can also reveal weaknesses within the supply base. It helps to know what the person in the next cubicle is talking about."

Although Bowman recommends that companies be pro-active in assessing their supply chains, he admits that one strategy is doing "nothing to assess the health of your suppliers, then count on your ability to adjust quickly when one or more of them goes belly up." Josh Green, chief executive officer of Panjiva, told Bowman, "That's actually not a crazy strategy." He explains, "It's reasonable if you have a nimble organization." In retort, Bowman asks, "Do you really want to take that chance?" He continues:

"There are too many stories about 'best-in-class' manufacturers who suffered serious supply-chain crises after an economic slump or even a factory fire caused by lightning. The problem with traditional [financial] risk-management tools, says Green, is that they weren't designed for the supply chain. They were created by credit-rating agencies to evaluate customers, not suppliers. And they're most effective when the user has access to a wealth of financial data about the company it's investigating, which isn't always the case with suppliers based outside the U.S."

Green also told Bowman that he recommends that companies go beyond investigating their immediate suppliers. They should "find out the identity of the supplier's suppliers, so you can track whether it's paying its bills on time." Bowman does acknowledge that there are "other kinds of supply failures have nothing to do with financial distress." He concludes:

"A key vendor might drop you as a customer, in favor of a more lucrative competitor. Such a scenario 'has not even remotely been touched by traditional financial measures,' says Green. There's also the possibility of severe damage to one's brand by irresponsible behavior on the part of the supplier, in the form of tainted products. One metric isn't going to tell the whole story – not by a long shot. 'When the Great Recession got going, all of a sudden it was all about risk,' says Green. 'Amazingly enough, two years on, there still is nothing even approaching a silver bullet when it comes to supplier risk management.' But smart companies aren't without ammunition."

Green's assessment certainly substantiates the conclusion of the Business Continuity Institute survey that "the sources of supply chain failure are deeply rooted." That being the case, finding Pettit's "Zone of Balanced Resilience" makes a lot of sense if you want your company to thrive in the years ahead.

Learning to Innovate

Zoe McKay writes, "Some people are born innovators. Others can become innovators, providing they follow some simple guidelines. That's the thesis of 'The Innovator’s DNA,' just published by Harvard Business Press, by Hal Gregersen, INSEAD Associate Professor of Leadership, with Jeffrey H. Dyer of Brigham Young University and Clayton Christensen of Harvard Business School." ["Innovator's DNA: Some Are Born, Others Can Learn," Forbes, 21 July 2011] I find the subject of innovation to be fascinating. I certainly agree with the notion that some people are born innovators. They have a gift -- like some people have a gift for music or art. It's my belief that the born innovators are the ones that make the biggest contributions; however, just like less gifted people can learn to play instruments or paint, it makes sense that less gifted people can also learn to innovate. In this post, I'll discuss three articles -- each featuring one the books authors. McKay's short article focuses on the thoughts of author Hal Gregersen. She continues:

"Innovators think differently and they behave differently, says Gregersen. They ask questions, look out for the unexpected, and are ready to experiment. About one third of these traits is genetically inherited, he believes, but the other two thirds can be learned. That's good news for companies. They can unleash the innovative capabilities of their employees by making innovation a priority from the top of the company downwards."

I'd modify that "good news" to say that companies with the right corporate culture "can unleash innovative capabilities of their employees." Booz & Company analysts, Barry Jaruzelski, John Loehr, and Richard Holman, insist that, when it comes to corporate innovation, the most important factor "is the role played by corporate culture — the organization's self-sustaining patterns of behaving, feeling, thinking, and believing — in tying them all together." ["The Global Innovation 1000: Why Culture Is Key," Strategy + Business, 25 October 2011] Gregersen told McKay that innovative companies generally have innovative people at the top. "The people part, it starts at the top," he said. "You walk into senior management teams in organisations that are incredibly innovative and they don't delegate innovation to somebody else." He also agrees with Jaruzelski, Loehr, and Holman that corporate culture is critical. McKay concludes"

"But openness to new ideas has to be the rule right through the company, Gregersen says. Employees at every level should be constantly invited to ask themselves: 'How can we do this better?' In a successful company, innovation 'is everybody's job. It's just part of what you do when you walk in through the door today when you come to work.'"

In another article about The Innovator's DNA, the featured author is Clayton Christensen. ["Think different," The Economist, 6 August 2011] The article begins:

"Innovation is today's equivalent of the Holy Grail. Rich-world governments see it as a way of staving off stagnation. Poor governments see it as a way of speeding up growth. And businesspeople everywhere see it as the key to survival. Which makes Clay Christensen the closest thing we have to Sir Galahad. Fourteen years ago Mr Christensen, a knight of the Harvard Business School, revolutionised the study of the subject with 'The Innovator's Dilemma', a book that popularised the term 'disruptive innovation'. [His latest book is] 'The Innovator's DNA', co-written with Jeff Dyer and Hal Gregersen, which tries to take us inside the minds of successful innovators. How do they go about their business? How do they differ from regular suits? And what can companies learn from their mental habits?"

The assertion that you can learn by aping what others do is certainly not a new concept. Many creativity gurus recommend that when faced with a challenge you should ask yourself: What would [insert famous person's name here] do? To get the most from such an exercise, consultants recommend that you consider famous people from outside your line of work or business sector. Gregersen, Dyer, and Christensen are offering some insights into how some of the world's "born innovators" think and act. The article continues:

"Mr Christensen and his colleagues list five habits of mind that characterise disruptive innovators: associating, questioning, observing, networking and experimenting. Innovators excel at connecting seemingly unconnected things. Marc Benioff got the idea for Salesforce.com by looking at enterprise software through the prism of online businesses such as Amazon and eBay. Why were software companies flogging cumbersome products in the form of CD-ROMs rather than as flexible services over the internet? Salesforce.com is now worth $19 billion. These creative associations often come from broadening your experience. Mr Benioff had his lucrative epiphany while on sabbatical—swimming with dolphins, he says. Joe Morton, co-founder of XANGO, got the idea for a new health drink when he tasted mangosteen fruit in Malaysia. Mr Christensen and [his colleagues] reckon that businesspeople are 35% more likely to sprout a new idea if they have lived in a foreign country (a rather precise statistic). But this is not a recipe for just hanging loose: IDEO, an innovation consultancy, argues that the best innovators are 'T-shaped'—they need to have depth in one area as well as breadth in lots."

I'll discuss the five habits of mind in a little more detail below. They aren't really new, just repackaged by some very bright people. Consultants have for years pointed out that the most creative people ask questions -- lots of questions. As the article states, "Innovators are constantly asking why things aren’t done differently." They also expose themselves to a range of ideas. Many creative people, for example, have offices stuffed with gadgets and toys. They read a variety of magazines and books outside of their area of expertise. They watch movies of all genres and they travel. The article continues:

"This taste for questions is linked to a talent for observation. Corey Wride came up with the idea for Movie Mouth, a company that uses popular films to teach foreign languages, when he was working in Brazil. He noticed that the best English speakers had picked it up from film stars, not school teachers. But people without a flair for languages find the 'Brad Pitt' method tricky—actors speak too fast. So Mr Wride invented a computer program that allows users to slow films down, hear explanations of various idioms and even speak the actors' lines for them."

The article claims that innovators have a "reputation as misfits." That's probably because there is a fine line that separates inventors from innovators. I'd say that inventors are more deserving of the misfit title than innovators. Not everything that inventors come up with is useful. An innovator, on the other hand, only attains that moniker if he or she comes up with something new, useful, and valued. Whereas some inventors (like mad scientists of literature and movies) are loners, innovators, it turns out, "tend to be great networkers." The article explains:

"They hang around gabfests to pick up ideas, not to win contracts. Michael Lazaridis, the founder of Research in Motion, says he had the idea for the BlackBerry at a trade show, when someone told him how Coca-Cola machines used wireless technology to signal that they needed refilling. Kent Bowen has turned CPS Technologies into one of the world’s fizziest ceramics companies by encouraging his employees to network with scientists who are confronted with similar problems in different fields: for example, the company eliminated troublesome ice crystals by talking to experts on freezing sperm (really)."

In a number of past posts concerning creativity and innovation, I've noted that the most interesting discoveries and innovations are found at the intersections of disciplines. Universities have picked up on that notion and some of the best schools offer courses that integrate business, engineering, and science. The article goes to report that "innovators are also inveterate experimenters, who fiddle with both their products and their business models."

"Jeff Bezos, the founder of Amazon, now sells e-readers and rents out computer power and data storage (by one estimate a quarter of small and medium-sized companies in Silicon Valley use the company's cloud). These experiments are frequently serendipitous. IKEA never planned to base its business on self-assembly. But then a marketing manager discovered that the best way to get some furniture back into a lorry, after a photo-shoot, was to take its legs off, and a new business model was born."

Of course, having an idea is very different than having the courage to act on that idea. One of the benefits of encouraging innovation in an established company is that employees can get rewarded for their ideas with little risk on their part. As noted above, that is why corporate culture is so important to the innovation process. The article states that "Christensen, Dyer and Gregersen argue that companies that have the highest 'innovation premiums' (calculated by looking at the proportion of their market value that cannot be accounted for by their current products) display the same five habits of mind as individual innovators. They work hard to recruit creative people." It explains:

"They work equally hard at stimulating observation and questioning. Keyence Corporation, a Japanese maker of automation devices for factories, requires its salespeople to spend hours watching its customers' production lines. Procter & Gamble and Google have found that job swaps provoke useful questions: the Googlers were stunned that P&G did not invite 'mommy bloggers'—women who write popular blogs on child-rearing—to attend its press conferences."

The article ends with some skepticism about how much innovation can be learned. It notes that the book's authors, despite "their insistence that innovation can be learned, ... produce a lot of evidence that the disruptive sort requires genius." The article's concludes, "Nearly all the world's most innovative companies are run by megaminds. ... The innovator's DNA is rare, alas. And ... it is impossible to clone."

To be fair to the book's authors, they don't claim that by following the five habits of mind that a person will transform into another Steve Jobs. They do believe, however, that individuals who adopt the five habits will become a more innovative version of themselves. A third article about the book, focuses on Jeffrey H. Dyer, who taught at the Wharton School of Business before returning to BYU where he received his MBA. "Dyer is the only strategy scholar in the world to have published five times in both Harvard Business Review and Strategic Management Journal and he was the fourth most-cited management scholar over the period from 1996-2006." ["BYU Prof’s New Book and Forbes Article Tell How Everyone Can Innovate Like the Best," BYU Media Relations, 11 August 2011] According to the article, "Dyer ... and his coauthors found that the most innovative CEOs spend 50 percent more time practicing five specific innovation skills than do their less creative counterparts." Whereas The Economist calls these skills "habits of mind," Dyer calls them "discovery skills." Those skills are listed below "along with specific actions you can take to implement them":

"Questioning -- 'It became clear early on that these folks asked a lot more questions than your typical executive,' Dyer said. 'Especially questions that challenge the status quo.'

• Write 10 questions each day that challenge assumptions in your company or industry. Asking 'why?' 'why not?' and 'what if?' spur creative thinking. Embrace constraints. For example, ask, 'If we were legally barred from doing things the way we do them now, what would we do?'

"Observing -- 'But if you just sit in your room and question all day, you are not going to start an innovative business,' says Dyer, who chairs the Marriott School of Management's Department of Organizational Leadership and Strategy. 'There's an action-oriented attitude that is captured in observing and these other skills.'

• Watch people, especially potential customers. Watch how customers experience a product or service in their natural environment. Focus on what’s different than you expected.

"Networking -- 'Rather than network to gain access to resources or to market yourself, connect with others who have very different backgrounds to simply to find and test new ideas. This will widen your perspective,' Dyer says.

• Contact the five most creative people you know and ask them to share what they do to stimulate creative thinking. Go to conferences that include people from outside your function, company, industry, or profession.

"Experiment --

• Seek training outside your expertise. Take apart a product or process just to see how it works.

"Living in a different country and culture is an excellent opportunity to experiment, says coauthor Gregersen. 'You can't succeed in living overseas without using these discovery skills,' he says. 'The constant practice of those skills--required by the novel cultural environment--not only helps people in their present challenges, but also prepares them for equally interesting (but qualitatively different) challenges later.'

"Associating --

• Connecting seemingly unrelated questions and ideas is the skill that brings all the others together, Dyer explains. But associating is triggered by new knowledge that is acquired through questioning, observing, experimenting, and networking.

"The researchers noted that the senior executives of the most innovative companies in their study don't delegate creative work. So how do they make time for these innovation skills? They enlist others' help in planning and analysis, the skills that are important for executing rather than innovation, Dyer said. 'Contrary to conventional wisdom, innovation isn't a genetic endowment magically given to some and not others; it's a set of skills that can be developed with practice,' Dyer says. 'If you want to be one of the really successful people that make a mark in business, you want to be the person that comes up with the idea, not just the person who carries out others' ideas.'"

Of all the skills, the most difficult to learn is undoubtedly associating. It "is the skill that brings all the others together." If there is a genetic endowment for innovators, my guess is that it would be in the ability to associate disparate ideas in a meaningful way. Perhaps that's why no exercises were recommended to teach this skill. As I noted above, none of the ideas in the book appear to be new; but, it is always good to be reminded how we can make ourselves think more creatively.

Thanksgiving 2011

Today is the Thanksgiving Day holiday in the United States. Like the past several years, it finds many people in need living in an economy that gives them little reason to hope. Yet, even in dire circumstances, a person should be able to find something for which to be thankful. I truly believe that having a thankful heart can make even the most miserable conditions more tolerable. Thanksgiving Day was set aside for people to pause and give thanks to a higher power; but, even individuals who don't believe in a higher power have reason to give thanks to someone. Henry van Dyke wrote:

"Gratitude is the inward feeling of kindness received. Thankfulness is the natural impulse to express that feeling. Thanksgiving is the following of that impulse."

Wherever you might find yourselves, and in whatever circumstances, I hope that on this day you will be able to search your heart and find something for which to be thankful. If you find yourselves with much to be grateful for, then I suggest that you ponder about what you can do to make someone else's life better. You may be the person for whom those individuals offer thanks next year. From all us at Enterra Solutions, Happy Thanksgiving.

Uncertainty, Confidence, and Catch-22 in the Supply Chain

Daniel Dumke writes, "For several years now researchers [have] predicted, that in the future supply chains [will] compete, not companies." ["Supply Uncertainty and Chain-to-Chain Competition," Supply Chain Risk Management, 15 August 2011] If true, one must ask: what is the nature of that competition? Steve Banker asserts, "The ultimate point of supply chain management is to help companies be cost competitive while maintaining the bare minimum of inventory consistent with achieving a targeted service level." ["The Catch-22 of Supply Chain Risk Management," Logistics Viewpoints, 13 June 2011] Banker realizes, however, that there is a problem with that description of a competitive supply chain. He continues:

"Global outsourcing, reducing the number of suppliers you do business with, and using optimized planning to reduce inventory are common techniques companies use to accomplish a cost-effective supply chain. But all of these things that make for a lean and mean supply chain can also cause a supply chain to become brittle and break in the face of disasters. ... Supply chain risk management says that you can avoid this outcome by having redundant factory lines in different geographic locations, using multiple suppliers, and carrying more inventory in locations around the world. These actions, of course, are the very opposite of what it takes to be a low-cost supply chain. This double bind is most acute for companies that compete mainly on price rather than service or product attributes. If these companies practice the prescribed risk management practices, they might find themselves losing a little market share year after year to competitors that don't engage in supply chain risk management. Eventually, the company becomes an afterthought in the market. On the other hand, if a company runs a brittle, low-cost supply chain, the company may gain a little market share year after year until a disaster occurs. The firm then experiences a huge drop in market share all at once."

In other words, being competitive means a company often finds itself in a Catch-22 situation. Retailers can help disrupt this unnerving situation by working with suppliers that maintain the most resilient supply chains. At least one study has shown that doing so is in a retailer's own best interest. The study was conducted by Professors Biying Shou, from City University of Hong Kong, Jianwei Huang, from The Chinese University of Hong Kong, and Zhaolin Li, from The University of Sydney. They conclude, "that a retailer should order more ... if its competing retailer's supply becomes less reliable." ["Managing Supply Uncertainty under Chain-to-Chain Competition," Social Science Research Network, 27 August 2009] Their study examines "competition of two supply chains which are subject to supply uncertainty. Each supply chain consists of a supplier and a retailer." The model may be simple, but the results are profound. They confirm what a number of supply chain analysts have been saying about the short-sightedness of perceiving the supply chain as a cost center that needs to be squeezed continuously to extract savings rather than a potential competitive advantage.

The authors note that "supply uncertainty is becoming a major concern in the global supply chain management." Uncertainty can breed apprehension which results in less confidence. Professors Martin Christopher, from Cranfield University, and Hau Lee, from Stanford University, believe that lack of confidence can have a serious deleterious effect on supply chains. ["Mitigating Supply Chain Risk Through Improved Confidence," International Journal of Physical Distribution & Logistics Management, 2004] They believe that increased supply chain visibility can improve confidence and help reduce uncertainty. In their abstract, they write:

"Today's marketplace is characterised by turbulence and uncertainty. Market turbulence has tended to increase for a number of reasons. Demand in almost every industrial sector seems to be more volatile than was the case in the past. Product and technology life-cycles have shortened significantly and competitive product introductions make life-cycle demand difficult to predict. At the same time the vulnerability of supply chains to disturbance or disruption has increased. It is not only the effect of external events such as wars, strikes or terrorist attacks, but also the impact of changes in business strategy. Many companies have experienced a change in their supply chain risk profile as a result of changes in their business models, for example the adoption of 'lean' practices, the move to outsourcing and a general tendency to reduce the size of the supplier base. This paper suggests that one key element in any strategy designed to mitigate supply chain risk is improved 'end-to-end' visibility. It is argued that supply chain 'confidence' will increase in proportion to the quality of supply chain information."

That conclusion is certainly not surprising to anybody who follows supply chain management thought leadership. What is surprising is that seven years on, we're still talking about it with increased urgency. Supply chain uncertainty remains a problem and disruptions continue to occur. Christopher and Lee believe that lack of confidence creates a "risk spiral" that is often self-induced. They explain:

"The intangible lack of confidence in a supply chain leads to actions and interventions by supply chain managers throughout the supply chain, which collectively, could increase the risk exposure. A classic example of this is the potential reaction from the customer-facing end of a business. For example, if a sales team believes that order cycle and order fulfilment times are not reliable, they will devise their own means of addressing this. They may order stock so as to have supplies to support their key customers and put in phantom (i.e. their own private buffer stock) orders to secure supply, all causing inefficiencies."

Christopher and Lee present a table in which they show other ways that lack of confidence results in a risk spiral.

They depict the risk spiral itself this way:

Christopher and Lee assert that the "risk spiral exists everywhere, and the only way to break the spiral is to find ways to increase confidence in the supply chain. To do so, we need to understand the elements of the supply chain that can reduce the lack of confidence – visibility and control." They continue their discussion with insights about visibility:

"Visibility -- Confidence in a supply chain is weakened when end-to-end pipeline time, i.e., the time it takes for material to flow from one end of supply chain to the other, is long. The increased globalisation of supply chains and the prevalent use of subcontract manufacturing and offshore sourcing can contribute to the length of time it takes to complete all the needed steps in the process. Associated with pipeline length is the lack of visibility within the pipeline. Hence, it is often the case that one member of a supply chain has no detailed knowledge of what goes on in other parts of the chain – e.g., finished goods inventory, material inventory, work-in-process, pipeline inventory, actual demands and forecasts, production plans, capacity, yields, and order status. The key to improved supply chain visibility is shared information among supply chain members. Traditionally companies have tended to subscribe to the view that 'information is power' and to interpret the phrase as meaning power is diminished if that information is shared. In fact in supply chains the reverse is true. If information between supply chain members is shared, its power increases significantly. This is because shared information reduces uncertainty and thus reduces the need for safety stock. As a result, the system becomes more responsive and, ultimately, could become demand driven rather than forecast driven. Mason-Jones and Towill (1997 and 1998) have demonstrated that 'information-enriched' supply chains perform significantly better than those that do not have access to information beyond their corporate boundaries."

Increased access to information is of little value unless it is meaningful, timely, and can be acted upon. Christopher and Lee next to turn to that aspect of the supply chain which they call "control." They write:

"Control -- In addition to visibility, supply chain confidence requires the ability to take control of supply chain operations. Paradoxically, most supply chains do not have a great deal of control once the order is released. Hence, even if a supply chain manager has visibility of some part of the pipeline, he/she often could not make changes in a short time. For example, even if information is obtained on demand changes or on yield shortfalls, the supply chain manager may be helpless, since the suppliers may not be flexible enough to respond to late changes, or there are no expediting options available, or the production line is inflexible and production schedule changes are not feasible, etc. Semiconductor manufacturers are often faced with this problem of lack of control. In this industry, the long lead times required by foundries are such that, even if the manufacturer is made aware of sudden market demand changes, it takes a long time to respond so that the market opportunities are then missed."

At Enterra Solutions we are working to provide clients with increased visibility so that they have more control over their supply chains. I wholeheartedly agree with Christopher and Lee that "the key to improved supply chain visibility is shared information among supply chain members." Most manufacturers and retailers also appreciate the importance of visibility and control. I suspect that Banker agrees that improved visibility and control can help break the Catch-22 situation he described at the beginning of this post. He offers some other suggestions as well:

"There are risk management practices that any company can adopt that do not fall into the category of a double bind. For example, a firm can do contingency planning upfront on who will do what when a facility goes down. The company can look for components widely used across its products that would put significant revenues at risk if the supplier of that component was to experience difficulties; for these components, the company should look at dual sourcing. And companies can have preset playbooks in place for disasters that are more likely to occur. ... For example, many retailers know that hurricanes are apt to strike the Gulf region every year during certain months. These retailers also know what products would be in demand when a hurricane hits, so they could carefully track hurricane forecasts and move the necessary inventory forward to key DCs before a hurricane strikes. But for companies that differentiate mainly on price, the core practices associated with supply chain risk management will continue to represent a Catch-22."

The opposite of having a lack of confidence is having trust. Trust is increased as information is shared because, as Christopher and Lee write, "shared information reduces uncertainty." Good contingency plans also help reduce uncertainty and increase trust because people understand what alternatives are available. Whether you call it a Catch-22 scenario or a risk spiral, it's a situation that companies need to work hard to avoid.

The "Big Data" Dialogues, Part 9: Physical Security

One might think that discussions about "big data" would start and end in cyberspace. The fact of the matter is that even data must be stored in physical locations within physical hardware. Those physical assets need to be protected as securely as the data they contain. There are two directions from which threats to physical security can arise -- inside and outside. Threats from the outside are often easier to deal with threats than threats from the inside because the number of potential breach attempts is lower and the vulnerabilities are generally better known. Internal physical security threats, however, generally make it onto analysts' lists of top risks to cloud computing. At a recent conference, Marlin Pohlman "noted that No. 3 on the Cloud Security Alliance's 'Top Threats to Cloud Computing' list is malicious insiders." ["Why physical security matters, even in the cloud," by Thomas J. Trappler, Computer World, 26 October 2011] Trappler, director of software licensing at UCLA and a nationally recognized expert in cloud computing risk mitigation, writes, "This serves as a good reminder that old-fashioned physical security issues require a lot of attention when you're considering a cloud service provider."

Jeff Beckman, a solution manager at Cisco, ranks "user access control" as the number four security threat on his Top 5 list. ["The Top 5 Security Risks of Cloud Computing," Cisco Blog, 3 May 2011] He writes:

"Data stored on a cloud provider's server can potentially be accessed by an employee of that company, and you have none of the usual personnel controls over those people. First, consider carefully the sensitivity of the data you're allowing out into the cloud. Second, follow research firm Gartner's suggestion to ask providers for specifics about the people who manage your data and the level of access they have to it."

Trappler agrees with Beckman and asserts that "it's important to vet the physical security of a cloud provider's data centers." He discusses "some of the key issues to investigate" when searching for cloud storage provider:

"Security policy. A policy typically details the mechanisms that the vendor has in place to prevent security breaches. An incident response plan typically details steps the provider will take should a breach occur. If the vendor has such documents, carefully review them. If it doesn't, that's a big red warning flag."

Although the primary focus of a contingency plan dealing with security breaches is likely to be on hacking breaches, it should also deal with unauthorized entry onto the premises. Unauthorized entry breaches, however, can also come from inside an organization. That is why Trappler's next issue deals with access control. He writes:

"Access Controls. Does the cloud provider have physical access controls in place to ensure that only authorized personnel are able to access the IT infrastructure on which your data is stored and processed? Ask the following questions:

• Are the data centers in nondescript facilities?

• Do those facilities have security guards, gates and checkpoints?

• Do they have video surveillance systems?

• Does the vendor use intrusion-detection technology?

• Does it use multifactor authentication?

• Does it have a need-based access policy, with access rescinded if a user's need changes?

Even if adequate access controls are in place, Trappler reminds us that not everyone working in a facility necessarily has your best interests at heart. That is why he recommends that background checks be conducted. He writes:

"Background checks. Does the cloud provider conduct background checks on everyone who has access to its infrastructure and your data? This can prevent malicious insiders from getting inside in the first place. Additionally, you should determine if the cloud provider requires all staffers to receive training that covers the issues pertinent to data security and the provider's own security policies."

I've read study results that assert that the greatest risk to most IT systems come from intentional and unintentional actions by personnel within an organization. That is why Trappler stresses the importance of training and procedures. He then recommends going a step further by segregating duties. He writes:

"Segregation of duties. Does the cloud provider distribute key tasks among multiple employees? This can help ensure that no single person is able to execute an unauthorized or inaccurate end-to-end transaction and go undetected. And if there are malicious insiders, the practice of distributing tasks among various people will make it harder for them to get away with anything."

You want your service provider to be paranoid when it comes to protecting your data. Things get trickier if third parties have access to your data. Trappler explains:

"Third-party adherence. If the cloud provider works with third parties, does it contractually require that those third parties understand and abide by the same security policies that apply to the provider's employees? Also, does the provider have processes in place to monitor the activities of third parties to ensure compliance? This can help prevent a malicious third party from becoming a malicious insider."

Trappler recommends making security guarantees a part any contract. He concludes:

"As always, you need to address these issues in the contract. If the cloud provider's security policy and incident response plan pass muster, then simply attach those documents to the contract and designate them as the cloud provider's minimum security requirements. If the policy and plan are lacking, you can address any shortcomings with additional corrective language in the contract. Following this process and codifying requirements in the cloud service contract is the best way to effectively minimize risks in the cloud."

Nick Coleman agrees that security remains the single greatest concern that companies have about cloud computing. He writes, "The big questions with cloud security boil down to: Where is my data? Who will be able to access it? And, how will I be able to maintain oversight and governance?" ["Securing The Cloud: Questions and Answers," Wired Cloudline] He continues:

"In looking at security, the fundamentals still apply. Building security involves three essential considerations: Have we designed security into how we build the cloud? Have we understood this in the context of what we are trying to do? Have we got security running for these cloud environments? To ensure we are communicating our approach we developed the cloud security reference model to help achieve this. This reference model [see attached figure] covers eight categories ranging from cloud governance, security, and risk and incident management to infrastructure protection and personnel and physical security."

I like the framework because it addresses people, processes, and technology -- three things that must always be kept in mind in any organization. Coleman indicates that "the reference model also allows for setting expectations about what the cloud provider would do and what the customer is expected to do." That's a good point. Without proper procedural practices by customers, they could actually end up making their own data vulnerable. Coleman concludes:

"In summary over the past several years, security concerns surrounding cloud computing have become the most common inhibitor of widespread usage. This often translates to where is my data, who will be able to access my data, and how will I maintain oversight and governance? Each cloud model has different features which changes the way security gets delivered which also changes the way we look at security governance and assurance. Determining your desired security posture [allows you tailor the] cloud in such a way that the new risks can be managed in a rapidly changing landscape."

Whether you manage your own data, access control, and other layers of security, or outsource those responsibilities to a cloud provider, you must be aggressive in implementing security policies. My company, Enterra Solutions, believes that attribute-based access control (ABAC) is the best way to facilitate information sharing policies within an organization as well as sharing information outside the organization (e.g., with business partners, regulatory bodies, law enforcement). It is a scalable framework that implements security policy from the top down but leaves the organization that owns the data in charge of who has access to it and how it is shared across a federated domain. We have applied this framework to physical security surveillance systems so that critical infrastructure enterprises can automatically provide first responders access to closed-circuit television (CCTV) video so that they can incorporate "live data" as they respond to an incident. Our framework ensures compliance with the enterprise security policies and Information Sharing Governance Plan and validates that the latest rules are applied to the specific situation and data being shared.

Today, sharing enterprise data is easier and has more value to your business if used in a real-time vice an archived approach (e.g., feeding a live video of a robbery to the police is more useful in protecting your property than giving them your surveillance tape after the fact). However, the complexity of sharing such information even with law enforcement or other government agencies probably requires a relook at your information sharing governance structure and enterprise security policies. Some sharing is driven by regulations and some by your business policies, either way; your governance framework for information sharing should be policy-driven so that you know all of your bases are covered. Our ABAC framework enables this governance model for the most granular level of data (e.g., for the CCTV video, it could be a specific date/time archive video from a specific camera). This framework is applicable to any cloud offering where complex access control rules, federated users groups, multiple systems and applications, large data sets, and dynamic situations are present.

Local Sourcing Gaining Ground

Last fall, IBM announced that it had partnered with six other companies (AT&T, Caterpillar, Bank of America, Citigroup, Pfizer, and UPS) in an initiative called Supplier Connection. The purpose of the initiative is "to promote the use of local small businesses by large procurement organizations." ["A Bold Initiative to Support U.S. Suppliers," SupplyChainBrain, 6 October 2011] The quoted article highlights information drawn from an interview conducted by Robert Bowman, Managing Editor of SupplyChainBrain, with two IBM employees (a video of the interview can be seen by clicking this link -- registration required). The article continues:

"Chet Karwatowski, senior technical staff member with IBM, calls the program 'unique.' It draws on the supply chains of large corporations in an effort to spur job growth in the U.S. The idea is to channel a portion of supply-chain spend to local small businesses. ... Supplier Connection was announced in September of 2010; since that time the partners have worked aggressively to create a portal for small businesses to register and join a thriving buying community. The system went live in February of 2011. As of August of 2011, just under 200 small businesses had joined, according to John Dischinger, program director for Supplier Connection."

The article states that Supplier Connection defines a small business "as one with either 500 employees or less than $50m in revenue. That description covers some nine million U.S. companies, Karwatowski notes. Beyond that, Supplier Connection is targeting 13 commodity areas that are key to its sponsoring membership." Clearly, not all nine million U.S. small businesses are suppliers or fit into one of the 13 commodity areas embraced in the program. Nevertheless, I found it surprising that less than 200 small businesses had taken advantage of the program. One reason for this modest number might be the fact that are some hoops through which suppliers must jump before being accepted into the program. "As part of the registration process, small companies learn what it takes to be a supplier to a large business. They go through nine sections, covering areas such as security and electronic business. Sponsoring companies also provide assets to help applicants improve their position." Another reason is that IBM hasn't actually announced the formal availability of the supplier portal. The article concludes:

"The new initiative differs from past efforts in its focus on small business based in the U.S., Karwatowski says. It requires that members know much more about their suppliers than might be the case with a mere listing service. Each business fills out a comprehensive application – 'like a college admission,' Karwatowski says – and that form becomes available to all members."

Although getting registered may be a hassle, the upside potential of being a member of Supplier Connection looks large. Importantly, there is no fee associated with this initiative. To learn more about the program, go the Supplier Connection site. IBM believes that Supplier Connection will help boost U.S. job creation, but it also recognizes that sourcing locally has sustainability implications as well. The site states:

"The promotion and growth of small businesses have been identified as crucial components to improving the economic vitality of the United States. Giving small businesses the opportunity to market their goods and services to supply chains of large companies could potentially serve as a key source of revenue to be leveraged for expansion and job creation."

As I've pointed out in previous posts, analysts claim that, for every manufacturing job created in a country, eight supply chain jobs are also created. That means that Supplier Connection could benefit from the creation of more manufacturing jobs in the U.S. as well. John Westerveld, a demo architect for Kinaxis, reports, "The on-shoring or near-shoring movement is gaining speed. This is the idea of bringing manufacturing back to where the demand is." ["Will on-shoring be the trend for 2011/2012?" The 21st Century Supply Chain, 15 June 2011]. He continues:

"Let's look at some advantages of putting manufacturing where the demand is:

• Time to market can be significantly improved
• Less risk to intellectual property
• Lead times are reduced and are more consistent
• Given reduced and more consistent lead times means inventory levels can also be reduced.
• With fuel prices going through the roof, reducing the overall distance traveled for our manufactured goods can only help the bottom line.
• Reduced product travel also impacts the overall carbon footprint for the product, a factor that is starting to become more and more important in the eyes of the consumer and governments.

"I've always been in favor of manufacturing near where the majority of the demand is (See my blog post from last year here). I think when companies look at the overall costs associated with offshore manufacturing, more will realize that manufacturing where their market is just makes sense (and dollars too)."

Westerveld cites a post written by Clare Goldsberry in which she refers to a study by Accenture. ["Offshoring loses some glamour, or how JIT became 'just-in-case'," Plastics Today, 10 May 2011]

"[According to management consulting firm Accenture,] 'Companies are beginning to realize that having offshored much of their manufacturing and supply operations away from their demand locations, they hurt their ability to meet their customers' expectations across a wide spectrum of areas, such as being able to rapidly [meet]increasing customer desires for unique products, continuing to maintain rapid delivery/response times, as well as maintaining low inventories and competitive total costs,' and that 'managing supply operations that are separated far from where demand occurs has weakened their overall operational planning, forecasting and general flexibility, while in some cases driving up costs with the need for complex network management. In some cases, this situation has limited the companies’ competitive advantage.'"

If it makes sense to manufacture near where demand is, it also makes sense to source near where manufacturing takes place. That applies to manufacturing anywhere in the world, not just in the United States. Steve Hall asserts that some critics believe that local sourcing is simply a buzzword. He believes, however, that local sourcing has "value of which businesses are becoming acutely aware." ["Making local sourcing and local content a business imperative," Procurement Blog, 28 September 2011] Hall discusses an interview he held with Tim Bass, CPO for BP in Angola.

"'There are tangible gains and intangible ones,' he says. On the tangible side – the sort of results that can make the business take notice: 'We can get better safety and operating risk performance, faster response times and ultimately lower long term costs. Ultimately, we see these strategies as creating long-term value.' Intangible; it adds value for stakeholders and builds trust among the people BP Angola works with, not to mention provides a key prerequisite for entry into Angola."

Tim Burt believes that through local sourcing "businesses and procurement make a real difference in the world." ["Local procurement winning hearts and minds", Procurement Blog, 23 June 2011] He explains:

"One of the key presentations at the [Procurement Leaders Forum in London] came from Andrew Hinkly, CPO at Anglo American on local procurement. He spoke about Anglo American's initiatives ... and how [they are] not only increasing its involvement in local procurement but also developing local suppliers, which is improving the lives and communities in which Anglo American operates."

Burt, premium content writer for Procurement Leaders magazine, also references an article by Ross Tieman in the Financial Times in which Tieman claims, "The procurement policies of multinational companies can shape the prosperity of communities, regions and nations." ["Procurement: Groups use purchasing power to combat poverty," 22 June 2011]. Tieman continues:

"Many [multinational companies] are now trying to use their purchasing power to combat poverty, but the task is complex. Demand is only half the equation. In emerging economies, they have also to nurture capacity among small farmers and entrepreneurs even as they offer them a market. When they succeed, the effects can be striking."

Tieman goes on to provide examples of how local sourcing has made a significant difference. He indicates that these local sourcing initiatives are "driven by enlightened self-interest: the need to refresh a flagging supply chain to ensure its sustainability." In his article, Tieman also talks a bit about the fair trade movement. He writes that more and more companies are selling products that carry "the label of the Fairtrade Foundation." To learn more about that movement, read my post entitled Wages at the End of the Supply Chain. Tieman continues:

"Paul Willgoss, head of food technology at [Marks and Spencer, the UK-based retailer], notes that procuring Fairtrade tea, coffee, wine or green beans, which are popular with customers, does not let multinationals off the hook in terms of social responsibility. 'We have a set of global sourcing principles that we apply across our business, regardless of whether the product is Fairtrade or not,' he says. But when companies work directly with suppliers that invest in schools, healthcare and buses to get people to and from work, 'there is a danger of developing a paternalistic arrangement', says Mr Willgoss. The Fairtrade system puts matters in the hands of the community, empowering local leaders to make the development choices. Yet amid the focus on poor farmers, the capacity of multinationals to boost wider economic development is often overlooked."

Tieman also interviewed Andrew Hinkly, who was mentioned above and is group head of supply chain at Anglo American, the mining group. Hinkly told him that the success of the company's initiatives "shapes Anglo American's approach to enterprise development in Chile, Brazil and elsewhere." Tieman continues:

"'Our focus is on leveraging our procurement spend,' [Hinkly said, '] which was more than $10bn in 2010, to build resilient local supply chains that foster economic and social development in the countries where we operate.' David Noble, chief executive of the Chartered Institute of Purchasing & Supply (CIP&S), says governments have noted such achievements, and 'in Africa are imposing local sourcing requirements where they can'."

IBM and its partners in Supplier Connection obviously believe that local sourcing is not just beneficial for developing countries. In developing countries, however, exactly how local sourcing initiatives are best implemented remains unclear. Tieman concludes:

"Aided by a joint United Nations-CIP&S programme that is training procurement officers, many states are also trying to strengthen their own ability to buy locally. The power of procurement to create prosperity is now widely recognised. But companies, communities and governments are still learning how to use it to best effect."

The Supplier Connection initiative will also learn lessons as it grows. Nevertheless, more and more analysts are coming to accept that local sourcing initiatives can play a major role in improving local, regional, and national economies.

Big Business: Good or Bad?

I recently read two articles that express very different opinions about big business. The first article, written by entrepreneur and venture capitalist Luke Johnson, took a rather dim view of big business. ["Why big businesses are bad for business," Financial Times, 18 October 2011] He penned the article after delivering a speech about entrepreneurism to a group of “middle-managers from large companies.” His words, he felt, fell on deaf ears. He explains:

"I realised as I spoke to the audience that my words about entrepreneurship were irrelevant to them – even offensive. For I was preaching the gospel of independence, freedom and risk-taking, while they were entombed in the cosy, airless coffin of big business. All of them were life-long employees of huge institutions and, to them, the struggles of running your own business were totally alien. The more I thought about this disconnect, the more I realised that all too many executives in large public companies actually have more in common with various arms of government than they do with entrepreneurs and start-ups. I used to believe that the great divide was between the public and the private sector: between state and commercial interests. But in truth the real difference is between giant and small organisations, whether they are for profit or not; between huge bureaucracies and owner-run outfits."

Johnson's point about large bureaucracies having much in common is a valid one. Clearly Johnson believes that size matters and, from the headline of his column, he apparently thinks that big is bad. What seems to bother him most about big companies is their lack of humanity – their disconnectedness from community. He continues:

"Private firms generally have loyalty to their home country, whereas multinationals are the commercial equivalent of non-doms – everything has a tendency to migrate to the lowest-cost location. Government and big business typically have close, sometimes unhealthy relationships. Corporates pay for lobbyists and lawyers to influence legislators and regulators; politicians seek non-executive directorships and consultancies with large banks and suchlike when they retire from public office. Such organisations as defence companies, builders, IT contractors, security firms and others are vast suppliers to the public sector. Their skill set is not innovation, but contract negotiation: they make money if they persuade the civil servants and regulators to agree price increases. … Most are near-monopolies, and behave much more like arms of government than the sort of companies I have owned or founded."

In some ways, Johnson has described a straw man corporation – a caricature that is easy to criticize because it is nameless, faceless, and ... big. On the other hand, he romanticizes about small businesses and their connections to real people. He asserts that, to make themselves more humanized, big businesses "jazz up their adverts, logos and branding, but such efforts are like putting lipstick on a pig." He also takes a swipe at the chief executives of large businesses. He writes:

"In companies I own and help direct, the highest-paid executive earns between five and ten times what the lowest-paid staff member earns – and mostly, as founders, they are risking their capital, too. By contrast, in corporate empires, the CEO often earns 50 or even 100 times what the basic workers are paid – and the most they risk is losing their job. Such massive inequality leads to profound dysfunction. It arises because the rewards systems in large firms are broken. Boards become obsessed by governance, bosses become convinced of their genius, while staff feel minimal loyalty. Large businesses tend to be mature and to focus on cost-cutting, outsourcing and automation. Frequently they do not generate additional jobs, but destroy them."

Johnson's last point is where his view and that of Charles Kenny, author of the second article, differ dramatically. Before discussing Kenny's article, however, I want to give Johnson one last opportunity to discuss big business. He concludes:

"Of course certain sectors require huge amounts of capital, such as car manufacturing or mining. Others, like water supply, have to be monopolies. And global enterprises can achieve economies of size that they pass on to the consumer. So I readily accept that big business can be beneficial to society – and is a fact of life. But I still hope that one day the relentless tide of consolidation is reversed, and both government and industry revert to a more human scale."

Johnson started with spit and fire; but, having sufficiently vented, he finished meekly. In the end, he is forced to conclude that big business isn't always bad. He nevertheless provides us with an excellent segue for discussing Kenny's article. Kenny, a fellow at the Center for Global Development and the New America Foundation, has a very different view of big businesses than Johnson; especially when it comes to job creation. He claims, "Big companies are … the key to growth." ["Rethinking the Boosterism About Small Business," Bloomberg BusinessWeek, 28 September 2011] He continues:

"In the popular imagination, small firms are more nimble, more innovative, and more virtuous than blue-chip companies that employ thousands. Yet the notion that small business is the force behind prosperity is not true. The longer the U.S. and other countries cling to this myth, the harder it will be to carry out the kinds of economic policies that might actually stimulate job growth."

You have to admit that statement stands in stark contrast to what Johnson wrote. Kenny continues:

"In the U.S. in 2007 there were around 6 million companies with workers on the payroll. Ninety percent of those businesses employed fewer than 20 people, according to analysis of the latest census data by Erik Hurst and Ben Pugsley of the University of Chicago. Collectively, those companies accounted for 20 percent of all jobs. Most small employers are restaurateurs, skilled professionals or craftsmen (doctors, plumbers), professional and general service providers (clergy, travel agents, beauticians), and independent retailers. These aren’t sectors of the economy where product costs drop a lot as the firm grows, so most of these companies are going to remain small. And according to Hurst and Pugsley’s survey evidence, the majority of small business owners say that's precisely their intent—they didn't start a business for the money but for the flexibility and freedom. Most have no plans to grow."

Kenny admits that "some small companies do grow, of course," but he adds the sobering fact that "eighty percent of U.S. small companies that remained in business from 2000 to 2003—the most recent period for which Hurst and Pugsley compiled data—didn't add a single employee." He continues:

"Looking at a sample of companies created from 2004 to 2008, Hurst and Pugsley found that only 3 percent added more than 10 employees during that time. An even smaller proportion had applied or were in the process of applying for patents. (So much for being seedbeds of innovation.) Many small businesses simply go bust after a few years. In 2009 economist Scott Shane at Case Western Reserve University surveyed the evidence on net job creation by each year’s cohort of new companies. He found that among small companies in their second year of business, more jobs were lost to bankruptcy than were added by those still operating. The same was true in years three, four, and five."

To read more about Professor Shane’s research, see my post entitled Entrepreneurship Not for the Faint of Heart. Kenny next gets to the heart of his argument about why big companies are good.

"If you’re looking for a lot of good-paying, stable jobs, you'd better hope there are some big companies around that want to hire. Kansas City Federal Reserve economist Kelly D. Edmiston's analysis of U.S. data found that each year, 22 percent of staff in companies with fewer than 100 employees quit or are fired, compared with only 8 percent for companies with 2,000 or more workers. Edmiston also found that the jobs offered at large businesses were better than those at small businesses. Hourly wages at the largest companies, those with more than 2,500 employees, average around $27, compared with $16 in companies with payrolls of fewer than 100. Companies with more than 100 workers are almost twice as likely to offer retirement benefits and insurance, and considerably more likely to offer health care. The story is the same in the rest of the world. A cross-country analysis of business surveys by economists Rafael La Porta of Dartmouth College and Harvard University’s Andrei Schleifer reveals that a society's wealth is inversely proportional to the number of people who earn their livings from small businesses. Among the poorest quarter of the world's economies, the proportion of people who are self-employed is 46 percent, compared with 13 percent in the richest quarter. The higher you go up the national-wealth ladder, the lower the number of small enterprises."

You have to admit that those are pretty sobering statistics. Kenny goes on to report that "large companies are far more productive—with value added per worker an average of 59 percent higher." One reason for this "productivity gap" is that "managers in larger companies are significantly better educated" than those in small companies. "La Porta and Schleifer conclude that the 'hope of economic development lies in the creation of large registered firms, run by educated managers and utilizing modern practices.'" Kenny isn’t against small businesses, especially those in developing countries. He asserts, however, that "microenterprises run by poor people in the developing world are usually the result of an absence of other opportunities rather than an abundance of entrepreneurial zeal." He further claims that "poor people consistently say is that they’d rather work for a stable employer" than for themselves. Massachusetts Institute of Technology economists Abhijit Banerjee and Esther Duflo told Kenny that finding stable employment "is the way rural people in India have been making their way out of poverty over the past couple of decades."

Professor Shane agrees that more, not fewer, big companies are needed. "Because the average existing firm is more productive than the average new firm," he told Kenny, "we would be better off economically if we got rid of policies that encouraged a lot of people to start businesses instead of taking jobs working for others." Kenny concludes, "Extolling small business might be a good way for politicians to win elections. But when it comes to creating jobs, size still matters." Big business versus small business comparisons are interesting to make; but, the fact of the matter is we need all sizes of business. Every job is important in today's economy.

The "Big Data" Dialogues, Part 8: Cybersecurity

Joseph King, Group Vice President, JDA Managed Services, writes, "Before your business makes the leap into cloud computing, or increases its investments in the cloud, it's essential to address the topic of data security with your provider. Navigating the cloud safely means ensuring that your most critical data is protected with a high degree of rigor that meets or exceeds your organization's needs. Your data should be safe, secure and ready to apply to your most urgent competitive challenges anytime, anywhere." ["Is Your Critical Data Protected in the Cloud — as Well as Leveraged to Its Full Potential?" SupplyChainBrain, 12 October 2011] King is correct -- security is an essential consideration and probably one of the reasons that some companies have been hesitant to make the leap into cloud computing. Of course there are two kinds of security about which you need to be concerned: cyber and physical. In this post, I'll discuss cybersecurity. In a future post, I'll discuss physical security.

Last year marked a turning point for businesses. According to the annual Kroll global fraud survey, "reported thefts of information and electronic data ... for the first time ... surpassed physical property losses as the biggest crime problem for global companies." ["Data theft overtakes physical losses," by Brooke Masters and Joseph Menn, Financial Times, 18 October 2010] Last year's survey revealed that more than a quarter of the 801 companies surveyed reported data losses. Richard Plansky, head of Kroll's New York office, told Masters and Menn, "This is a reflection of the changing nature of the economy. More and more of the value of a company is intangible rather than things. Firms don't make widgets. They make ideas." The article points out that "China has become the single most problematic market for the multinationals that took part in the Kroll survey, with 98 per cent of those that do business there reporting some sort of fraud loss, up from 86 per cent the year before." Things haven't gotten any better over the past year. "The U.S. government [has] accused the Chinese of being the world's 'most active and persistent' perpetrators of economic spying, an unusual move designed to spur stronger U.S. and international action to combat rampant industrial espionage threatening U.S. economic growth." ["China Singled Out for Cyberspying," by Siobhan Gorman, Wall Street Journal, 4 November 2011] Gorman reports:

"The bulk of this theft of U.S. corporate and economic secrets is carried out in cyberspace, where vast volumes of data can be stolen in seconds, according to U.S. intelligence officials. The spying campaigns have reached a crescendo, they said, as U.S. government and business operations have grown extraordinarily reliant on communication technology. ... The threat will accelerate in the coming years and presents 'a growing and persistent threat' to U.S. economic security, according to the intelligence report, which reflects the views of 14 U.S. intelligence agencies."

If those stories don't scare you, they should. That is why Joseph King is so insistent that you address security with cloud service providers. However, he doesn't want to scare you the point that you decide that cloud computing isn't worth the risk. King believes the advantages of cloud computing outweigh the risks. He explains the benefits of cloud computing this way:

"In the information technology world, perhaps no topic today is receiving more attention than cloud computing. Once viewed as a cost-effective, flexible option for small or mid-sized companies, cloud computing is now generating interest from even the largest businesses, whose executives once believed that their data was critical, too sensitive or too complex to relegate to a managed services model. Increasingly, companies of all sizes are realizing the benefits of leveraging a cloud approach for application hosting, hardware hosting and data management, which offer clear cost and efficiency advantages — and also allow the organization to focus on key strategic challenges, instead of administrative tasks. Cloud computing offers dynamic capabilities, such as flexible configurations, as well as ubiquitous user access from every geographic location and time zone. For core business activities such as transportation scheduling, warehouse management and point-of-sale (POS) data collection, cloud computing is ideally suited to manage extremely large data volumes and multiple collaborative relationships across the supply chain, seamlessly and invisibly. In the event of a natural disaster or other significant business disruption, cloud computing offers peace of mind and reliable business continuity. Cloud computing also delivers extremely rapid time-to-value, with full software and data hosting occurring in as little as 15 days. Your business can immediately start realizing a return on its technology investments, instead of waiting for an internal IT infrastructure to be provisioned and configured."

Having spelled out the tremendous benefits of cloud computing, he nonetheless admits that "it's not always easy to trust another company with the critical data that represents the lifeblood of your business." He continues:

"Maintaining your hardware, software and precious information at an off-site facility certainly makes good business sense — but it requires real trust, based on sound operating practices. High-profile data security breaches at credit card companies, health care providers, universities and government agencies have dominated the headlines recently, reminding us of the dangers of doing business in today's real-time, technology-connected world."

King goes on to explain the difference between public and private clouds. He begins by discussing public clouds:

"One of the first issues your business needs to understand is the all-important distinction between public and private clouds. Today's online world is filled with public clouds, which enable customers to subscribe to and buy data storage space. While public clouds may be cost-effective, businesses should be aware that public storage providers are likely not employing the same systematic approach to firewalls, data encryption and other security protocols that exist within their own organizations. And, because public clouds are not designed to store mission-critical data, 24/7 access might be a problem. Outages are common, whether due to site maintenance, upgrades or other issues. While public clouds are perfect for the needs of consumers, they lack most of the serious performance features and security protocols needed to run your business with a high degree of confidence."

It only makes sense that you shouldn't trust storing your critical business data on a site that caters to grandmothers who want to share pictures of their grandchildren with family and friends. That's where private clouds come in. King continues:

"Private clouds are built with a single customer, or group of customers, in mind. Segregation, separation and data protection are key concepts. Because private cloud providers understand the real everyday needs of your business, continuous access is also a high priority — and your team members will be able to remotely access the applications and data they need to do their jobs, 24/7, from any location in the world. When working in a private cloud, your employees will also benefit from custom-designed, Web-based interfaces that are seamless and easy to use. The best private clouds are invisible to your team members, who only see an extension of your own business when they access solutions and data in the cloud. In addition, private clouds are generally characterized by stringent security measures which ensure the safety, integrity and real-time availability of your most important data."

King then asks an important question, "How Protected Is My Data?" In other words, how good are the stringent security measures he addresses earlier? He says security relies in "establishing the right protocols." He explains:

"Any IT professional can list the 'three A's' of data security: authentication, authorization and accountability. Your own IT and compliance teams have worked diligently to ensure that all the information stored within your own walls is protected, in keeping these three essential themes. In your relationships with external trading partners, your business has also worked to ensure that all third parties are accessing your data in a safe, secure manner. Nowhere are the concepts embodied by the three A's more critical than in your choice of the cloud computing partner who will virtually host your hardware, software and proprietary data. Three A's must be foundational to their delivery model. At the off-site facility where your data is stored, personnel should be issued proximity access cards that authenticate their identity when they enter the facility. Security personnel should be on site 24-7 to closely monitor access, backed by stringent security systems. When employees log in, user authorization should be required at both the network and system levels. Accountability should be established via standard operating system event logs that are carefully maintained and monitored. Ongoing alerts should monitor both the health and performance metrics of each technology system. Networks and systems should be safeguarded with a variety of firewalls, including intrusion prevention systems, data loss prevention systems and Web application firewalls. Cloud managers should ensure that all systems and processes are compliant with standards such as SSAE-16 (SAS-70) and Sarbanes-Oxley — and should schedule security audits on a regular basis to ensure that protocols are upheld stringently over time."

Although my company offers cloud-based services, we often have to draw on client data being stored in the kind of cloud computing system King describes. Even though we might not be the principal provider of data storage, we are extremely security conscious. Our Solution-as-a-Service (SaaS) offerings are all SAS-70 certified. King's next subject is the people (rather than the hardware or software) involved in providing cloud services. He writes:

"Even though cloud computing relies heavily on high-quality computing resources and stringent IT protocols, all these technologies and processes are managed on a day-to-day basis by people. It's essential to ask and answer the question: Who is actually managing my data? What are their credentials and skill sets? The best cloud providers will have teams of hundreds of experts supporting your cloud computing needs every single day. Not only should these cloud managers be subject to background checks, confidentiality agreements and daily security protocols that control their access to the cloud, but they should also have a broad range of hardware, software and business skills. They should not only be technology experts, but also business generalists who understand your organization's strategic needs for various software applications and operating information — and who can help custom-tailor the cloud's capabilities to best meet your needs. Cloud managers should know not only how to store data but how to apply data to help customers streamline processes, reduce risk and expedite business results from software investments that are already in place. While your internal IT team might only consist of a small group of people, the right cloud provider can supply a team of highly qualified, credentialed experts to supplement your team. By relying on this external expertise to streamline your daily computing needs and help you leverage your data to the fullest extent, your IT staff can focus on the core strategic priorities that are driving your business."

From the beginning, cloud computing has been touted as way for small- and medium-sized businesses to leverage the IT expertise of larger organizations. A good part of that expertise comes in the security field. As a result, King insists that "there are very few companies that cannot achieve significant time, cost and efficiency benefits from entering the cloud." He concludes:

"The key is identifying those parts of your business that are right for cloud computing — whether because they are data-intensive, involve partner collaboration or are otherwise well suited — then creating a close partnership with a trusted managed services provider. The right partner should combine IT expertise and a commitment to security with a general business approach that helps you maximize your return on your technology investments. Cloud managers should understand both the applications you are running and the data you are storing, as well as how these resources can be applied to your core business challenges. This approach not only helps cloud computing deliver a lower total cost of ownership and quicker returns — but, more importantly, positions your business for a competitive advantage by turning technology and information into powerful strategic weapons."

Although most of the attention these days seems to be on cybersecurity, physical security cannot be overlooked. As I noted earlier, I'll write more on that topic in a future post.