Cybersecurity In The Digital Supply Chain: Managing Third-Party Risk Through Verified Trust

Craig Moss

A digital supply chain (DSC) establishes new links inside your company and with the third parties in your end-to-end supply chain. With access to real-time data and other insights from the DSC, you can foster new collaborations between your procurement and product development departments and link them with your customers, your customers’ customers, and your suppliers.

The proliferation of data moving across platforms and among parties requires a new and different kind of umbrella of trust, one that enables increased agility and performance. But how is this trust built and maintained? And how does one not only trust but verify? These are a few of the management challenges that lie ahead, and they exist in an environment marked by escalating cybersecurity risk.

Additionally, the rise in critical intellectual property being stored and shared digitally puts confidential information, trade secrets, and personally identifiable information at risk. These vulnerabilities present an even greater need for rigorous and transparent risk management that incorporates cybersecurity.

Cybersecurity risks in the DSC

The Digital Supply Chain Institute (DSCI) – a new leading-edge research institute, established by the Center for Global Enterprise (CGE) – defines DSC as a customer-centric platform model that captures and maximizes the use of real-time data derived from a variety of sources. It enables demand stimulation, matching, sensing, and management to improve performance and minimize risk. Just as it will create tremendous opportunities, it will exponentially increase cybersecurity risks.

The number of cybersecurity breaches is growing by 64% every year. While cyber threats come from a wide variety of sources (including nation states, competitors, and organized crime syndicates), 60% of cyber breaches are linked to insiders – current and former employees, contractors, service providers, suppliers, and business partners. These could be insiders in your company or in the companies in your end-to-end supply chain.

In the DSC, companies will be collecting and storing more data and sharing high-value confidential business information with other companies. A 2016 CGE study found that 95% of people surveyed agree that the digitalization and sharing of company information with third parties (i.e., suppliers, customers, and business partners) increases the importance of cybersecurity measures.

Companies are rapidly realizing that cybersecurity is not purely a technology issue. Effective cybersecurity is a people, process, and technology issue. It is critical to get cybersecurity out of the IT silo and embed it in how the company operates.

In short, everyone in the value chain – from internal employees to external third parties – needs to know what is expected to mitigate and manage cyber risks. It will require a broad approach built on policies, procedures, controls, and contractual agreements, supported by monitoring, training, and continual improvement.

Internally, senior management needs to set the right balance between ensuring tight cyber controls and enabling people to efficiently do their jobs and collaborate. Overly stringent and cumbersome security procedures have the unintended consequence of driving people to create workarounds. The right blend of people, processes, and technology is needed inside your company and across the companies in your supply chain.

From a technology perspective, companies have improved their perimeter defense. However, according to The State of Cybersecurity and Digital Trust 2016, 69% of respondents had experienced an attempted or realized data theft from insiders. Building stronger perimeters alone is not a sufficient or practical solution in the interconnected DSC, where companies need to share valuable information.

The role of cybersecurity standards and frameworks

Industry and government are coming to the collective realization that they need to prioritize cybersecurity in the DSC. The momentum has built dramatically since the National Institute for Science and Technology (NIST) released its Cybersecurity Framework (CSF) in 2014.

In response to feedback from companies, NIST recognized the need to directly address cybersecurity in the supply chain. In January 2017, NIST released the updated draft of the CSF (V1.1), which includes specific additions on how companies must begin assessing supply chain cybersecurity risk. The CREATe Cybersecurity Advisory Council – a multi-industry group of more than 20 multinational companies, formed to broaden the use of the NIST CSF and make it easier for companies to operationalize the framework to reduce risk – views the addition of supply chain risk management as a positive.

However, the advisory council highlighted that there is a long way to go for companies to be able to efficiently assess third-party cyber risk. Organizations need to develop effective, scalable methods that provide a calibrated way to assess third-party cybersecurity risk across a large number of companies. Ultimately, it is in everyone’s best interest to use assessment results as the basis for prioritizing improvements and integrating cybersecurity into business operations.

In December 2016, the Commission on Enhancing National Cybersecurity, with CGE chairman Sam Palmisano as the vice-chair, released its Report on Securing and Growing the Digital Economy. This document, which was recently provided to the White House, highlights the importance of focusing on cybersecurity in the DSC and outlines some ways the NIST CSF can be helpful.

In the report, the NIST CSF was positioned as a key way for organizations to manage cyber risk in their enterprises and supply chains. The commission paid special attention to the interdependencies among companies in a DSC and the growing Internet of Things. The report also emphasizes that trust is fundamental to a digital economy:

The success of the digital economy ultimately relies on individuals and organizations trusting computing technology and the organizations that provide products and services and collect and retain data. That trust is less sturdy than it was several years ago because of incidents and successful breaches that have given rise to fears that corporate and personal data are being compromised and misused.

The commission references the NIST CSF when discussing risk management and mechanisms for increasing trust. As the document gains wider adoption, there is growing speculation that U.S. government procurement departments will use the CSF as a means of assessing the cybersecurity performance of potential suppliers. If this occurs, it will accelerate the use of the CSF as large U.S. government suppliers cascade cybersecurity requirements into their domestic and global supply chains.

The need for verified trust

The DSC puts more emphasis on the interdependency of companies and the associated need for verified trust. In Digital Supply Chains: A Frontside Flip, a white paper published in October 2016, CGE identified four pillars for managing the DSC: demand, people, technology, and risk. Looking at the four pillars from a cyber perspective, the mission is clear: To reduce cyber risk, companies will need trusted, cross-functional collaborations internally – and with verified third parties – that are enabled by secure technology that integrates cybersecurity into operations.

This leads to one important task that is often overlooked: knowing and prioritizing what to protect. It is impossible to protect everything equally. Companies must allocate resources strategically to protect the most valuable information. Linking cybersecurity into the broader areas of enterprise risk management and supply chain management will be essential focal points for cross-functional collaboration.

Mapping interdependencies with third parties

Just as the DSC will require greater collaboration with third parties to improve business performance, it also requires greater collaboration to reduce cyber risk and improve the ability to respond and recover from breaches. Companies should have a map of their critical cyber interdependencies and conduct a risk assessment. The collaboration on cybersecurity with third parties needs to be built into contractual agreements, addressing areas such as access control, identity management, training, threat intelligence sharing, and incident response plans.

If we look at other supply chain performance and compliance issues, such as quality, corruption, or labor practices, companies typically evolve toward a verified trust. As the trust grows with a third party and the business relationship becomes more long-term and strategic, the companies tend to shift their resources from verification to collaboration on mutually beneficial improvement areas. One of the foundational elements of the verified trust approach is the existence of a mature management system to ensure the right business processes are in place.

Currently, the assessment of third-party cybersecurity programs lags far behind the assessment of certain business performance and compliance issues (e.g., labor and environment, health, and safety). Very few companies have started to integrate cybersecurity into their supplier qualification and evaluation programs. The challenge is how to achieve the right level of verified trust.

Some senior executives that oversee supply chain risk management strongly feel that it will not be practical nor reliable to depend on self-assessment. One member of the CREATe Cybersecurity Advisory Council suggested using a mix of internal staff and third parties to verify supplier performance. The challenge is how to add cybersecurity at the right level. The NIST CSF can be an effective tool for assessing the maturity of a third party’s cybersecurity program, the associated risk, and priority improvements.

Begin your race toward a secure DSC

Leading companies are racing forward in their transformation into a demand-focused DSC – and for good reason.

According to the CGE report, the transformation into a DSC can:

  • Reduce procurement costs for all purchases of goods and services by 20%
  • Cut supply chain process costs by 50%
  • Increase revenue by 10%

However, companies also need to move quickly to manage the risks associated with greater interdependency. They need to shift from being reactive to proactive. They need to begin using practical, scalable ways to assess the cybersecurity risks of third parties that incorporate evaluating the maturity of the third parties’ cybersecurity programs.

Ultimately, companies will need trusted cross-functional collaborations internally – and with verified third parties – that are enabled by secure technology that integrates cybersecurity into operations.

Read CGE’s entire report, Digital Supply Chains: A Frontside Flip: Building Competitive Advantage to Optimize Performance and Customer Demand, to gain even more insight on what business leaders have to say about digitizing the supply chain.

Comments

Craig Moss

About Craig Moss

Craig Moss is the Director of CGE’s Digital Supply Chain Institute (DSCI) and Chief Operating Officer of the Center for Responsible Enterprise and Trade (CREATe.org), a non-governmental organization (NGO) helping companies around the globe prevent piracy, counterfeiting, trade secret theft, and corruption and benchmark their practices against other companies.

Why You Might Not Recognize Cybersecurity In A Few Years

Derek Klobucher

It’s already been an exciting National Cybersecurity Awareness Month. More than “an annual campaign to raise awareness about the importance of cybersecurity,” as the U.S. Department of Homeland Security describes it, October began with bicameral congressional hearings into the high-profile cyberattack on one of the nation’s largest credit reporting agencies.

Many cyberattacks are so severe because their victims don’t have the right tools – or don’t effectively use the tools available to them.

“Hearings into the Equifax breach that affected 143 million U.S. consumers could offer important, if painful, lessons on what companies should not do when it comes to protecting data and responding to incidents,” the Washington Examiner stated. “The company reportedly made a half-hearted attempt to use available patches to seal up the vulnerability that hackers exploited … and [it] did not use Department of Homeland Security cyber tools made available to all companies.”

The massive data breach at Equifax also highlights calls for enhanced cybersecurity, including a prescient appeal from an investigator at the U.S. Securities and Exchange Commission.

Where legacy fails

An SEC forensic unit warned of shabby cyber defenses – hamstrung by insufficient training and equipment – a mere two months before the agency discovered an epic hack of its corporate filing system, according to Reuters. Instead of the necessary resources, the unit resorted to using obsolete and repurposed hardware.

And it’s not just the SEC. More than 70% of federal chief information officers said most of their applications are legacy systems, according to a Professional Services Council survey released last month. And weak points in old apps were among the top concerns of the CIOs suffering from increasingly frequent cyberattacks.

More broadly, 95% of federal employees and contractors want common cybersecurity standards across the government, according to a Telos report released last month. And 88% of respondents agreed on a specific framework that “effectively helps organizations manage risk.”

But that would only go so far.

Back to basics

“Cybersecurity threats continue to increase in size and complexity,” Dark Reading stated recently. “But the real problem is that too many IT organizations are leaving their enterprises vulnerable to attacks because they overlook a number of simple tasks.”

Careless employees are the weakest cybersecurity link at small and midsize businesses in North America and the U.K., according to a Keeper Security and the Ponemon Institute study. This underscores the importance of cybersecurity basics, such as heeding security software warnings. (Find other best practices for 2018 in this TechRepublic list.)

“CISOs, CIOs, and boards of directors [must] think about cybersecurity, not just in the terms of the IT shops they run, but all products – anything that potentially exposes the company to a cyberattack,” GE global chief information and product cyber security officer Nasrin Rezai stated in CSO. She looks at securing an organization in three areas:

  • Operational technology (OT): Take special care when connecting parts of the business that had been secure only because they were isolated.
  • Consumer devices: Instead of just thinking about how to secure each device, focus on protecting all of your enterprise’s assets.
  • Readiness: Cybersecurity drills must ensure that everyone – from IT to manufacturing – knows what to do in case of a breach.

And a lot more is changing. In fact, you might not recognize cybersecurity in a few years.

The revolutionary future of cybersecurity

Students at the University of Central Arkansas will learn how to detect and defend against cyberattacks, thanks to a $500,000 grant to create a “cyber range.” And a startup in New York recently raised $8 million to ensure that cybersecurity credentials always remain with the user, authenticating people via biometrics, such as fingerprints and faces, as well as traditional passwords.

Keeping credentials with the user is a reason why U.S. Social Security numbers – once the holy grail for identity thieves – may be obsolete for national identification, according to the White House’s cybersecurity coordinator. That’s because victims can’t even change their numbers after they have been compromised.

“It’s a flawed system that we can’t roll back after a breach,” Rob Joyce said at a cybersecurity summit Oct. 3. “The Social Security number has outlived its usefulness.”

Doing our part

Put in context – especially in the wake of 2017’s deadly hurricanes – a sufficiently massive cyberattack could be worse for the U.S. infrastructure than hurricane season, according to an infrastructure security official at the Department of Energy. Deputy secretary L. Devon Streit’s comments at a cybersecurity and infrastructure panel echo an upcoming department report comparing the hazards of natural disasters to those of cyberattacks.

“The most worrisome threat we face in the energy sector is cyber,” Streit said. Potential solutions in the works include a pilot program to declassify and share cybersecurity threat information with both government- and privately owned infrastructure organizations.

More than a campaign, National Cybersecurity Awareness Month reminds us that there’s a lot at stake. And while others prepare to fend off future cyberattacks, the rest of us can use this month to refocus on best practices.

Learn more about The Future of Cybersecurity: Trust as Competitive Advantage.

Comments

Derek Klobucher

About Derek Klobucher

Derek Klobucher is a Brand Journalist, Content Marketer and Master Digital Storyteller at SAP. His responsibilities include conceiving, developing and conducting global, company-wide employee brand journalism training; managing content, promotion and strategy for social networks and online media; and mentoring SAP employees, contractors and interns to optimize blogging and social media efforts.

Apathy, Not Hackers: The Real Enemy Of The Cloud And Emerging Tech

Paul Kurchina

The cloud is quickly moving past the hype to deliver tangible and transformational value. Across the board, cloud-based products and services are growing to the point where more than 92% of all workloads will be processed in cloud data centers by 2020. The cloud is also enabling heavy-hitter, emerging technology along the way, including advanced analytics, containers, artificial intelligence, cognitive computing, and virtual reality. And even the Internet of Things (IoT) is gaining momentum in the cloud as it sets to impact the world in the next decade 5-10x more than the entire existence of the Internet.

According to Mark Weatherford, senior vice president and chief cybersecurity strategist of vArmour, there are no signs of the cloud’s influence slowing down. In his upcoming Webcast “The Cloud, IoT, and Critical Infrastructure: It’s Not Too Late for the Cyber,” sponsored by Americas’ SAP Users’ Group (ASUG), he will share a much-needed reality check:

“Today is the slowest day in your life in terms of technology. If you think the pace is frantic now, just wait until Q4 … or 2018 … or 2020. The rate of change in business is going to be faster every year for the rest of your working life.”

Even though there is so much potential, very few business leaders understand how the cloud – and the technology it supports – will impact their company. Why? It’s most likely because their organizations are still outmatched in their ability to combat cyberattacks of any kind.

The truth about the cloud, virtualization, and cybersecurity

In no other area of the business are companies fighting to protect their business from so many ill-intended actors, ranging from international organized crime rings to terrorist organizations, politically charged hacktivists, and cyberspies acting on behalf of global nation states. Although there are high-stakes risks in the cloud, this doesn’t mean that locking down your IT systems and data to limit information-sharing and real-time insight is the answer.

Thomas Friedman, American journalist, author, and three-time Pulitzer Prize winner, poetically laid out the dangers of this lack of know-how in one of his recent New York Times columns:

“We’re moving into a world where computers and algorithms can analyze (reveal previously hidden patterns); optimize (tell a plane which altitude to fly each mile to get the best fuel efficiency); prophesize (tell you when your elevator will break or what your customer is likely to buy); customize (tailor any product or service for you alone); and digitize and automatize more and more products and services. Any company that doesn’t deploy all six elements will struggle, and this is changing every job and industry.”

To realize Friedman’s vision, businesses must somehow whittle down a seemingly infinite number of digital options to find technology that best fits their needs. But, as Weatherford suggests, the key to investing in the right technology is focusing on nine fundamental areas of strategic security:

  • Identity and access: Monitor privileged-account usage while allowing only authorized users to access critical systems and countering threats.
  • Network: Ensure that all networks in the IT landscape are secure.
  • Applications: Identify risks to all applications.
  • Security breaches: Understand the threat landscape and plan the right strategy to protect the business.
  • Compliance: Adhere to all application obligations as the company reduces its compliance burden.
  • Supplier risk: Track whether suppliers are adequately safeguarding organizational assets.
  • Business continuity: Strengthen protections to ensure continuous operations during a crisis.
  • Mobility: Secure mobile applications.
  • Cloud: Assess any security risks as a result of a cloud migration.

Weatherford also warns that insiders need to be better trained to prevent unintended security breaches. “The real danger is the uneducated user who is more likely to click on a link or push a button that shouldn’t be touched in the first place,” he said. “Educate, educate, educate. Drill, drill, drill. This is all necessary to raise the bar on security.”

In our increasingly digital world, hope is not a strategy, but a reasonable security program is. Maybe, one day within the next 10 years, security will become a top priority that everyone understands and acquires as a natural skill. But until then, let’s put a little more attention, time, and care into the security of the IT architecture and data while engaging technology that can drive significant competitive advantage.

For more cybersecurity insights and advice from Mark Weatherford, senior vice president and chief cybersecurity strategist of vArmour, join us on October 23 for the Americas’ SAP Users’ Group (ASUG) Webcast “The Cloud, IoT, and Critical Infrastructure: It’s Not Too Late for the Cyber.”

Comments

Paul Kurchina

About Paul Kurchina

Paul Kurchina is a community builder and evangelist with the Americas’ SAP Users Group (ASUG), responsible for developing a change management program for ASUG members.

Diving Deep Into Digital Experiences

Kai Goerlich

 

Google Cardboard VR goggles cost US$8
By 2019, immersive solutions
will be adopted in 20% of enterprise businesses
By 2025, the market for immersive hardware and software technology could be $182 billion
In 2017, Lowe’s launched
Holoroom How To VR DIY clinics

Link to Sources


From Dipping a Toe to Fully Immersed

The first wave of virtual reality (VR) and augmented reality (AR) is here,

using smartphones, glasses, and goggles to place us in the middle of 360-degree digital environments or overlay digital artifacts on the physical world. Prototypes, pilot projects, and first movers have already emerged:

  • Guiding warehouse pickers, cargo loaders, and truck drivers with AR
  • Overlaying constantly updated blueprints, measurements, and other construction data on building sites in real time with AR
  • Building 3D machine prototypes in VR for virtual testing and maintenance planning
  • Exhibiting new appliances and fixtures in a VR mockup of the customer’s home
  • Teaching medicine with AR tools that overlay diagnostics and instructions on patients’ bodies

A Vast Sea of Possibilities

Immersive technologies leapt forward in spring 2017 with the introduction of three new products:

  • Nvidia’s Project Holodeck, which generates shared photorealistic VR environments
  • A cloud-based platform for industrial AR from Lenovo New Vision AR and Wikitude
  • A workspace and headset from Meta that lets users use their hands to interact with AR artifacts

The Truly Digital Workplace

New immersive experiences won’t simply be new tools for existing tasks. They promise to create entirely new ways of working.

VR avatars that look and sound like their owners will soon be able to meet in realistic virtual meeting spaces without requiring users to leave their desks or even their homes. With enough computing power and a smart-enough AI, we could soon let VR avatars act as our proxies while we’re doing other things—and (theoretically) do it well enough that no one can tell the difference.

We’ll need a way to signal when an avatar is being human driven in real time, when it’s on autopilot, and when it’s owned by a bot.


What Is Immersion?

A completely immersive experience that’s indistinguishable from real life is impossible given the current constraints on power, throughput, and battery life.

To make current digital experiences more convincing, we’ll need interactive sensors in objects and materials, more powerful infrastructure to create realistic images, and smarter interfaces to interpret and interact with data.

When everything around us is intelligent and interactive, every environment could have an AR overlay or VR presence, with use cases ranging from gaming to firefighting.

We could see a backlash touting the superiority of the unmediated physical world—but multisensory immersive experiences that we can navigate in 360-degree space will change what we consider “real.”


Download the executive brief Diving Deep Into Digital Experiences.


Read the full article Swimming in the Immersive Digital Experience.

Comments

Kai Goerlich

About Kai Goerlich

Kai Goerlich is the Chief Futurist at SAP Innovation Center network His specialties include Competitive Intelligence, Market Intelligence, Corporate Foresight, Trends, Futuring and ideation. Share your thoughts with Kai on Twitter @KaiGoe.heif Futu

Tags:

Blockchain: Much Ado About Nothing? How Very Wrong!

Juergen Roehricht

Let me start with a quote from McKinsey, that in my view hits the nail right on the head:

“No matter what the context, there’s a strong possibility that blockchain will affect your business. The very big question is when.”

Now, in the industries that I cover in my role as general manager and innovation lead for travel and transportation/cargo, engineering, construction and operations, professional services, and media, I engage with many different digital leaders on a regular basis. We are having visionary conversations about the impact of digital technologies and digital transformation on business models and business processes and the way companies address them. Many topics are at different stages of the hype cycle, but the one that definitely stands out is blockchain as a new enabling technology in the enterprise space.

Just a few weeks ago, a customer said to me: “My board is all about blockchain, but I don’t get what the excitement is about – isn’t this just about Bitcoin and a cryptocurrency?”

I can totally understand his confusion. I’ve been talking to many blockchain experts who know that it will have a big impact on many industries and the related business communities. But even they are uncertain about the where, how, and when, and about the strategy on how to deal with it. The reason is that we often look at it from a technology point of view. This is a common mistake, as the starting point should be the business problem and the business issue or process that you want to solve or create.

In my many interactions with Torsten Zube, vice president and blockchain lead at the SAP Innovation Center Network (ICN) in Potsdam, Germany, he has made it very clear that it’s mandatory to “start by identifying the real business problem and then … figure out how blockchain can add value.” This is the right approach.

What we really need to do is provide guidance for our customers to enable them to bring this into the context of their business in order to understand and define valuable use cases for blockchain. We need to use design thinking or other creative strategies to identify the relevant fields for a particular company. We must work with our customers and review their processes and business models to determine which key blockchain aspects, such as provenance and trust, are crucial elements in their industry. This way, we can identify use cases in which blockchain will benefit their business and make their company more successful.

My highly regarded colleague Ulrich Scholl, who is responsible for externalizing the latest industry innovations, especially blockchain, in our SAP Industries organization, recently said: “These kinds of use cases are often not evident, as blockchain capabilities sometimes provide minor but crucial elements when used in combination with other enabling technologies such as IoT and machine learning.” In one recent and very interesting customer case from the autonomous province of South Tyrol, Italy, blockchain was one of various cloud platform services required to make this scenario happen.

How to identify “blockchainable” processes and business topics (value drivers)

To understand the true value and impact of blockchain, we need to keep in mind that a verified transaction can involve any kind of digital asset such as cryptocurrency, contracts, and records (for instance, assets can be tangible equipment or digital media). While blockchain can be used for many different scenarios, some don’t need blockchain technology because they could be handled by a simple ledger, managed and owned by the company, or have such a large volume of data that a distributed ledger cannot support it. Blockchain would not the right solution for these scenarios.

Here are some common factors that can help identify potential blockchain use cases:

  • Multiparty collaboration: Are many different parties, and not just one, involved in the process or scenario, but one party dominates everything? For example, a company with many parties in the ecosystem that are all connected to it but not in a network or more decentralized structure.
  • Process optimization: Will blockchain massively improve a process that today is performed manually, involves multiple parties, needs to be digitized, and is very cumbersome to manage or be part of?
  • Transparency and auditability: Is it important to offer each party transparency (e.g., on the origin, delivery, geolocation, and hand-overs) and auditable steps? (e.g., How can I be sure that the wine in my bottle really is from Bordeaux?)
  • Risk and fraud minimization: Does it help (or is there a need) to minimize risk and fraud for each party, or at least for most of them in the chain? (e.g., A company might want to know if its goods have suffered any shocks in transit or whether the predefined route was not followed.)

Connecting blockchain with the Internet of Things

This is where blockchain’s value can be increased and automated. Just think about a blockchain that is not just maintained or simply added by a human, but automatically acquires different signals from sensors, such as geolocation, temperature, shock, usage hours, alerts, etc. One that knows when a payment or any kind of money transfer has been made, a delivery has been received or arrived at its destination, or a digital asset has been downloaded from the Internet. The relevant automated actions or signals are then recorded in the distributed ledger/blockchain.

Of course, given the massive amount of data that is created by those sensors, automated signals, and data streams, it is imperative that only the very few pieces of data coming from a signal that are relevant for a specific business process or transaction be stored in a blockchain. By recording non-relevant data in a blockchain, we would soon hit data size and performance issues.

Ideas to ignite thinking in specific industries

  • The digital, “blockchained” physical asset (asset lifecycle management): No matter whether you build, use, or maintain an asset, such as a machine, a piece of equipment, a turbine, or a whole aircraft, a blockchain transaction (genesis block) can be created when the asset is created. The blockchain will contain all the contracts and information for the asset as a whole and its parts. In this scenario, an entry is made in the blockchain every time an asset is: sold; maintained by the producer or owner’s maintenance team; audited by a third-party auditor; has malfunctioning parts; sends or receives information from sensors; meets specific thresholds; has spare parts built in; requires a change to the purpose or the capability of the assets due to age or usage duration; receives (or doesn’t receive) payments; etc.
  • The delivery chain, bill of lading: In today’s world, shipping freight from A to B involves lots of manual steps. For example, a carrier receives a booking from a shipper or forwarder, confirms it, and, before the document cut-off time, receives the shipping instructions describing the content and how the master bill of lading should be created. The carrier creates the original bill of lading and hands it over to the ordering party (the current owner of the cargo). Today, that original paper-based bill of lading is required for the freight (the container) to be picked up at the destination (the port of discharge). Imagine if we could do this as a blockchain transaction and by forwarding a PDF by email. There would be one transaction at the beginning, when the shipping carrier creates the bill of lading. Then there would be look-ups, e.g., by the import and release processing clerk of the shipper at the port of discharge and the new owner of the cargo at the destination. Then another transaction could document that the container had been handed over.

The future

I personally believe in the massive transformative power of blockchain, even though we are just at the very beginning. This transformation will be achieved by looking at larger networks with many participants that all have a nearly equal part in a process. Today, many blockchain ideas still have a more centralistic approach, in which one company has a more prominent role than the (many) others and often is “managing” this blockchain/distributed ledger-supported process/approach.

But think about the delivery scenario today, where goods are shipped from one door or company to another door or company, across many parties in the delivery chain: from the shipper/producer via the third-party logistics service provider and/or freight forwarder; to the companies doing the actual transport, like vessels, trucks, aircraft, trains, cars, ferries, and so on; to the final destination/receiver. And all of this happens across many countries, many borders, many handovers, customs, etc., and involves a lot of paperwork, across all constituents.

“Blockchaining” this will be truly transformational. But it will need all constituents in the process or network to participate, even if they have different interests, and to agree on basic principles and an approach.

As Torsten Zube put it, I am not a “blockchain extremist” nor a denier that believes this is just a hype, but a realist open to embracing a new technology in order to change our processes for our collective benefit.

Turn insight into action, make better decisions, and transform your business. Learn how.

Comments

Juergen Roehricht

About Juergen Roehricht

Juergen Roehricht is General Manager of Services Industries and Innovation Lead of the Middle and Eastern Europe region for SAP. The industries he covers include travel and transportation; professional services; media; and engineering, construction and operations. Besides managing the business in those segments, Juergen is focused on supporting innovation and digital transformation strategies of SAP customers. With more than 20 years of experience in IT, he stays up to date on the leading edge of innovation, pioneering and bringing new technologies to market and providing thought leadership. He has published several articles and books, including Collaborative Business and The Multi-Channel Company.