CyberTalk Issue 4 Page 34

the correct ia Conference tone, i.e. plenty of doom and gloom with no
answers or even suggestions offered about what we should actually do
about it.

"I can calculate your chance of survival, but you won't like it".
Okay, enough flippancy. This article is not designed to offer opinion
in respect to the validity or credibility of such paranoia (if it is indeed
paranoia). The point of this article is to provoke debate about solutions
to this potential dilemma, in the hope that we can move this stalled and
stagnant area of discussion forward to another stage.

To explore the issue I'd like to begin by describing an idea that we had
recently. This idea was to provide inter alia, some upstream supply
chain information that could potentially assist our customers. it involved
the creation of labels similar to the type that provide nutritional
information on food packaging, but for the IT products that we sell to
our customers. These would become "Supply chain safety labels" chiefly
designed for those within the government and national infrastructure
markets.

Within our due diligence and product on-boarding process used to
bring on-line new additions to the portfolio, we ask for, and record the
following information about the products put forward for adoption:

· Country of origin
· Countries where the r&d and assembly occurs
· Location(s) of major financial stake holdings and subsidiaries
· Plan(s) in respect to on-going support arrangements for the

intellectual property (e.g. source code)

all these questions are designed in some way to protect ourselves and
our customers from risks inherent in a global supply chain, as well as
within the rapidly developing and volatile iT industry.

The idea then developed a secondary element whereby we would list
this information on quotes in the form of a "Traffic Light Scheme" to
assist customers in identifying supply chain risks. We never did get
around to finalising the criteria for such a labelling scheme, but for the
point of illustration it could have read:

Green = wholly "five eyes" supply chain Assured Supply Chain
amber = supply chain within the naTo member nations
red = global supply chain Unassured supply Chain

Playing devil's advocate on the development of the Traffic Light Scheme,
we soon realised we could get ourselves into trouble undertaking such
politically sensitive discriminations without some serious governmental
backing to which we could refer. Based upon this fear we decided to
stick to plain labels only.

But I then asked myself "But

who really cares?" as in reallY

cares?

if i quoted 2 options (1 green & 1 red), and the red was 10% cheaper
than the green, who would really consider paying more for the
"assured supply chain" option? are we paranoid to the degree that we
apportion a tangible risk factor, which then translates to an economic
buying decision based upon the value of a weighted risk?

i am yet to witness any formal discrimination with respect to location of
the origin or assembly of technology made by our customers.

a global supply chain is extremely complex, and the context in which it
is perceived changes dependent upon your own location and associated
risk factors. For instance, IT has distinctly different supply chain
structures for software, hardware, services, and Cloud services.

Taking Cloud Services as an example, in particular referencing the
G-Cloud framework prevalent within the UK public sector, effort has
been exercised to actually address supply chain assurance issues.

due to the very nature of Cloud services in that they transmit and host
sensitive data, threats of compromise appear to be more direct and
immediate. To address these threats, G-Cloud introduces the concept
of an accredited "Uk safe harbour"; Uk only domains perfect for
sme's to engage in. This in turn serves a separate government agenda
regarding the wider utilisation of sme's in the public sector supply chain.

it is widely recognised that larger global vendors who have based
their data centre operations almost exclusively in geographic locations
that are more economically viable and therefore not within the Uk,
have held back the adoption of Cloud Services on a large scale, and
specifically within the public sector. This is especially true when
it involves departments outsourcing the more critical or sensitive
elements of their business processes to an external third party.

components that originate in the far east are

intentionally contaminated and

sent through the supply chain

ready to

wreak havoc

· 34 ·