Tag: Business

Link
Posted on in Links

Economics and Software Bills of Materials (SBOM)

In an article for The Hill, Shannon Lantzy and Kelly Rozumalski have discussed how Software Bill Of Materials (SBOMs) are good for business as well as security. SBOMs more forcefully emerged on the American policy space after the Biden Whitehouse promulgated an Executive Order on cybersecurity on May 12, 2021. The Order included a requirement that developers and private companies providing services to the United States government be required to produce Software Bill of Materials (SBOM).1 SBOMs are meant to help incident responders to cybersecurity events assess what APIs, libraries, or other digital elements might be vulnerable to an identified operation, and also help government procurement agencies better ensure the digital assets in a product or service meet a specified security standard.

Specifically, Lantzy and Rozumalsko write:

Product offerings that are already secure-by-design will be able to command a premium price because consumers will be able to compare SBOMs.

Products with inherently less patchable components will also benefit. A universal SBOM mandate will make it easy to spot vulnerabilities, creating market risk for lagging products; firms will be forced to reengineer the products before getting hacked. While this seems like a new cost to the laggards, it’s really just a transfer of future risk to a current cost of reengineering. The key to a universal mandate is that all laggards will incur this cost at roughly the same time, thereby not losing a competitive edge.

The promise of increased security and reduced risk will not be realized by SBOM mandates alone. Tooling and putting this mandate in practice will be required to realize the full power of the SBOM.

The idea of internalizing security costs to developers, and potentially increasing the cost of goods, has been something that has been discussed publicly and with Western governments for at least two decades or more. We’ve seen the overall risk profiles presented to organizations continue to increase year over year as a result of companies racing to market with little regard for security, which was a business development strategy that made sense when they experienced few economic liabilities for selling products with severe cybersecurity limitations or vulnerabilities. In theory, enabling comparison shopping vis-a-vis SBOMs will disincentivize companies from selling low-grade equipment and services if they want to get into high-profit enterprise or high-reliability government contracts, with the effect being that security improvements will also trickle down to the products purchased by consumers as well (‘trickle down cybersecurity’).

While I think that SBOMs are definitely a part of developing cybersecurity resilience it remains to be seen just how much consumers will pay for ‘more secure’ products given that, first, they are economically incentivized to pay the lowest possible amounts for goods and services and, second, they are unlikely to know for certain what is a good or bad security practice. Advocates of SBOMs often refer to them as akin to nutrition labels but we know that at most about a third of consumers read those labels (and those who read them often experience societal pressures to regulate caloric intake and thus read the labels) and, also, that the labels are often inaccurate.

It will be very interesting to see whether enterprise and consumers alike will be able or willing to pay higher up-front costs, to say nothing of being able to actually trust what is on the SBOM labels. Will companies that adopt SBOM products suffer a lower rate of cybersecurity incidents, or ones that are of reduced seriousness, or be able to respond more quickly when a cybersecurity incident has been realized? We’re going to actually be able to test the promises of SBOMs, soon, and it’s going to be fascinating to see things play out.

  1. I have a published a summary and brief analysis of this Executive Order elsewhere in case you want to read it. ↩︎
Link
Posted on in Links, Reflections

Unintentionally Supporting Bad Policy

A way forward for U.S. Policy on TikTok:

“Hu Xijin, the editor of the Chinese state media outlet the Global Times, weighed in recently on the most recent merger proposal. “The US restructuring of TikTok’s stake and actual control should be used as a model and promoted globally,” remarked Hu on Twitter. “Overseas operation of companies such as Google, Facebook shall all undergo such restructure and be under actual control of local companies for security concerns.”

It’s not exactly a good sign for Chinese state media to tout a U.S. play designed to be “tough on China” as a model for global behavior. The United States may be bumbling its way into a precedent the consequences of which it has yet to anticipate. “

This was exactly the concern that was raised by experts in North America the second after the Trump administration proposed its bumblingly-stupid approach to TikTok. With the American policy in place it’s going to be that much harder for Western companies operating in China to have convincing arguments that they shouldn’t need to partner with Chinese organizations tans engage in manufacturing, technology, or intellectual property disclosures as a condition of doing business in China. And the issue won’t end in China: American (and other countries’) businesses are almost certain to have (now) US-framed arguments thrown at them when operating all around the world whenever there is even a marginal ‘national security’ concern linked to the foreign company’s operations.

Link
Posted on in Links, Reflections

The New Convenience Store?

Elizabeth Segran:

Bodega sets up five-foot-wide pantry boxes filled with non-perishable items you might pick up at a convenience store. An app will allow you to unlock the box and cameras powered with computer vision will register what you’ve picked up, automatically charging your credit card. The entire process happens without a person actually manning the “store.”

Bodega’s logo is a cat, a nod to the popular bodega cat meme on social media–although if the duo gets their way, real felines won’t have brick-and-mortar shops to saunter around and take naps in much longer. “The vision here is much bigger than the box itself,” McDonald says. “Eventually, centralized shopping locations won’t be necessary, because there will be 100,000 Bodegas spread out, with one always 100 feet away from you.”

Segran makes the excellent point through her reporting that these ‘bodegas’ will lack human curation, that persons of Latin descent don’t necessarily appreciate a pair of ex-Google employees trying to appropriate a Latino phrase, and that small business owners aren’t excited about the prospect of losing their businesses and livelihoods.

Beyond those points, there is another issue that the company is going to require credit cards to do anything. What happens when you’re a member of a population that generally doesn’t have access to credit? What happens when you prefer cash? What happens when your credit card is frozen for whatever reason?

(It’s worth noting, of course, that this proposal isn’t nearly as shocking when looking at other countries like Japan which have embraced vending machine culture for a very, very long time.)

Link
Posted on in Links, Reflections

Imagine if Donald Trump Controlled the NSA

Wired:

And exactly what could a President Trump do with the NSA? First, Hennessey says, there’s the question of what he could undo: He could, for instance, rescind the executive actions of President Obama aimed at reforming the NSA after Snowden’s revelations. Presidential Policy Directive 28, for example, issued in 2014, was designed to ensure that the NSA’s signals intelligence branch wouldn’t use its powers to promote American business interests or suppress political dissent abroad, and that it would minimize its invasion of the privacy of not just Americans but also non-Americans whenever possible. Trump could also defang or coopt the executive branch’s Privacy and Civil Liberties Oversight Board, which opposed and helped to end the NSA’s mass collection of Americans’ cell phone records last year.

More fundamentally, Hennessey and other former NSA staffers worry that Trump could redefine the priorities of the NSA’s foreign intelligence mission. He could, for instance, refocus American spying efforts to take the agency’s eyes off Russia and instead target that country’s adversaries, like Georgia, Ukraine, or even the European Union. Given Trump’s murky financial ties to Russia, it’s still not clear how he would approach its authoritarian government if he were to take power. “Trump has indicated he has unusual views about Vladimir Putin as an individual and Russian activity around the world that’s very problematic for the security interests of the US,” Hennessey says. “We shouldn’t underestimate the importance of the intelligence community’s high level priorities and the ability of the president to shift them.”

Despite what people believe, the NSA is significantly restrained in some of its activities as compared to its compatriots. As an example, there is still no evidence that the NSA conducts economic espionage for the purpose of enhancing specific American business’ interests. The United States does conduct economic espionage for trading and global threat assessments, but not to share the collected information with domestic businesses. A Trump presidency could change that and, in the course, truly blend best-of-class government surveillance with nationalist economic policies. While that might sound appealing to Americans it could also initiate a full-scale trade war…and one where the people of the world would likely come out far poorer.

Link
Posted on in Links

Why doctors are rebelling against Ontario’s crumbling healthcare system

Toronto Life:

The fact that doctors bill more than $11 billion annually makes them something like a corporation—their revenues are roughly the same as Air Canada’s or Canadian Tire’s. When companies of that size have to deal with revenue freezes or shortfalls, they respond by finding efficiencies, eliminating duplication and waste, lowering wages or prices, squeezing suppliers for discounts. They take a hard look at how they run their business, and they usually become better companies as a result. Doctors refuse to do this work. Hoskins is determined to force them.

I’m uncertain that the author has ever travelled on Air Canada. Unless, of course, they think that the ‘efficiencies’ Air Canada has achieved by laying of thousands of people, worsening service quality, and regularly failing to meet its agreements with customers have made Air Canada a “better company” as a result.

Link
Posted on in Links

Saudi Millennials Don’t Use Their Phones Like We Do

Saudi Millennials Don’t Use Their Phones Like We Do:

… the problem lies in [the branding/marketing companies’] intent: Instead of entering new markets with an open mind, they approach with a strategy in place and then look for the people who prove their theories right. “The only thing worse than not asking the questions, is not paying attention to the answers that don’t fit into their world view, because it’s inconvenient,” says Chipchase.

Set aside the headline. This longish read does a good job of explaining why it makes sense to hire an ethnographer before developing (to say nothing of launching) a product and, simultaneously, the intense amount of work that goes into launch a new product with a unique brand identity.

Aside
Posted on in Links, Writing

Can @Jack Save Twitter?

A long read by the author of Hatching Twitter: A True Story of Money, Power, Friendship, and Betrayal, which unpacks the return of one of Twitter’s co-founders. It’s an instructive read into the poisonous culture of Twitter and the backbiting that characterizes the company…and seemingly has meant that it’s been unable to really determine what it’s about, for whom, and how it will be profitable to investors. The end is particularly telling, insofar as Twitter is seen as having one last chance — to succeed in ‘live’ events — or else have to potentially sell to a Microsoft or equivalent staid technology company.

Aside
Posted on in Aside

A sad part of my life is currently being spent comparing e-commerce platforms that have fair fees for processing digital downloads. It’s becoming apparent that, despite being a problem needing solving for more than a decade, solutions remain mediocre on average 😦

Posted on in Writing

We Need Clarity on ‘National Security’ Rules for Telecommunications

The story of Blackberry has gripped many technology watchers, watchers who are bearing witness to the trials and tributations of the company as it struggles to compete in the increasingly populated smartphone market. To some, it seemed that one way ‘out’ for Blackberry was for the company to be purchased by another firm looking to aggressively enter this market. Based on recent reporting by the Globe and Mail, however, it looks like any hopes that Blackberry might be purchased could be scuttled for ‘national security’ reasons.

Specifically, Steven Chase and Boyd Erman write that,

Ottawa made it clear in high-level discussions with BlackBerry that it would not approve a Chinese company buying a company deeply tied into Canada’s telecom infrastructure, sources said. The government made its position known over the last one to two months. Because Ottawa made it clear such a transaction would not fly, it never formally received a proposal from BlackBerry that envisioned Lenovo acquiring a stake, sources said.

…

on Monday the Canadian official took pains to emphasize that concerns about BlackBerry are not part of a trend to shut out Chinese investment. “This is a company that has built its reputation and built its success on system security and its infrastructure. That’s one of the reasons businesses use BlackBerries. … The security is robust and we’d obviously have an interest in making sure we didn’t do anything or allow anything that would compromise Last fall, citing a rarely used national-security protocol, Ottawa has sent a signal to Chinese telecom equipment giant Huawei Technologies that it would block the firm from bidding to build the Canadian government’s latest telecommunications and e-mail network. Huawei, founded by a former People’s Liberation Army member, has on numerous occasions found itself having to reject claims its equipment could be used to enable spying.

In October. 2012, a senior spokesman for Prime Minister Stephen Harper publicly hinted Huawei would be left out the cold. “I’ll leave it to you if you think that Huawei should be a part of [the] Canadian government security system,” Mr. MacDougall said.

I’m particularly mindful of the possible security issues that may be linked to letting foreign-located businesses playing significant roles in Canadian telecommunications networks. But, at the same time, the present Canadian government seems to be applying ‘national security considerations’ in a manner that prevents market analysts and watchers from clearly assessing when such considerations might be applied.

Without clear criteria, what are the conditions under which a non-Canadian company could purchase Blackberry? Could a well-financed American company buy it, based on what we’ve learned about NSA surveillance? Could a company that was known to comply with foreign governments’ lawful interception requirements buy Blackberry, given that such requirements could have a global reach? Could Blackberry be purchased by companies that operate in countries that, if their governments had access to Blackberry communications, could gain an edge in international diplomatic engagements with Canada or its closest international partners?

I don’t dispute that national security may sometimes demand terminating business deals that would violate the national interest. However, given that incredibly large investments are being killed by the federal government of Canada it is imperative that the government make clear what ‘national security’ interests are at play, and the security models that motivate terminating such deals. To date, neither the interests nor models are particularly clear. As a result, analysts are forced to read the outcome of federal decisions without the benefit of understanding the full rationale of what went into them in the first place. The result has been to make it incredibly uncertain whether foreign businesses will be legally permitted to engage in market operations with Canadian companies.

Canadians are all to aware that the current federal government has failed on its promise to provide a digital strategy for the Canadian marketplace. In the absence of such a strategy, perhaps the federal government could at least provide its rules for determining when a business proposal runs counter to national security?