Access Control and User Authentication

Lax access controls within your partner’s systems will give you an Excedrin headache. Ray Bedard, a partner in PricewaterhouseCoopers’ supply chain practice in Virginia Beach, Va., tells of a company he worked with that failed to terminate a departing employee’s access to its B2B applications. Before the employee left, he went into the system and ordered a bunch of goods from an online partner. The goods arrived and nobody could figure out what they were doing there. It took several hundred man-hours for the parties to resolve the mess.

To avoid that sort of tampering, companies should require partners to maintain strong, active password programs. Measures should include requirements to change passwords frequently, monitoring and logging of password usage, tools to detect easily guessed passwords and a central authority to set access policies. Wade adds that you should forbid your partner to set up departmental passwords if the partner accesses your systems through its network. "This is always a sticking point in negotiations," he says. "The partner always wants to use some easier form" of password protection.

For sensitive information, companies should require higher-level access and authorization tools. Ramana Palepu, CTO of the Worldwide Retail Exchange in Alexandria, Va., says his members require public-key infrastructure authentication technology, and will expect digital signatures for financial settlement and payment services the exchange may offer in the future. But for less sensitive transactions, such as purchase orders, auctions and item tracking, strong password and user-name controls suffice.

Encryption

Experts and practitioners say companies should require their partners to use encryption for any sensitive information?customer data, marketing strategy, labor relations and unreleased financials?transmitted over the Internet. The Federal Reserve is constantly dealing with financial information, so Wade requires anything transmitted between the Fed and its financial and banking partners to be properly secured.

At J.P. Morgan Treasury Services in New York City, Joe Calaceto, who heads up security as vice president and technical director, requires varying levels of encryption of customer information such as account numbers and beneficiary names and addresses.

Gaffney says Staples requires its B2B partners to encrypt all Internet transmissions, but he doesn’t require encryption for transmissions sent over private networks. "That would be overkill, since one of the reasons we’re paying a premium for a private connection is for its security," he says.

Response Plans

DeMaio says the response plan is where to expect resistance from partners. Most companies focus on perimeter defense because it’s sexy, but once they think nobody can get in, detailed response plans seem like overkill. That is a mistake, and you shouldn’t let your partners get away with it, says DeMaio. "Too many organizations will simply fade and say, ’OK, you don’t have to do it.’"