Wednesday, April 30, 2014

Software security pays off: How Heartland Payment Systems gains steep ROI via software assurance tools and methods

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.

Heartland Payment Systems has successfully leveraged software-assurance tools and best practices to drive better security within its IT organization -- and improve their overall business performance.

In this first of a two-part series -- Does Software Security Pay? -- hear directly from Ashwin Altekar, Director of Enterprise Risk Management at Heartland, as he shares his insights and knowledge with Amir Hartman, the Founder and Managing Director at MainStay, a marketing and IT advisory services firm in San Mateo, California.

We’ll learn how Heartland, based in Princeton, New Jersey, has improved governance results in innovative ways across the organization, thanks to both security best practices and HP Fortify tools.

Hartman, who recently completed a software-assurance return-on-investment (ROI) study, also shares details from that study on how HP Fortify has impacted Heartland’s IT organization.

Here are some excerpts:
Amir Hartman: The research that we did found some very interesting results from the companies that we interviewed.

Hartman
We found three main benefits to employing and institutionalizing a strong software security-assurance program with supporting tools. One was a saving that organizations are seeing. Second, it’s a risk-management benefit to the organization. Last, we actually saw some revenue protection benefits as well.

So I'm pretty excited to have Ashwin on the call today and have Ashwin share with us his experiences in deploying HP Fortify solutions and these practices within Heartland. Ashwin, give us a little bit of background, a little bit about yourself, and then describe the software security landscape at Heartland.

Ashwin Altekar: I've been working in information security for over a decade and have spent a large portion of my time performing application penetration tests and managing software-assurance efforts.

At Heartland, we take software security very seriously. We strive to be the trusted transaction provider, the trusted partner of the large number of merchants who depend on our payments and payroll services. With application security being such a large vector for attack, we’re very aware of the multiple controls necessary to keep our customers’ data secure.

We lean quite heavily on HP Fortify, first to understand, and then improve, our level of software assurance.

Previous scenario

Hartman: Let's take people back a little bit. Please describe what the software-security scenario was like at Heartland before institutionalizing some of these practices and before implementing and rolling out Fortify. What did things looked like before? Then, talk to us about why you went in a new direction.

Altekar: Prior to Fortify, or any automated tools, we relied mostly on manual inspection by developers using common security guidelines like the Open Web Application Security Project (OWASP) or assessments done by third parties.

Altekar
As our enterprise grew, it became harder and harder to be confident in our application-security posture with just manual inspection by development teams. Software assurance is very important to us, not just finding vulnerabilities, but understanding what percentage still remains. With manual efforts, there was just too much to do and not enough time.

We liked the breadth of programming languages supported by Fortify and we really liked the direct integration to the integrated development environment (IDE) for common IDEs like Visual Studio and Eclipse. So Fortify was just a natural fit for the need at the time.

Hartman: I would imagine that with the space that Heartland plays in, obviously these issues are quite sensitive. And if you look at the marketplace, you’re seeing this explosion of mobile devices and mechanisms by which consumers are transacting. It makes this issue even more front and center.

Altekar: Absolutely. Our primary product or service of facilitating transactions is provided through software. So Fortify is definitely a key product that helps us position ourselves as a secure company. And to do so, we need to understand what security issues we have in our software.

Hartman: What are some of the benefits that you've been able to deliver to the organization and to its customers through institutionalizing these practices and tools?

Altekar: At Heartland, we risk-rank our numerous applications and have various requirements on what each development team has to do to meet internal requirements.

One of our basic requirements is that all software applications be scanned using Fortify. From the information-security perspective, that has allowed us to understand what it is that we’re up against when we talk about software-security assurance. So, a large challenge is trying to figure out what it is we don’t know. Fortify allows us to quantify our level of effort and get the attention software security requires.

Also, we've been able to show the successes of many teams that embrace Fortify. They’ve been able to do more and learn more about software security in much less time.

Similar results

Hartman: In the research that we did, we found similar results. We found quite a number of organizations that were able to reduce the amount of time the developers were spending identifying and remediating. Because of the automated mechanism, they focused their attention on developing new value-add applications.

It's reallocating their time. It’s not that this stuff isn’t important. Obviously it's essential, but if we've got a way to do this faster and then focus the developers’ attention on different areas that are more value add, that was a big win. I don’t know if that’s something similar what you’re finding as well, as developers are making it part of their DNA.

Altekar: We absolutely do find that. There’s an old expression for spell check that if you see the correct spelling seven times, you would finally get it right on the eighth.

Our developers are bit quicker in learning about security best practices, but Fortify allows us to do a very similar type of reinforcement when it comes to specific software-security issues. They’re able to see the right way to do secure development through Fortify and then learn from that.
They’re able to see the right way to do secure development through Fortify and then learn from that.

Hartman: Some of the things we noticed were a little bit unexpected. When we went into the study trying to figure out how companies are benefiting from effective software security practices, we were going in with certain assumptions.

One of the assumptions was that some of these automated tools and practices are going to obviously save time and save money on the developer side. Certainly, if I can address and remediate things early in the development cycle, that’s going to save me a tremendous amount of resources and money, versus down the road in post production.

But there were a couple of areas that we found in terms of benefits that companies were experiencing that were a little bit unexpected, and there were some innovative uses.

Can you share with us a little bit from your perspective, and from Heartland's experience, some of the more innovative uses of these practices and Fortify related to software assurance?

Altekar: We provide broad warnings about software security issues in general at the enterprise level, and Fortify allows us to really target our training efforts on the issues we see at the project level.

We can discuss those specific topics with the development teams when we interact with them and we can even point out the specific remediation tips within Fortify. That’s very helpful.

Secure development

Something else we’re looking to roll out right now is how we can visualize the different development teams and how they compare to each other in terms of software security. So we’re looking to see if we can incentivize secure development even before a line of code has been written.

Through some minor gamification, leveraging Fortify statistics between the various development teams here at Heartland, we hope to better train developers and, in turn, improve the overall development productivity.

There’s another interesting use that we have. At Heartland, from time to time, we acquire various companies or seek to be partners with them. During the evaluation phase, often we’ll use HP Fortify to determine the amount of work that we may need to do to get the acquired software into a production-ready state.

That has been helpful sometimes in negotiating the acquisition price or making sure that we factor that in and do and appropriate level of due diligence ahead of time.
When you start articulating and dictating to developers things that they should do, the reaction isn’t always positive.

Another common scenario for us is that we’re able to understand the quality of any third-party developers that we contract with and we can force strict standards on what secure development means.

Traditionally we enforce security through a legal contract that says the third party has to follow secure coding guidelines based on best practices, but with the implementation of Fortify we can say that they have to have a clean Fortify scan prior to finalizing a certain amount of work.

Lastly, our secure software development lifecycle (SDLC) process, which includes HP Fortify, signals to our partners -- especially our partners that value security -- that we’re very serious about software security and that we take a lot of the right steps, if not all the right steps, doing whatever we can to understand our vulnerabilities in software and to eliminate them.

Hartman: How this has differentiated, or been used to differentiate, Heartland? Obviously, in the space that you play in, security is at a premium, as is being able to ensure your customers that you've got a terrific approach. Can you talk to us about that in terms of  whether this capability helps you differentiate in the marketplace?

Altekar: As I'm sure you know, security is more important than ever in our customers’ minds. When it comes to transactional security, we've heard of a few high-profile reports about payment security and breaches lately. That has really raised awareness and that’s great, especially since many of Heartland’s products and services focus on security.

Confidence in the quality and security of our software product is absolutely a differentiator. It allows our customers to focus on their business without having to worry about technical security issues in their day-to-day operations.
Having trust in a brand, having trust in a company and its products and services, is very important for our customers.

Having trust in a brand, having trust in a company and its products and services, is very important for our customers, and our secure SDLC allows us to articulate why it is they should have that confidence in us.

We can tell them that we have secure development training, we have a static source code analyzer, we use dynamic tools, we have manual inspection, we have third-party assessments. These are all things that especially our larger customers appreciate. They understand that this is what you need to do in today’s day and age to have secured products.

We’re able to elaborate on the multitude of things that we do, and many of our partners are very thrilled to partner with us because of that.

Hartman: Can you help us understand what were some of those key factors throughout this journey, and it is a journey? It's not just one quick little implementation and then you are off and running. It's definitely a journey from the customers we've talked to. What are some of those key success factors in institutionalizing such tools and practices across an organization?       

Changing variables

Altekar: Journey is a great word for it. There have been so many times when I thought that we were finally at a place where we need to be, and then, one of the variables changed.

The first thing that you can do is be very clear about what development teams need to do for internal compliance when it comes to software assurance. That could mean setting specific metrics or making sure that they have well defined processes. But whatever is right for your organization, you have to repeat that message often.

I used to think that I was just constantly talking about security, and everyone was tired of it, but one of the key lessons I learned was that it's impossible for you to repeat that message too often. So be very clear about what it is you want them to do and say it often to anyone who will listen.

The second is to make it easy. Make it very simple for various development teams that integrate into your software assurance processes. So understand the challenges that individual teams face in implementing security during the development life cycle. One team’s problem, if they are doing an agile development process versus waterfall, could be very different depending on those scenarios.
The key success factors are just to be clear about the message, make it easy for people to integrate, and then measure how well everyone is doing.

Make sure you understand their challenges, whether it's process, time, or the right tools, and make sure that you’re able to solve for those. Thankfully, for us, Fortify has been very easy to integrate into the IDE. We've been able to automate with it, so it's been flexible in a number of different scenarios for us.

Finally, quantifying, measuring progress over time. It's very easy to sit back and say, “These guys implement Fortify” or “We have manual tests for them” or “They take all the required training,” but it's great to quantify each, so that you provide feedback to senior management and talk about many of the success stories.

If you can provide quantitative information and share those success stories everywhere throughout the organization, you’re able to reward everyone’s efforts. In summary, the key success factors are just to be clear about the message, make it easy for people to integrate, and then measure how well everyone is doing.

Hartman: That’s a great summary, and last one, especially to your point, sounds easy. It's not that trivial of an activity. It's being able to communicate to leadership as well as to the troops.

Leadership, especially in a set of measures or metrics that resonate with them, is not an easy task. There are a lot of activities that get done as far as software security and software assurance practices go, but translating that into a language that a senior business leader is going to understand is not an easy task. That’s a very good point.

A couple of last questions for you. If you could take a look back for us with this journey and when it started and the success you've had, is there anything you would do a little differently?

Be repetitive

Altekar: One of the things I already mentioned was to be repetitive about the importance of software security and what needs to be done. There is always someone who hasn’t heard that message, and it's important for them to hear it as well.

The other thing is that it's okay to be a bit more realistic in what an organization can do. Just because there's lots of security work ahead of you, it doesn’t mean that the organization is able to get it all done immediately.

So it's important to create realistic goals and time frames that the organization can meet, versus trying to get everything done all at once. It changes from organization to organization on what that means, but I've learned to have realistic goals, rather than ideal goals.

Hartman: Going forward then, what's next for Heartland and specifically in this space? Can you paint us a picture for what's next in the horizon from an SSA standpoint, let's say, the next 12 months or so?
My next goal is to combine all our different tools and get even more value out of them running in sync with each other.

Altekar: I'm really excited for the next year at Heartland. We’re at a place where we have many of the right tools. We have many of the right controls at the right time during the software development lifecycle. 

My next goal is to combine all our different tools and get even more value out of them running in sync with each other - trying to add one and one to get three, versus just the two that we have today.

Going forward, I’d really like to continue to automate and leverage the individual tools and get them working together so that we get, one, richer information about our security posture, but two, to get more actionable and precise information on what various development teams need to do, or what the security team needs to do to better support software assurance efforts.
Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.

You may also be interested in:

Tuesday, April 29, 2014

Ariba's roadmap points to instant, integrated and data-rich business cloud services

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: Ariba, an SAP company.

The next BriefingsDirect thought-leader interview focuses on the Ariba product roadmap for 2014 -- and beyond.

Ariba’s product and services roadmap is rapidly evolving, including gaining more analytics capabilities. BriefingsDirect had an opportunity to learn first-hand how at the recent 2014 Ariba LIVE Conference in Las Vegas.

To learn more about the recent news at Ariba LIVE -- and also what to expect from both Ariba and SAP Cloud in the coming months -- we sat down with Chris Haydon, Senior Vice President of Solutions Management for Procurement, Finance and Network at Ariba, an SAP company. The discussion is moderated by me, Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:
Gardner: What’s changed in the business-network market? What’s shifted since we spoke last a year ago?

Haydon: There’s a lot more interest. People are just starting to really understand what business networks really mean.

Haydon
In some of the conversations coming through, large corporate enterprise buyers are really looking for a single hole through the firewall, if you like. They’ve done some great work in optimizing their internal business processes, but they really understand that the next undiscovered country is in collaborating with their suppliers.

But it’s not just their suppliers. It’s payment providers, logistics providers, and a whole heap of supply-chain stakeholders. We’re seeing that larger conversation over not just a single business process, but a holistic business-process view.

I think the other really interesting thing isn’t a trend. It's probably a confirmation of what we already knew, particularly in the southern hemisphere. Mobile is on the increase and is now bypassing of the laptop, specifically in some emerging markets.

They’re the two macro trends that we are seeing that are manifesting themselves in our new business acquisitions. 

Mingling with others

Gardner: So “mobile first” is really important, as is the notion of a boundaryless organization. You don’t just exist as an island. If you’re going to be really adept and productive and develop some of the great insights you can through data, you need to allow your borders to mingle with others.

Haydon: That’s right. And it’s a network effect as well. People don’t want to do all the heavy lifting themselves. They’re really starting to understand that there is the network here. I can adapt, not adopt, so to speak, and really accelerate the business by leveraging the existing community.

Gardner: Have there been any technology shifts that we’ve had in the past year that have enabled some new and interesting things at the business networks and applications level?

Haydon: We’re in the early stages of redoing parts of our technology to take advantage of where the growing trend is going to come. We spoke about mobile, but it’s not just mobile. It's more about user experience and how we focus specific use cases on where an improved screen, an improved device, or both makes sense in the user context. That’s a really big change for us as well.

We’ve spent the last 12 months, and we will spend a good part of the next 12 months, rebuilding the platform to really be able to take advantage of these larger trends around real-time analytics, big data, and all that, but translating that into actual actionable use cases.

Gardner: What are the highlights for you at Ariba LIVE 2014?
We have some amazing customers, and the adoption of our customers is just superb for us.

Haydon: First, there’s another record turnout. We have some amazing customers, and the adoption of our customers is just superb for us. We want to drive more value into both the buyers and the sellers.

There are some pretty interesting announcements that we’re doing. We announced AribaPay last year, and we are happy to announce this year that that’s well on track. We’re going to be doing more on AribaPay, but this is really transforming the B2B payment space and leveraging that. We want to bring the payment process within the visibility and the view of the network. We think that’s pretty huge.

Second, you’re going to hear about us doing more innovation than ever before. We have some significant investment from SAP, which will translate itself into globalization -- moving into Russia, moving into China -- and into new business processes, like supply chain and payment, as well as leveraging the great infrastructure and platform that SAP has in mobile. You’ll see three to five mobile-centric use cases delivered in Ariba within the next 12 months.

Gardner: What about the Ariba-SAP synergy? How has that changed Ariba. It’s been a while now since the merger and acquisition. What can you tell me about the relationship and the character of the company?

Embracing the cloud

Haydon: SAP has really embraced the cloud. And it has worked so well in terms of a lot of the cloud DNA that Ariba brings to the table. SAP has truly embraced that.

And for us within Ariba, there are three or four dimensions. One is certainly global, and SAP is everywhere. A global sales force and, more importantly, global know-how is very important.

Number two is industries. Historically, Ariba was not very industry focused. Now, with SAP, with their vast industry expertise, it really will enable us to drive great solutions into specific industries globally.

And last, but not least, it’s getting access, from a product-management perspective, to lots of new things to play with and great platform tools. We have HANA, and we have released some products on HANA starting this weekend.
We’ve seen some really great synergies in the first 12 months and we expect more next year.

We’re going to continue to do that. We’re going to put the network on HANA, accelerate that investment in mobile, other aspects on reporting, and deep integration with the business suite. We’ve seen some really great synergies in the first 12 months and we expect more next year.

Gardner: Let’s look at this whole spectrum of data and analysis. Data scientists and business intelligence (BI) professionals have been creating reports and developing the fruits of a data infrastructure for years, but what we are starting to see now is the use of analytics and visualizing the analytics.

We’re giving it to folks down on the line of business, not just at the very tip of the organization, but throughout the organization. How has this need and demand for greater data and greater analysis capabilities translated into what you’re doing at Ariba and SAP?

Haydon: This is actually part of why people understand the business network and why the business network is starting to take off. If you think about what’s so great about SAP/Ariba and our great capability, we have this great business network, more than 600 billion in spend, and more than a million suppliers.

I’ll go into technology for a second. It's the promise of what an in-memory database can give us. Imagine when we can put all of those transactions in real-time that are flowing today, imagine when we double it over the next three years or something like that.

Power of HANA

And we put that in real time because of the power of HANA, real-time analytics, whether it's lead time or a moving price average. We won’t just dish it up in quarterly reports that an executive sees. What if a supplier is responding to an order confirmation and they can see that the average lead time has changed? They can take an action and do something about it to fill their customer’s needs.

What if you’re a procurement officer and you’re going to do a sourcing event? You can see that five extra suppliers come on or there is some problem with your core supplier because they are out of stock. If there’s a natural disaster hitting, what if you can see that real-time?

That’s the promise that big data and analytics delivers in something like the business network, which gives us a holistic view that is unparalleled, particularly when we are able to marry that with the master data that exists in the applications or in the enterprise resource planning (ERP) systems.

Gardner: What strikes me, Chris, about this era is that for so long, companies relied on their own data and their own analysis. There was really a wall around the activity with BI.

But now, with things like third-party networks, like the Ariba Network, they can start to get data that might be anonymized. Privacy issues have been worked out and people are allowing data to be shared. That’s where these real insights are coming. It’s the volume, velocity, and variability of the type of information.
None of this happens without the appropriate privacy, anonymization, aggregation, and all of that.

So what comes in terms of a business application benefit? Where are you driving these visualizations and this data? What can we expect in the next 12-18 months in terms of analytics meeting business applications?

Haydon: The first one, which we have already announced, is Supplier InfoNet, which is our HANA-based alerting and supplier information system, which can also feed in. We’re  releasing that and we’ll be building that integration into our solution set. That’s the first thing.

We’re kind of feeling our way here, and you brought up an excellent point. None of this happens without the appropriate privacy, anonymization, aggregation, and all of that. That’s the given that you have got to work out first.

But once you have that, we want to look at point areas to road test what it looks like. Maybe we just show to a supplier and say, “When you’re responding to an event, your lead time is x percent slower than all your other competitors.” There’s some peer pressure, and we’re not sharing anything else, but it actually helps the salesperson understand where they are.

It’s the same thing on the buy side. If you confirm that the moving average price of this commodity in the United States moved by 5 percent, you might want to consider having a sourcing event. Those are the type of point things.

Most meaningful

The holistic dashboarding and automated alerts will come. We just want to work out those flows and what’s most meaningful. That’s where we go back to the point about the user experience. How do we do that? Do we need to expose that in a mobile app with an alert, or is that just an icon that pops up on your screen, or both. That’s how we want to intersect the two.

Gardner: Let’s move into mobile. You mentioned "mobile first." That’s really an interesting concept, but it seems to me that it's more than just a screen definition. You really need to rethink processes when you start to go to that mobile tier and recognize that people are 24x7, regardless of location, intersecting and  interacting with business processes. So what should we expect from mobile innovation?

Haydon: I wouldn’t even couch it as “mobile first,” but “mobile as required.” First and foremost, what we are focusing on for our mobile strategy is, notwithstanding putting in place, just the core platform to enable it. When we’re looking to our features that we build in our products, we want to focus, which, as you were alluding to, is how does the end user need to consume this information?

If it does make sense that a mobile device is able to present that, then we’ll do it. We are not doing it for the sake of having a mobile solution, just to have it out there. We don’t need to do that.
We want to take a focused approach. We want to embed the mobile development paradigm within our current development product teams.

Obviously, some things bubble to the top, approval apps or flipping a purchase order or a new event, and we will do those. But we want to be quite systematic in what we’re going to do.

Also, from a product development sense, we want to take a focused approach. We want to embed the mobile development paradigm within our current development product teams.

What does that mean? It means we’re not going to have a mobile team out on the left, running and building 500-600 apps that they think they should build, and then our core feature team doing it. We’re going to have our engineers, our product managers, our quality assurance (QA) people thinking about mobile in parallel with the screen and how that enhances the customers or the user experience to deliver the business outcome.

While we might be somewhat slow compared to others, some competitors are saying they have 20 mobile apps. We think our way is going to deliver better business outcomes by taking the user experience construct and making that, whether that’s mobile, analytics, or screen, all in the same context.

Gardner: I like the idea that it's process first, regardless of the screen, but this seems to give you an opportunity to move and scale into new regions in some markets. In China, for example, the smartphone is the primary device and screen.

It also allows you to scale down smaller businesses. You can run a business on a smartphone. Why not have cloud business services to accomplish that? What about that global reach? What do you expect for the next 12-18 months in terms of expansion vis-à-vis any number of services, but mobile being part of that?

New data centers

Haydon: A couple of things. Number one, since we first spoke, we announced our first European data center, and that was commissioned in December. We already have a number of customers live already. We’re in the process of dealing with that. 

We have also announced data centers in China and Russia for our applications. So in terms of just global deployment, we’re investing in data centers which will deal with a lot of the data privacy and encryption table stakes to even get started.

And then, just being on the back of SAP is one of the really great synergies that we get, in that they have in-country local product managers who are born and bred and live in the jurisdiction to be our proxy customers, the voice of the customer actually in-country as we look to embed in there. 

Gardner: Into our next subject. What about governance, risk, and compliance (GRC) topics and issues. It seems that we can’t really divorce concerns about privacy and security and risk amelioration from business activities, especially as we consider that boundaryless organization. We want to expand into new markets and allow enterprises to do more business and supplier activities across these boundaries.
All decisions -- procurement, supply chain or others -- are made with a risk-management focus.

So how do we think about embedding GRC both as a process and as a technology in the Ariba roadmap?

Haydon: Ariba had a pretty good legacy of being at the forefront on a lot of that. Maybe we didn’t give ourselves credit, but for the longest time, we have had security, privacy, availability, and confidentiality processes and certifications. Some competitors have one, some competitors have two or three, but we had five.

We are also payment card industry (PCI) compliant. That’s a pretty high threshold. I know other companies have PCI compliance, but I mention those points because that’s part of our DNA. You have to start thinking about that, you have to understand enterprise problems and build your operations, your infrastructure, and your technology around that. We’re in a pretty good state.

Obviously, these GRC compliance processes are growing. Risk management is like a new mantra. It's the forefront of anything else.

I mentioned our data centers. One aspect of dealing with in-country data privacy, obviously, is having a data center in a jurisdiction. As I said, we commissioned our European data center. One in Germany is primary, and there is a failover elsewhere. That should deal with a lot of EU data-privacy concerns. Then, Russia, China, and so on.

The second piece that we do have, being as part of SAP, is that SAP has a very comprehensive GRC process themselves to make sure that they don’t do business with customers that are on particular restrictions or watch lists internationally. It's not just the US or the EU, as I understand. SAP reviews 13 or 14 data sources, not just one or two.

Trading partners

So we’re bringing those processes into the Ariba Network to make sure that we don’t do that, but we also notify our trading partners as well, and that’s part of the value-added service. You may well be doing transactions or trying to do an event with someone not appropriate from a risk perspective.

The last piece, a little bit related to this from the roadmap, is that, in the course of this year, we’re looking to build out on the Ariba Network support for US public sector. Once you start into the public sector for business process transactions, you get a whole heap of compliance issues on encryption, accessibility, and a couple of other dimensions. Those requirements will be built into the network and also to our applications over the next 12 and 24 months.

Gardner: Now, back to products and services. Often, at these Ariba events, and I’ve been at quite a few, we hear about services that people are familiar with, but there are layers of new functionality and features. Are there any that pop out in your mind from 2014 that we should go over and s reflect on as maybe changing the way people think about doing business vis-à-vis cloud and vis-à-vis the networked economy?
We said we’re going to do a lot of innovation. We’re going to deliver on that innovation.

Haydon: Yeah, there are a couple. One is something released in Quarter 4, at least for our SAP clients. We have native connectivity between the SAP Business Suite and the Ariba Network. You don’t need middleware. It's a downloaded extension pack.

It's pretty game-changing, when you can download something and an order can go out of the Business Suite straight to the network natively. Let’s just remind people of that. That’s pretty nice.

Number two, we have a lot of new features and products coming out, as we said. We said we’re going to do a lot of innovation. We’re going to deliver on that innovation. I’d like to quickly talk about four.

AribaPay, which we touched on, is changing the role of B2B payments on the payment side.

At the top end of the funnel, we are also launching Spot Quote. This is pretty interesting. Forty percent of procurement activity is on contract or on catalog. In some industries, it's greater. This Spot Quote process enables us to take these tactical three bids in a buy from a buyer programmatically and put that out into the business network to be bid upon, and we can also identify new suppliers.

What's exciting about that is lot of process efficiency for buyers, but also for a seller. Think about this. It's almost like the budgets are already largely being committed, and they have a close date. It almost drops to the bottom of the pipeline. That’s pretty nice. It might not be the biggest deal, but I’ll take it.

Supply chain

We’re also releasing our first version of the supply chain, focusing primarily on retail use-case scenarios, working very hard with SAP to have end-to-end connectivity, and we are very excited about that.

Last, but not least, services on the network as well, extending a whole new type of collaborative services for estimate-based services, are going live.

So we have more innovation. It's supporting both buyers and suppliers, and going globally, in terms of Russia and China, and we’ll be adding Brazil and Mexico invoicing as well. So there are a lot of exciting things on the business network for customers, not only in the USA, but globally.
Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: Ariba, an SAP company.

You may also be interested in: