Target’s massive security breach exposes security process failures

…And although there are companies that blatantly violate the standards, security is a constantly changing condition, not a static one. Every time a company installs new programs, changes servers or alters its architecture, new vulnerabilities can be introduced. A company that is certified compliant one month can quickly become non-compliant the next month if administrators install and configure a new firewall incorrectly or if systems that were once carefully segregated become connected because an employee didn’t adhere to access restrictions. Companies that conduct audits also have to rely on their clients to be honest about disclosing what they have on their network — such as stored data.

To answer the question posed by the title of the Wired.com post – No.  Therein lies the problem. [footnote] The nature of audits, in most professions, is that their usefulness is a function of the competency of those conducting them [/footnote]
Wired link: Will Target’s Lawsuit Finally Expose the Failings of Security Audits?

The corroding value of the internet cookie, and an opportunity to shape a new market

Several years ago, I first heard Doc Searls make an amusing comment about one of the basic elements of the internet universe, the browser cookie.  With full credit to Phil Windley, Doc’s historical summary of ecommerce (and much of the modern internet) went like this:

A brief history of ecommerce can be summarized as this- 1995: The invention of the cookie. The end.

The browser cookie has reigned supreme for nearly two decades.  It has given rise to marketing empires like Double-Click (Google), Omniture, and nearly every imaginable advertising network of the modern web.  Cookies also provide context beyond ecommerce, since they help sites fine-tune the user experience and reduce friction for end users.

Cookies have become so pervasive that a contextualized web with out them would not be possible.  They’ve also extended well beyond context, as most cookies now actively track internet users, often without explicit permission.  With that backdrop, it’s hard to imagine that this atomic element of today’s web may soon fade away.

Perhaps because of how pervasive it is, and how invasive it is to personal privacy, the browser cookie is now under assault on many fronts.  The Europeans have taken to legislation as the primary vehicle to act against personal tracking technologies like cookies, Microsoft has gone as far as to ‘default‘ a do-not-track feature with their latest version of Internet Explorer, and there are at least a dozen such plugins for Firefox and Chrome.  Some ad-tech experts are actually predicting the complete collapse of the browser cookie in five years:

Five years at the most.

At my former company, my peers were the people who created cookies. We didn’t create them for this. It’s a very weak computing mechanism. It’s flawed, invasive, it’s got privacy issues, it’s going to go.

I think it will take five years to kill it. At that point, it’ll be like birds chirping and flowers blooming because we’ll find some kind of value proposition that allows consumers to trust us and opt into personalization. I term it, tailor don’t target.

via – The cookie has five years left says Merkle’s Paul Cimino | Ad Exchanger

It’s no surprise that ad-tech professionals see a paradigm shift away from cookies, but that shift isn’t being driven by a direct attack on the technology.  I can’t imagine that the ‘average’ internet user is proactively installing browser plugins to block cookies, so there has to be another reason why cookie usage has dropped precipitously.  At a prior point in the same blog post, Cimino reveals:

The second main reason is that non-cookieable devices – phones and iPads, Kindles and the like – are generating traffic somewhere between 35% and 40% of our overall traffic. So 35-40% of traffic is not from computers.

Consumer behavior has shifted away, which is forcing a shift away from cookies.  Although this might seem as a ‘win’ for privacy,  the ad-tech world has figured out even more invasive ways to target consumers:

I can’t cookie your iPhone or your Android phone. If you are at home or you go to the same place every day, I can see the IP and part of the user agent – enough information to reasonably identify you over and over and keep that good sync between the data – the first- and third-party data and the targeting opportunity that’s out there.

The takeaway here is that, as we see the value of cookies corroding, the technological fabric that has woven the modern web has produced even more invasive methods to track individual behavior.  At the same time, legislation and technology to counteract tracking technology is focused on the old cookie paradigm.  While the new tracking systems are relatively new, perhaps there is a window of opportunity for consumers to help shape a more balanced framework.

It is this balanced framework, that we are focusing on developing at Customer Commons:

Customer Commons holds a vision of the customer as an independent actor who retains autonomous control over his or her personal data, desires and intentions.  In this vision, each of us will act as the optimal point of integration and origination for data about us. Customers must be able to share their data and intentions selectively and voluntarily. Individuals must also be able to know exactly what information is being held about them by those who gather it, by whatever means. To achieve this, customers must be able to assert their own terms of engagement, in ways that are both practical and easy to understand for all sides.

I encourage you to join the conversation at Customer Commons.  Additionally, I will be devoting more time writing about how customer engagement in a modern marketplace will be significantly different, and how we call all help to shape that future, and more free, market.

If you are in the bay area during the week of May 6th, 2013, please consider joining the Customer Commons Salon that Monday evening.

Google’s take on the customer journey

These days, the customer journey has grown more complex. Before making an online purchase decision, a customer may engage with your brand through many different media channels over several days. This tool helps you explore and understand the customer journey to improve your marketing programs.

via The Customer Journey to Online Purchase – Think Insights – Google.

There are several interactive charts on that post, all of which reveal some interesting characteristics on how customer interactions vary based on the channel of engagement, by industry and region.

An excellent post on big data and the customer experience…

An excellent post on big data and the customer experience over at the Harvard Business Review blog. Of note:

Expand the Value You Create for Customers

Improving the customer experience is a fine idea. But companies often take it to extremes. It’s always a good idea to look for new ways to create value for customers. But focusing only on doing so through your product or service is entirely one-dimensional. The hard reality is that your product or service, however great it is — however much it helps your customers get a job done or provide an enjoyable experience — is likely just not that important to their lives in the grand scheme of things.

via The Big Goal Behind All that Customer Data – Bill Lee – Harvard Business Review.

Solid, in-depth piece on pricing

There’s lots of talk about optimizing the customer experience from a process perspective, but not much conversation from a pricing perspective.  Pricing, as the article I link to below, is more than building in profitability above product or service costs.  Achieving an ‘optimal’ price requires deeper analysis than most companies actually do.  According to the Sloan Review piece, fewer than 5% of Fortune 500 companies have a full-time pricing function, and less than 15% of companies do systematic research on pricing.  That, to me, was surprising.  Here’s a clip from the article:

 

How could companies go about rethinking their pricing strategy? The first area that may require a fundamental rethink is the way companies set prices. Many companies have a significant opportunity to differentiate themselves from competitors by learning how to create, quantify, communicate and capture customer value by implementing customer value-based pricing strategies. A second area concerns price realization — that is, the process of translating list prices into profitable pocket prices. Here, many companies lack the information systems, negotiation capabilities, incentive schemes, controlling tools and sales personnel confidence leading to superior price realization. Small improvements in any of these areas lead to quantifiable results very quickly. (See “Next Steps for Improving Pricing Capabilities.”)

CEO involvement is a critical requirement for ensuring that changes in a company’s pricing strategy lead to a true change in the company’s culture. At the same time, the CEO must ensure that these changes are not seen, as too many failed initiatives are, as “just another project.” CEO championing, bundled with organizational confidence, new capabilities and transformational change are key catalysts to obtain pricing power.

via Is It Time to Rethink Your Pricing Strategy?.

A definite must read piece.