Identifying Best-of-Breed Cloud Technology Apps For Petroleum Marketers Sigma IT Share Group March 14th 2014
David Freese CEO
[email protected] www.titancloud.com
Best-of-Breed / Best-in-Class Apps • Use Cloud Technology in conjunction with other disruptive technologies/trends like IoT, Big Data, or Mobility • Allow IT to create real economic value for the business • Are assembled and integrated in a secure manner across presentation, process and data layers – enabling a custom set of Cloud Apps sourced from vendors / internal development 1
Copyright 2013, Titan Cloud Software - Confidential
The Internet of All Things
2
Copyright 2013, Titan Cloud Software - Confidential
Advanced Analytics
3
Copyright 2013, Titan Cloud Software - Confidential
Realizing Anything as a Service
4
Copyright 2013, Titan Cloud Software - Confidential
Best-of-Breed / Best-in-Class Apps • Use Cloud Technology in conjunction with other disruptive technologies/trends like IoT, Big Data, or Mobility • Allow IT to create real economic value for the business • Are assembled and integrated in a secure manner across presentation, process and data layers – enabling a custom set of Cloud Apps sourced from vendors / internal development 5
Copyright 2013, Titan Cloud Software - Confidential
COMPONENTS OF IT VALUE Focus of section
Key measures Market-level value created by adoption of widespread IT tools/techniques within the firm’s industry sector* Value delivered by IT within a firm
+ Above market-level value created by IT function’s superior ability to execute and innovate
IT productivity frontier - contribution of IT to overall productivity gains within industry sector: • Core process quality/differentiation accessible at a given cost, using common technologies and approaches (e.g., commercially available ERP software) • Continually shifting outward as new technologies and approaches are developed and widely adopted
IT economic value - returns from internal
IT performance in excess of market-level due to: • Low-cost service provision • High-impact project delivery • Innovative project identification/ funding
* Each industry sector affected by IT differently. Market-level IT performance refers to historical/expected gains in productivity due to continued evolution of IT tools, techniques, and approaches
6
STAGES OF IT ECONOMIC VALUE CREATION
Service provider
Project delivery partner
Innovator and business partner
Products / services
Low cost and reliable IT, e.g., desktop, network connection, app maint. & support
On-time, on-budget (i.e., successful) project delivery
Ideation - innovative ideas/ projects to improve productivity / performance
Sources of value
Extent to which IT charge backs are lower than external provider(s)
Potential project benefits (which typically accrue to project sponsor/investor); lower delivery costs; increased success rate
Untapped productivity improvements driven by IT and project benefits from tapping those improvements
Quantification
Benchmark IT costs and compare to marketplace
• Delivery cost: compare vs. external provider • Project success rates: compare vs. market
Add portion of project benefits where IT was principal project innovator / investor
7
QUANTIFYING IT ECONOMIC VALUE $X
ILLUSTRATIVE
Value from serving as project innovator/ investor
Value from above marketlevel performance
• By definition, average or market-level IT performance would generate zero economic value
400
775
50 250
• External markets exist for
IT products/ services allowing reasonable comparisons to determine economic value
• Largest potential 75 Low cost IT service delivery1
Improved success rate2
Reduced costs3
Project delivery
IT led productivity improvement4
Total
contribution to value occurs when IT directly creates opportunities as an innovator and/or investor
1 IT budget = $1000x, infrastructure = $500x, internal unit costs 15% lower than external market 2 IT delivers 50% of large projects successfully, market rate is 25%; with $1000x of project business case benefits at stake 3 Application development resources $150 hr vs. $200 in external market; overall app dev. budget $200x 4 IT identified, defined and co-sponsored 4 large-scale productivity improvement projects (e.g., web services, product development collaboration) resulting in $800x in net benefits; IT contributed 50% 8
DIFFICULT TRANSITION TO INNOVATOR 3. Innovator
IT economic value creation
Transition requirements:
1. Service provider
• Solid evidence of IT providing Barrier
2. Project delivery partner
efficient service • Record of successful project deliveries • Strong support from business units • Senior mgmt understanding of how IT can drive innovation
•INNOVATIONS/APPS TO PITCH
IT as a cost center
IT as enabler
Senior mgmt perception of IT value 9
Best-of-Breed / Best-in-Class Apps • Use Cloud Technology in conjunction with other disruptive technologies/trends like IoT, Big Data, or Mobility • Allow IT to create real economic value for the business • Are assembled and integrated in a secure manner across presentation, process and data layers – enabling a custom set of Cloud Apps sourced from vendors / internal development 10
Copyright 2013, Titan Cloud Software - Confidential
Start with Cloud App Platform Illustrative
Need platform from which to add and deploy Apps Cloud App Platform Document Mgmt.
IoT/SCADA/ATG Engine
11
Analytic Services
Integration Svcs
Availability: 99.99% uptime / Apdex SLA Administration: Advanced user administration, groups, roles, and privileges Access: Unlimited user across all browsers and mobile devices Secure Cloud: PCI / SAS 70 / SSAE 16 Compliant Data Center Secure Apps: OWASP audits
Copyright 2013, Titan Cloud Software - Confidential
Platform and Apps should adhere to industry standard frameworks Security Standards SAML 2.0 – secure single sign on using any secure and trusted identity provider – no vendor lock in SSL – required for all cross-customer boundary communications – 2048 bit public key minimum *AES Encryption – based on Rjindael cipher (pronounced rain-doll) – approved by NSA for encrypting classified documents *SHA-2 Hashing – passwords should be stored using salted SHA-2 hashes, never clear text and almost never with reversible encryption * never roll your own algorithm or implementation – use commercially standard and independently vetted encryption and hashing implementations Integration Standards RESTful web services – lighter and takes advantage of stateless nature of HTTP SOAP web services – heavier but traditionally more flexible SFTP – SSH File Transfer protocol for secure end-to-end encryption. Avoid unencrypted FTP. 12
Copyright 2013, Titan Cloud Software - Confidential
All Apps should have been audited for OWASP* Top 10 Risks - Good App Dev Hygiene & Arch will prevent OWASP Top Ten Risks 2013
Description
A1 - Injection
Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
A2 - Broken Authentication and Session Management
Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
A3 - Cross-Site Scripting (XSS)
XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
A4 - Insecure Direct Object References
A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
A5 - Security Misconfiguration
Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.
A6 - Sensitive Data Exposure
Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
A7 - Missing Function-Level Access Control
Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.
A8 – Cross-Site Request Forgery
A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
A9 – Using Known Vulnerable Components
Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts.
A10 – Un-validated Redirects and Forwards
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.
13
* Open Web Application Security Project (www.owasp.org)
Source/build best-in-class business Apps and add to Platform Release Detection Automator
Compliance Alarm Notifier
Important Date Tracker
ILLUSTRATIVE Flow Rate Manager
Fuel Carrier Manager
ATG Configurator SIR Connector
Cloud App Platform Document Mgmt.
IoT/SCADA/ATG Engine
Analytic Services
Integration Svcs
Testing Connector for Tanknology/Crompco, et al Maintenance Work Order Manager
14
Inspector App
Copyright 2013, Titan Cloud Software - Confidential
Flow Rate Case Study 800 Site and 300 Site Chains in California •
Data Points Gathered – Flow Rate Data (Daily or Weekly) • Gather all fuel transactions – filter out invalid and show peak flow and average flow of each fueling position • Enable notifications based on ideal thresholds – Example set threshold of 7 gallons/min - if under alarm sent based on flow rate averages/downward trends
– Nozzle Usage • Shows fueling positions not in use (bagged)
– Benefits: • • • •
15
Faster throughput enables service of more customers Remote identification of bagged nozzles or slow flow issues=lost revenue recovered Better flow = happier customers, extended customer lifetime value, higher customer loyalty Marketing can boast company has fastest flow
Copyright 2013, Titan Cloud Software - Confidential
Know Your Flow Reporting - by Site, Product, Fueling Position
Last 7 days of Daily Max FR
Weekly Max Flow Rate & Transaction Count
Slowing flow rates can be tracked/identified for filter change, etc.
No-Flow dispensers become obvious
Copyright 2013, Titan Cloud Software - Confidential
16
Receive Daily Reports Reporting - by Site, Product, Fueling Position
Repair thresholds
Weekly Max Flow Rate and Count of Transactions within profile
Red areas indicate potential equipment issues
Copyright 2013, Titan Cloud Software - Confidential
17
View Trends/History • View the history over custom timeline • Sort by daily max or daily average flow rate • View dispensers at once or by fueling position or by meter to better understand the issues
Copyright 2013, Titan Cloud Software - Confidential
18
See Root Cause/Analyze/Resolve Users can extract defect/cause data using our custom reporting tool Facility Name Circle K 1 Circle K 2 Circle K 2 Circle K 2 Circle K 2 Circle K 2 Circle K 2 Circle K 2 Circle K 2 Circle K 3 Circle K 3
State GA GA GA AL GA NC NC VA GA GA GA
Subject Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance Flow Rate Variance
Activity Type Site Investigation Site Investigation Site Investigation Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance Maintenance
Priority High High High High Medium High High High High High Medium
Defect Type Filter STP Filter Filter STP Filter STP Filter Filter STP Blending Meter
Issue Type + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance + / - Out of Tolerance
Resolution Type Filter Replacement Hardware upgrade Filter Replacement Filter Replacement Hardware upgrade Filter Replacement Hardware upgrade Filter Replacement Filter Replacement Equipment upgrade Meter upgrade
Extracted data that can be easily manipulated by Excel For example, a basic Pareto chart can be used to focus on root causes of slow/no flow in order to reduce frequency of occurrence
Copyright 2013, Titan Cloud Software - Confidential
19
Trigger Email Notifications Sample Email • Flow rate alarms generate an activity & trigger email • Emails can be sent to maintenance staff or outside vendors to for resolution • Flow rate defect/cause tracking option for use with activity module
Copyright 2013, Titan Cloud Software - Confidential
20
Flow Rate App Summary Set-up Objective: Scope:
Monitor
Detect no/slow flow exceptions, alert personnel • Configure profiles and • Email alerts activities • Monitor flow-rate to filter our false activities via positives • Set-up fueling position dashboard and data connector Set-up data connector and site profiles
Manage
Improved Customer Experience
Reduce frequency of no/slow flow exceptions • Report on sites that may need repair • Investigate root causes
Key Benefits • Limit no/slow flow customer experiences • Reduce maintenance costs • Trigger automatic meter replacement based on volume hurdle Copyright 2013, Titan Cloud Software - Confidential
21
Case Study #1 900 Site Jobber, East Coast: 450 COCOs, 450 DODOs •
Challenges Faced: – – –
•
Low visibility into site inventory levels; dispatchers making daily phone calls into facilities to get levels Reactive not proactive on compliance issues resulting in fines and risk exposure Scalability to add new dealer networks
Benefits Realized: – –
Solution: – –
Titan Cloud: FuelCloud, EnviroCloud, & FacilityCloud Suites Key Apps • • • •
22
•
Inventory/Delivery Visibility (hourly) Maintenance Work Order Management Release Detection Automation Fuel & Compliance Alarm Notification
Copyright 2013, Titan Cloud Software - Confidential
–
–
Common cloud platform for visibility and control Hourly inventory levels and delivery histories helps them better manage in-ground fuel Mitigated environmental risks & liability (prompt reception of alarms and documented resolution) More efficient work order system that better meets their needs
Case Study #2 600 Site Jobber, Northeast: 400 COCOs, 200 DODOs •
Challenges Faced: – – –
•
Environmental risks too high; paying too many fines Inefficient, undocumented facility-level inspection practices No system for effectively managing work order requests from store-level personnel Titan EnviroCloud & FacilityCloud Suites Key Apps • • •
Benefits Realized: –
– –
Solution: – –
23
•
Maintenance Work Order Management Advanced Facility Inspections Cloud E-file Manager
Copyright 2013, Titan Cloud Software - Confidential
–
Common cloud platform with multiple logins for various levels of personnel Reduced fines and mitigated environmental risks More efficient work order dispatch & vendor management system Management visibility into all locations
Case Study #3 260 Site Jobber, Midwest: 150 COCOs, 110 DODOs •
Challenges Faced: – – – –
•
Inefficient manual processes (spreadsheets) Just “getting by” with major growth challenges without a scalable solution Too many executive-hours spent on compliance (exposure too high) No central dispatch solution for work orders
Solution: – –
Titan EnviroCloud & FacilityCloud Key Apps • • • •
24
•
Maintenance Management Testing Vendor Management Important Dates Management E-file Management
Copyright 2013, Titan Cloud Software - Confidential
Benefits Realized: –
– – –
Centralized access to all compliance documents, dates, and data Single platform for work orders Flexibility to focus on core business and grow Reduced invoice cost by managing vendors more effectively
Thank You • www.titancloud.com for more information • Mark Hayes (
[email protected]), Director of Sales, 615-337-9099 • David Freese (
[email protected]), CEO
25
Copyright 2013, Titan Cloud Software - Confidential