rfid in the supply chain a guide to selection and implementation

AU3018_C000.fm Page i Monday, October 16, 2006 7:14 PM RFID in the Supply Chain A Guide to Selection and Implementation AU3018_C000.fm Page ii Monday, October 16, 2006 7:14 PM Series on Resource Management Titles in the Series Handbook of Supply Chain Management, Second Edition by James B Ayers ISBN: 0-8493-3160-9 Collaborative Manufacturing: Using Real-Time Information to Support the Supply Chain by Michael McClellan ISBN: 1-57444-341-0 The Portal to Lean Production: Principles & Practices for Doing More With Less by John Nicholas and Avi Soni ISBN: 0-8493-5031-X The Supply Chain Manager’s Problem-Solver: Maximizing the Value of Collaboration and Technology by Charles C Poirier ISBN: 1-57444-335-6 Supply Market Intelligence: A Managerial Handbook for Building Sourcing Strategies by Robert Handfield ISBN: 0-8493-2789-X The Small Manufacturer’s Toolkit: A Guide to Selecting the Techniques and Systems to Help You Win by Steve Novak ISBN: 0-8493-2883-7 Velocity Management in Logistics and Distribution: Lessons from the Military to Secure the Speed of Business by Joseph L Walden ISBN: 0-8493-2859-4 Supply Chain for Liquids: Out of the Box Approaches to Liquid Logistics by Wally Klatch ISBN: 0-8493-2853-5 Supply Chain Architecture: A Blueprint for Networking the Flow of Material, Information, and Cash by William T Walker ISBN: 1-57444-357-7 ERP: Tools, Techniques, and Applications for Integrating the Supply Chain by Carol A Ptak with Eli Schragenheim ISBN: 1-57444-358-5 Integral Logistics Management: Planning and Control of Comprehensive Supply Chains, Second Edition by Paul Schonsleben ISBN: 1-57444-355-0 Introduction to e-Supply Chain Management: Engaging Technology to Build Market-Winning Business Partnerships by David C Ross ISBN: 1-57444-324-0 Supply Chain Networks and Business Process Orientation by Kevin P McCormack and William C Johnson with William T Walker ISBN: 1-57444-327-5 Lean Performance ERP Project Management: Implementing the Virtual Supply Chain by Brian J Carroll ISBN: 1-57444-309-7 Integrated Learning for ERP Success: A Learning Requirements Planning Approach by Karl M Kapp, with William F Latham and Hester N Ford-Latham ISBN: 1-57444-296-1 Basics of Supply Chain Management by Lawrence D Fredendall and Ed Hill ISBN: 1-57444-120-5 Lean Manufacturing: Tools, Techniques, and How to Use Them by William M Feld ISBN: 1-57444-297-X Disassembly Modeling for Assembly, Maintenance, Reuse, and Recycling by A.J.D Lambert and Surendra M Gupta ISBN: 1-57444-334-8 Back to Basics: Your Guide to Manufacturing Excellence by Steven A Melnyk and R.T Chris Christensen ISBN: 1-57444-279-1 Enterprise Resource Planning and Beyond: Integrating Your Entire Organization by Gary A Langenwalter ISBN: 1-57444-260-0 Restructuring the Manufacturing Process: Applying the Matrix Method by Gideon Halevi ISBN: 1-57444-121-3 Inventory Classification Innovation: Paving the Way for Electronic Commerce and Vendor Managed Inventory by Russell G Broeckelmann ISBN: 1-57444-237-6 AU3018_C000.fm Page iii Monday, October 16, 2006 7:14 PM RFID in the Supply Chain A Guide to Selection and Implementation Judith M Myerson IT Consultant Philadelphia, Pennsylvania USA Boca Raton New York Auerbach Publications is an imprint of the Taylor & Francis Group, an informa business AU3018_C000.fm Page iv Monday, October 16, 2006 7:14 PM Auerbach Publications Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2007 by Taylor & Francis Group, LLC Auerbach is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S Government works Printed in the United States of America on acid-free paper 10 International Standard Book Number-10: 0-8493-3018-1 (Hardcover) International Standard Book Number-13: 978-0-8493-3018-6 (Hardcover) This book contains information obtained from authentic and highly regarded sources Reprinted material is quoted with permission, and sources are indicated A wide variety of references are listed Reasonable efforts have been made to publish reliable data and information, but the author and the publisher cannot assume responsibility for the validity of all materials or for the consequences of their use No part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers For permission to photocopy or use material electronically from this work, please access www copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc (CCC) 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400 CCC is a not-for-profit organization that provides licenses and registration for a variety of users For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe Library of Congress Cataloging-in-Publication Data Myerson, Judith M RFID in the supply chain : a guide to selection and implementation / Judith M Myerson p cm Includes bibliographical references and index ISBN 0-8493-3018-1 Inventory control Automation Radio frequency identification systems I Title TS160.R43 2006 658.7’87 dc22 Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the Auerbach Web site at http://www.auerbach-publications.com 2006045675 AU3018_C000.fm Page v Monday, October 16, 2006 7:14 PM TABLE OF CONTENTS Tables xvii Figures xix Preface xxi Supply Chain Overview 1.1 Paradigm Shift in Product Traceability 1.1.1 Transitioning to RFID Technology 1.1.2 Tracking Problems 1.1.3 Supply Chain 1.2 RFID Markets 1.3 Economic Feasibility of Rolling Out RFID 1.3.1 Supply Chain Synchronization 1.3.2 Customer Privacy Issues 1.3.3 Security Challenges 1.3.4 Operational and IT Challenges (Hardware, Software, System Compatibility, People Expertise) 1.3.5 Logistical Challenges 1.3.6 Program Management Challenges 1.3.7 Education and Training 1.3.8 Standard Implementation Challenges 1.3.9 Lessons Learned 1.3.9.1 Iraq: Asset Visibility 1.3.9.2 Wal-Mart: Implementation Training 1.3.9.3 International Paper: Business Processes 1.3.9.4 Procter & Gamble: Docking Loading Throughput 1.4 RFID Technology Infrastructure 1.4.1 Open Architecture: Savant Server 1.4.2 Major Vendor Servers 1.4.3 Tags 1.4.4 Antennas 1.4.5 Readers 1.4.6 Electronic Product Code 1.4.7 Object Name Service 1.4.8 EPC Information Service 12 15 16 16 17 17 18 19 19 20 20 20 23 23 23 24 24 26 27 29 30 31 33 34 v AU3018_C000.fm Page vi Monday, October 16, 2006 7:14 PM vi Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation 1.4.9 Scenarios 1.5 Web-Centric Supply Chain Management Challenges 1.5.1 Combining Web-Centric with RFID Technology 1.5.2 E-Business Applications 1.5.3 Advantages and Disadvantages References RFID Technology 39 2.1 Primary Drivers 2.1.1 RFID Technology Deployment 2.1.2 RFID Technology: Basics, Advantages, and Disadvantages 2.2 Selection Guidance on Tags, Servers, and Middleware 2.2.1 EPC Tag Classes 2.2.2 ISO Standards 2.2.3 RFID Device Selection Criteria 2.2.3.1 What Are the Objects to Be Tagged? 2.2.3.2 What Are the Materials of the Objects and How Do They Affect Reading Ranges? 2.2.3.3 What Are Chip Antenna Types? 2.2.3.4 What Readers Can Read Both Passive and Active Tags? 2.2.3.5 What Are Other Considerations that Could Affect Externally the Optimal Location of Tags? 2.2.3.6 What Readers Can Read Both RFID Tags and Bar Codes for Easy Transitioning? 2.2.3.7 How Do Various Entities Organize Frequency Types or Ranges? 2.2.3.8 What Standards Are the Vendors Using for Their RFID Products? 2.2.4 Middleware Selection Criteria 2.2.4.1 RFID Plug-and-Play 2.2.4.2 RFID Supply Chain Execution Applications 2.2.4.3 RFID Platform-Dependent Legacy Systems 2.2.4.4 RFID Integration Hubs 2.3 RFID Implementation Examples References 35 36 36 36 37 38 39 39 43 46 47 48 50 50 51 53 55 56 56 57 60 60 61 62 64 67 68 73 RFID Applications in Supply Chain Management 75 3.1 Logistics 3.1.1 SCM Logistics Maturity Model 3.1.2 Logistics: Reactive, Proactive, and RFID 3.2 Management 3.2.1 Oracle–PeopleSoft 3.2.2 Microsoft RFID Council 3.2.3 IBM 3.2.4 The METRO Group Future Store 3.2.4.1 Inventory Management 3.2.4.2 Information Management 3.2.4.3 Check-Out 75 77 79 82 82 83 84 85 86 86 87 AU3018_C000.fm Page vii Monday, October 16, 2006 7:14 PM Ⅲ vii Table of Contents 3.2.5 3.2.6 3.2.7 Chain Pharmacy Operations SAP Web Services 3.2.7.1 Object Name Service 3.2.7.2 EPC Information Service 3.2.7.3 Electronic Product Code 3.2.7.4 Savant Servers 3.2.7.5 EPCglobal and the Auto-ID Center References 88 89 91 93 93 95 96 97 100 Storing and Retrieving Data 101 4.1 Two Big Questions 101 4.1.1 Relationship between Data Storage and Retrieval Issues 101 4.1.2 Understanding Risks Associated with RFID/EPC Technologies 102 4.2 EPC Technology in Functional Areas 103 4.3 Perceptions of Product Benefits 103 4.4 Database CD on Local Workstation 105 4.5 Remote Database Servers 106 4.5.1 How Can We Reduce the Number of Traffic Bottleneck Incidents? 107 4.5.2 Why Do We Need to Divide the Database into the Static and Dynamic Partitions? 108 4.5.3 What Kind of Database Management Should We Get to Satisfy Our Requirements? 108 4.5.4 What Is the Optimal Way of Increasing Throughputs and Operational Efficiency? 109 4.5.4.1 Peoplesoft Enterprise Systems 110 4.5.4.2 IBM RFID Product 110 4.5.5 How Do We Reduce Loading Times Cost Effectively? 111 4.5.6 How Do We Migrate a Relational Database Management System to Another? 112 4.5.7 How Is Partitioning Emulated and What Are the Partitioning Types? 112 4.5.8 How Do You Determine the Number of Partitions for a Database? 115 4.5.9 What Are the Factors You Should Consider in Your Migration Planning? 116 4.6 Databases in Company Merger Processes 117 4.7 Hybrid Databases 117 4.8 Web Services 118 References 120 RFID Business Processes 121 5.1 Implementation Approaches 5.1.1 Dual Shipping Faces 5.1.2 Two Sides of the Mandates 5.1.3 RFID Implementation Checklist 122 123 124 124 AU3018_C000.fm Page viii Monday, October 16, 2006 7:14 PM viii Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation 5.2 Business Process Reengineering 5.2.1 Procter & Gamble: Dock Loading Throughput 5.2.2 Canus: Changing Antenna’s Orientation 5.2.3 Unilever: Changing Tag Placement 5.2.4 Heinz: Adapting Tag Requirements 5.2.5 Gillette Scenario: Misplaced Case 5.2.6 Canus: Adjusting Computer Speed 5.2.7 Software Checklist 5.3 Organizational Maturity 5.4 Basic Multi-Layer RFID Business Process Model 5.5 Adaptive Multi-Layer RFID Business Process Model 5.5.1 Adaptive Maturity 5.5.2 Application Adaptors 5.5.3 The METRO Group 5.6 Predictive Multi-Layer Business Process Model 5.7 RFID Business Processes Strategy 5.7.1 IBM RFID Strategy 5.7.2 Heinz RFID Strategy 5.7.3 Canus RFID Strategy 5.7.4 International Paper RFID Strategy 5.7.5 Kayser-Roth RFID Strategy 5.7.6 Philips Semiconductors RFID Strategy 5.7.7 Intel RFID Strategy 5.7.8 Unilever RFID Strategy 5.7.9 Major Clothier Retailer RFID Strategy 5.7.10 Marks and Spencer RFID Strategy 5.8 RFID Enterprise Supply Chain Systems 5.8.1 Supply Chain Planning 5.8.2 Supply Chain Execution 5.8.3 Supply Chain Management 5.8.3.1 SCM Logistics 5.8.3.2 SCM Management 5.9 RFID Business Process Life Cycle 5.9.1 Older Life-Cycle Models 5.9.1.1 Waterfall Life Cycle 5.9.1.2 Incremental Life Cycle 5.9.1.3 Spiral Life Cycle 5.9.2 Newer Life-Cycle Models 5.9.2.1 Adaptive Linear Feedback Life Cycle 5.9.2.2 Adaptive Dynamic Life Cycle References 126 127 128 128 128 129 131 131 132 135 136 137 138 139 140 143 143 144 144 145 145 146 148 149 149 149 150 150 151 153 153 155 156 158 158 159 161 162 162 162 163 RFID Security, Privacy, and Risk Assessment 165 6.1 Security Policy 6.1.1 Organizational Policy 6.1.2 Issue-Specific Policy 6.1.3 System-Specific Policy 165 166 166 167 AU3018_C000.fm Page ix Monday, October 16, 2006 7:14 PM Ⅲ ix Table of Contents 6.2 Security of RFID Query 6.2.1 Query Scenario 6.2.2 Security Problems 6.3 Attacks on RFID Technology 6.3.1 War-Walking and Lifting 6.3.2 Counterfeiting 6.3.3 Denial-of-Service 6.3.4 Weak Cryptography 6.4 Defense in Depth 6.5 Risk Assessment 6.5.1 Risk Assessment Profile 6.5.2 Internal Asset Risk Assessment 6.5.3 Risk Assessment Service References 168 168 169 170 170 172 173 173 176 177 178 178 182 183 Appendix A Passive RFID Technology 185 A.1 Avonwood (http://www.avonwood.com) A.1.1 Eureka 111 Systems A.1.2 Eureka 211 Systems A.2 Escort Memory Systems (http://www.ems-rfid.com/) A.2.1 HMS Passive Read/Write Systems A.2.1.1 HMS100 Series Passive Read/WriteTags A.2.1.2 HMS800 Series Passive Reader/Writers A.2.1.3 HMS827 Series Passive Reader/Writer A.2.1.4 HMS828 Series Passive Reader/Writer A.2.1.5 HMS820-04/HMS830-04 Series Passive Conveyor Reader/Writers A.2.1.6 HMS820-08/HMS830-08 Series Passive Wide-Plate Reader/Writers A.2.1.7 HMS820/HMS830 Passive Reader/Writers A.2.1.8 HMS827-04 Passive Conveyor Reader/Writer A.2.1.9 HMS827-05 Passive Tubular Reader/Writer A.2.1.10 HMS814/HMS816 Portable Reader/Writers A.2.2 Passive Read-Only Systems A.2.2.1 ES600-Series Read-Only Tags A.2.2.2 RS427 Read-Only Reader A.2.2.3 RS427-04 Passive Read-Only Conveyor Antenna A.3 Intermec (www.intermec.com) A.3.1 RFID Tags and Inserts A.3.2 RFID Readers A.3.3 Intellitag PM4i Printer A.3.4 RFID Partners A.4 Northern Apex (www.northernapex-rfid.com) A.4.1 Inlays and Tags A.4.2 Readers and Antennas A.4.2.1 900-MHz Readers and Antennas A.4.2.2 13.56-MHz Readers and Antennas 185 185 185 186 186 186 186 186 187 187 187 187 188 188 188 188 189 189 189 189 189 191 194 195 195 195 197 197 198 AU3018_A017.fm Page 413 Friday, September 29, 2006 2:27 PM Sample Security Policy Templates Ⅲ 413 Q.12.2 Scope All routers and switches connected to production networks are affected Routers and switches within internal, secured labs are not affected Routers and switches within DMZ areas fall under the Internet DMZ Equipment Policy Q.12.3 Policy Every router must meet the following configuration standards No local user accounts are configured on the router Routers must use TACACS+ for all user authentication The enable password on the router must be kept in a secure encrypted form The router must have the enable password set to the current production router password from the router’s support organization Disallow the following: a IP directed broadcasts b Incoming packets at the router sourced with invalid addresses such as RFC1918 address c TCP small services d UDP small services e All source routing f All Web services running on router Use corporate standardized SNMP community strings Access rules are to be added as business needs arise The router must be included in the corporate enterprise management system with a designated point of contact Each router must have the following statement posted in clear view: “UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED You must have explicit permission to access or configure this device All activities performed on this device may be logged, and violations of this policy may result in disciplinary action, and may be reported to law enforcement There is no right to privacy on this device.” Q.12.4 Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment AU3018_A017.fm Page 414 Friday, September 29, 2006 2:27 PM 414 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation Q.12.5 Definitions Production Network Lab Network The “production network” is the network used in the daily business of Any network connected to the corporate backbone, either directly or indirectly, which lacks an intervening firewall device Any network whose impairment would result in direct loss of functionality to employees or impact their ability to work A “lab network” is defined as any network used for the purposes of testing, demonstrations, training, etc Any network that is stand-alone or firewalled off from the production network(s) and whose impairment will not cause direct loss to nor affect the production network Q.13 SERVER SECURITY POLICY Abstract: Defines standards for minimal security configuration for servers inside the organization’s production network, or used in a production capacity Q.13.1 Purpose The purpose of this policy is to establish standards for the base configuration of internal server equipment that is owned or operated by Effective implementation of this policy will minimize unauthorized access to proprietary information and technology Q.13.2 Scope This policy applies to server equipment owned or operated by , and to servers registered under any -owned internal network domain This policy is specifically for equipment on the internal network For secure configuration of equipment external to on the DMZ, refer to the Internet DMZ Equipment Policy Q.13.3 Policy Q.13.3.1 Ownership and Responsibilities All internal servers deployed at must be owned by an operational group that is responsible for system administration Approved AU3018_A017.fm Page 415 Friday, September 29, 2006 2:27 PM Sample Security Policy Templates Ⅲ 415 server configuration guides must be established and maintained by each operational group, based on business needs and approved by InfoSec Operational groups should monitor configuration compliance and implement an exception policy tailored to their environment Each operational group must establish a process for changing the configuration guides, which includes review and approval by InfoSec Ⅲ Servers must be registered within the corporate enterprise management system At a minimum, the following information is required to positively identify the point of contact: Ⅲ Server contact(s) and location, and a backup contact Ⅲ Hardware and Operating System/Version Ⅲ Main functions and applications, if applicable Ⅲ Information in the corporate enterprise management system must be kept up-to-date Ⅲ Configuration changes for production servers must follow the appropriate change management procedures Q.13.3.2 General Configuration Guidelines Ⅲ Operating System configuration should be in accordance with approved InfoSec guidelines Ⅲ Services and applications that will not be used must be disabled where practical Ⅲ Access to services should be logged or protected through accesscontrol methods such as TCP Wrappers, if possible Ⅲ The most recent security patches must be installed on the system as soon as practical, the only exception being when immediate application would interfere with business requirements Ⅲ Trust relationships between systems are a security risk, and their use should be avoided Do not use a trust relationship when some other method of communication will Ⅲ Always use standard security principles of least required access to perform a function Ⅲ Do not use root when a nonprivileged account will Ⅲ If a methodology for secure channel connection is available (i.e., technically feasible), privileged access must be performed over secure channels, (e.g., encrypted network connections using SSH or IPSec) Ⅲ Servers should be physically located in an access-controlled environment Ⅲ Servers are specifically prohibited from operating from uncontrolled cubicle areas AU3018_A017.fm Page 416 Friday, September 29, 2006 2:27 PM 416 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation Q.13.3.3 Monitoring All security-related events on critical or sensitive systems must be logged and audit trails saved as follows: Ⅲ All security related logs will be kept online for a minimum of one week Ⅲ Daily incremental tape backups will be retained for at least one month Ⅲ Weekly full tape backups of logs will be retained for at least one month Ⅲ Monthly full backups will be retained for a minimum of two years Security-related events will be reported to InfoSec, who will review logs and report incidents to IT management Corrective measures will be prescribed as needed Security-related events include, but are not limited to: Ⅲ Port-scan attacks Ⅲ Evidence of unauthorized access to privileged accounts Ⅲ Anomalous occurrences that are not related to specific applications on the host Q.13.3.4 Compliance Ⅲ Audits will be performed on a regular basis by authorized organizations within Ⅲ Audits will be managed by the internal audit group or InfoSec, in accordance with the Audit Policy InfoSec will filter findings not related to a specific operational group and then present the findings to the appropriate support staff for remediation or justification Ⅲ Every effort will be made to prevent audits from causing operational failures or disruptions Q.13.4 Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment Q.13.5 Definitions DMZ Server De-Militarized Zone A network segment external to the corporate production network For purposes of this policy, a Server is defined as an internal Server Desktop machines and Lab equipment are not relevant to the scope of this policy AU3018_A017.fm Page 417 Friday, September 29, 2006 2:27 PM Sample Security Policy Templates Ⅲ 417 Q.14 VIRTUAL PRIVATE NETWORK (VPN) POLICY Abstract: Defines the requirements for Remote Access IPSec or L2TP Virtual Private Network (VPN) connections to the organization’s network Q.14.1 Purpose The purpose of this policy is to provide guidelines for Remote Access IPSec or L2TP Virtual Private Network (VPN) connections to the corporate network Q.14.2 Scope This policy applies to all employees, contractors, consultants, temporaries, and other workers including all personnel affiliated with third parties utilizing VPNs to access the network This policy applies to implementations of VPN that are directed through an IPSec Concentrator Q.14.3 Policy Approved employees and authorized third parties (customers, vendors, etc.) may utilize the benefits of VPNs, which are a “user managed” service This means that the user is responsible for selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and paying associated fees Further details may be found in the Remote Access Policy In addition, It is the responsibility of employees with VPN privileges to ensure that unauthorized users are not allowed access to internal networks VPN use is to be controlled using either a one-time password authentication such as a token device or a public/private key system with a strong passphrase When actively connected to the corporate network, VPNs will force all traffic to and from the PC over the VPN tunnel: all other traffic will be dropped Dual (split) tunneling is not permitted; only one network connection is allowed VPN gateways will be set up and managed by network operational groups AU3018_A017.fm Page 418 Friday, September 29, 2006 2:27 PM 418 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation All computers connected to internal networks via VPN or any other technology must use the most up-to-date anti-virus software that is the corporate standard (provide URL to this software); this includes personal computers VPN users will be automatically disconnected from ’s network after thirty minutes of inactivity The user must then logon again to reconnect to the network Pings or other artificial network processes are not to be used to keep the connection open The VPN concentrator is limited to an absolute connection time of 24 hours Users of computers that are not -owned equipment must configure the equipment to comply with ’s VPN and Network policies 10 Only InfoSec-approved VPN clients may be used 11 By using VPN technology with personal equipment, users must understand that their machines are a de facto extension of ’s network, and as such are subject to the same rules and regulations that apply to -owned equipment; that is, their machines must be configured to comply with InfoSec’s Security Policies Q.14.4 Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment Q.14.5 Definitions IPSec Concentrator A device in which VPN connections are terminated Q.15 WIRELESS COMMUNICATION POLICY Abstract: Defines standards for wireless systems used to connect to the organization’s networks Q.15.1 Purpose This policy prohibits access to networks via unsecured wireless communication mechanisms Only wireless systems that meet the criteria of this policy or have been granted an exclusive waiver by InfoSec are approved for connectivity to ’s networks AU3018_A017.fm Page 419 Friday, September 29, 2006 2:27 PM Sample Security Policy Templates Ⅲ 419 Q.15.2 Scope This policy covers all wireless data communication devices (e.g., personal computers, cellular phones, PDAs, etc.) connected to any of ’s internal networks This includes any form of wireless communication device capable of transmitting packet data Wireless devices or networks without any connectivity to ’s networks not fall under the purview of this policy Q.15.3 Policy Q.15.3.1 Register Access Points and Cards All wireless Access Points/Base Stations connected to the corporate network must be registered and approved by InfoSec These Access Points/Base Stations are subject to periodic penetration tests and audits All wireless Network Interface Cards (i.e., PC cards) used in corporate laptop or desktop computers must be registered with InfoSec Q.15.3.2 Approved Technology All wireless LAN access must use corporate-approved vendor products and security configurations Q.15.3.3 VPN Encryption and Authentication All computers with wireless LAN devices must utilize a corporate-approved Virtual Private Network (VPN) configured to drop all unauthenticated and unencrypted traffic To comply with this policy, wireless implementations must maintain point to point hardware encryption of at least 56 bits All implementations must support a hardware address that can be registered and tracked (i.e., a MAC address) All implementations must support and employ strong user authentication which checks against an external database such as TACACS+, RADIUS, or something similar Q.15.3.4 Setting the SSID The SSID shall be configured so that it does not contain any identifying information about the organization, such as the company name, division title, employee name, or product identifier Q.15.4 Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment AU3018_A017.fm Page 420 Friday, September 29, 2006 2:27 PM 420 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation Q.15.5 Definitions User AuthenticationA method by which the user of a wireless system can be verified as a legitimate user independent of the computer or operating system being used Q.15.6 Revision History July 10, 2003, Section 3.4 Added July 6, 2003, expanded to support CDI Initiative AU3018_C007 index.fm Page 421 Friday, October 13, 2006 3:04 AM INDEX network level, 126, 131 object hierarchy, 157 organizational maturity, 132 package level, 126 site level, 127 13.56 MHz, 42, 59, 185 802.11, 195, 202 A antenna adjusting positions, 145 conveyor, 29, 53, 186 docking door, 70 dual, 53–54, 202 geographical zone, 45 improper positioning, 30, 45 orientation, 5, 29 perpendicular, 4, 30 ports, 193–194 random orientation, disadvantages, 5, 29 reading area limits, 70 anti-collision, 200, 206 arranging cases odd vs even, 51 problems, 51 B backup site, 114 Backscatter, 253–254 bandwidths loading times, 111 mixing, 120 battery, paper-thin, 246, 255 Bayes theorem, 365 blocking transmitter in a cat, 173 business process reengineering C Capability Maturity Model, 41, 370 cable, 107 coaxial, 199 antenna, 209 CERT advisories, 182 chicken spoiled, 45, 110 temperature changes, 109 chips memory size, 44 voltage threshold, 44 circuitry insufficient power, 175 thermostat, 144 Class 1, Gen2, 202 close-loop system, 134 COMPTIA RFID+ certification, 20 concerns business executives, 75 database migration, 112 IT executives, 75 configuration European Telecommunications Standards Institute, 247 FCC, 247 See Elliptic Curve Cryptography container tag, 52, 190, 194 conveyance units active and passive, 4, 55 white noise, 51, 55–56 conveyors, 55–56, 186–199 antenna, 29, 53, 186 verification and tracking, 290 421 AU3018_C007 index.fm Page 422 Friday, October 13, 2006 3:04 AM 422 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation corporate spy, 17, 171 cost/benefit analyses, 15 cryptography active tags, security, 170 defense-in-depth, 176 minimalist, 173 pseudonym throttling, 175 weak, risks of, 176 cyber-attacker, 130 D data requirements, 47, 116, 260 database performance loading times, remote, 111 RAID and filegroup options, 113 database physical design, 114 deployment METRO Group, 27, 40, 82, 110, 155 Target, 41, 98, 121, 133 digital signature, 173 dipole, 191, 195 dual shipping faces, 123 E EAI, loosely vs tightly coupled, 118 electromagnetic fog, 173 Elliptic Curve Cryptography, 173 EPC 64-bits, three versions, 33 other bit codes, 33 partitions, 95 EPC Information Services PML, 93 See Physical Markup Language Middleware, 62 EPC number, not properly recorded, 130 EPC-compliant, 60, 64, 71, 149 EPCglobal members, 98 eTrust Internet Defense, 183 G-H gray market, 130 harsh manufacturing environment, 190 hierarchy of objects, 157 high carbon content, 51 hybrid reader, 30, 45 I IBM DB2 for SAP, 27, 117 DB2 UDB, 114 Department of Defense, 178 label placements, 129, 144 Emerging Technologies Toolkit, 94 METRO Group, 27, 69, 110 Oracle/PeopleSoft, 27, 117 SAP customer, 117 Sensor and Actuator Solutions, 66 WebSphere® Adapters, 360 idle items, 129 iMotion, Device Emulator, 145 impedance, 208–209, 237 inductive link, 248 incremental models, risk management, 160 interference problem, bundling products, 51 interview findings, 102 investments in infrastructure, 41 ISO 15693, 48, 185, 199–207, 231–239 15961, 60 18000, 48, 228–248 18185, 60 22389, 60 item exception, 348 falling out of truck, 110 security, 348, 351 unavailability, 348 return reasons, 78 F L firewall security standards, 181 weak spots, 179 fluidic self-assembly, 41 forecasting methods, 304 FoxMeyer Drug, bankruptcy, 89 frequency bands, de facto, 59 interference, liquids, 128, 149 Future Store, 82–87, 139, 155 lithium ion, 193, 220 load balancing, 119 loading dock, 247 forklift truck drivers, 7, 23, 71, 127 resolving bottlenecks, loading times, remote database, 111 log resource management, 344 logistics maturity high, 78 low, 78 loosely coupled, 134 AU3018_C007 index.fm Page 423 Friday, October 13, 2006 3:04 AM Index Ⅲ 423 M P map flags military application RFID-based items, 111 temperature changes, 111 metrics, 91, 156 measured limits, logistics visibility, 78, 154 Medicare cuts, 80 maturity factor, 91, 156 METRO Group, 40, 82–89, 140, 155 first retailer in rolling out, 68 Future Initiative, 86 hybrid technology, 57 IBM, 69 maturity, 139 migration issues, 112 planning, 107, 116 minimum voltage threshold, 44 microwave, 189 model Capability Maturity, 41 linearity, 159 SCM Logistics Maturity, 76, 153, 159 statistical, 304, 371 monitoring sensor, 253 multidrop interface, 187, 189 multiple customers, 11, 121 multiple tables, vertical partitioning, 113 multi-protocol, 191, 201, 207, 248 multi-tag sort, 192 Palm OS, 198–199, 218 partitioning generating ROIs, 113 increasing throughputs, 114 multiple tablespaces, 114 vertical, 113 partitions EPC, 95 number of, 107 overflowing and reorganizing, 115 static and dynamic, 106 time-related, 347–348 password 64-bit, 170, 176 protection policy, 167 PCMCIA, 193 performance, remote database, 111 Physical Markup Language, 93 PKI, 173, 176–177 PML examples, 35, 94 Pocket PC, 192–199, 219–230 policies, confusing, 174 privacy issues, 16 N-O normalization, vertical partitioning See row splitting, 113 OASIS standards, 36 offending materials 3, 27–30, 61, 72–73, 121 13.56 MHz vs lower-frequency, 42 detune or attenuate tag signals, OLAP, 114, 314, 317, 370 operational requirements database physical design, 114 optimal reads, factors of, 30 Oracle, combining tags with sensors, 67 organizational maturity adaptive RFID technology, 156 business process reengineering, 132 culture, 89–90 Q-R query parallelism, 115 RAID, 113 readers four types, 30 hybrid, 30, 45, 55–57 METRO Group, 57 multi-protocol, multi-frequency, 55 strategic points, 5, 31 reasons for item returns, 78 refrigeration breakdown, 45 regulatory compliance, 365 reshipping items, 129 RFID active tags, cryptography, 170 advantages, attacks, 170 benefits, 138 consumer item-level tracking, 71, 149 database middleware, 108 data on spoiled chicken, 109 denial-of-service, 173 differences from bar-code scanner, drastic temperature changes, 111 early implementation, 66 electromagnetic fog, 173 emulating tag read speed, 145 AU3018_C007 index.fm Page 424 Friday, October 13, 2006 3:04 AM 424 Ⅲ RFID in the Supply Chain: A Guide to Selection and Implementation event alert, 12 fewer insurance claims, 127 forklift truck drivers, 7, 23, 71, 127 IBM, 27, 110 idle items, 129 implementation approaches, 156 infrastructure in hospitals, 81 jamming radio signals, 173 limited real-time recalls, 128 linking with Web services, 91 nested tags, 90 passive, when appropriate, programmability, 43 quality of input readers, 18, 30, 70, 131, 144 real-time recovery, 128 reshipping, 129 reusable smart labels, 71, 149 scanner-equipped cell phones, scanning on conveyors, 290 sensor-based services, 26, 108 service attributes, 178 standard types, 20 tag and ship approach, 124 tag deactivation, 16 tag vulnerability, 170 tracking physical movement, unsecured tags, 169 Visual Device Emulator, 145 voluntary compliance, 141 Web services, RIED, 25, 97 risks separated items, 110 contributing factors, 102 incremental models, 160 ROI partitioning types, 113 risk mitigation, 369 time-value, 15 row splitting, vertical partitioning, 113 RS232, 26, 44, 186–189 RS422, 194, 207–208 RS485, 26, 187–189, 197 S safety, 353 SANS, 377 SAP IBM customer, 117 RFID application, 64, 152 scanner-equipped cell phones, SCE applications major players, 63, 151 SCM Logistics Maturity Model, 76, 153, 159 sensor monitoring, 253 temperature, 44–45 sensor-based services Oracle, 26–27, 83, 108, 109 RFID technology, 26, 108 servers three Savant modules, 97 sleep/wake commands, 174–175 smart labels, 66, 71, 149, 189 smart shelves, 8, 75, 82, 87 solid state, 187, 197, 203 spiral models sidetracking difficult problems, 162 statistical models, 304, 371 T tags active, weaker signal, 45 add-on memory, 59 amount of data, 3, 6, 27 anti-theft deterrance, 44 awakened, 174 chip to sleep, 174 classes, 24, 28, 38, 47 incorporating ISO standards, 60 migrating to EPC, 60 combining with sensors, 67 counterfeiting, 172 detune or attenuate signals, digital signature, 173 dual antenna, read-only, 29 ECC-enabled, 175 high carbon content, 51 interior case wall, 56 memory size, 3, 6, 27 metal beams in warehouse, 52 nested, 90 one antenna, read-only, 29 optimal tag location, 50 PKI, 173 product shape and size, 51, 70, 126 refrigeration breakdown, 45 sawing or etching, 17, 171 security stamp, 173 sending an alert, 45 shape and size of the product, 128, 149 smart appliances, 174 storage capacity, 43 testing reading ranges, 53 AU3018_C007 index.fm Page 425 Friday, October 13, 2006 3:04 AM Index Ⅲ 425 two-active, 59 unsecured, 169 user privileges, very short range passive, 59 vulnerability to alteration, 170 when they work, 3, 27 wrong data, 128, 149 Target, 41, 98, 121, 133 technology maturity, 134 temperature drastic changes, 27, 44, 111, 249 high, 109, 186, 197, 206 sensor, 44–45 thermostat circuitry, 144 threshold, minimum voltage, 44 Threshold reporting, 344 throughputs docking loading problem, 68 benchmarks for partitioning, 114 tightly-coupled, 118 time-related partitions, 347–348 time-value ROI, 15 tradeoffs, 47, 63, 151 traffic bottlenecks, 89, 105, 120 transponder, abstract, 260 triggering alert event, 118 U-W U.S Federal Drug Administration, 84 uncertainty, 84 vertical partitioning, examples 113 voluntary compliance, 141 war driving, wireless LAN driving, 170 warehouse items falling off, 109 metal of a lift truck, 56 problems with metal beams, 52 separated items, 111 Warehouse Management System, 12, 62, 151, 289–303 war-driving, 170 war-walking, 17, 171 waterfall models, risk management, 160 Wide-Plate Reader, 186–187 Win CE, 57, 66, 83, 19 wireless LAN driving See war-driving AU3018_C007 index.fm Page 426 Friday, October 13, 2006 3:04 AM ... labor intensive to analyze a huge base of information about and in the files and databases, collect a portion of the needed data in a standard format, and analyze data in logging files, just to. .. standards organizations contributing to the RFID standards are EPCglobal Inc., International Standards Organization (ISO), and the American National Standards Institute (ANSI) However, the nature... you place the products in a shopping cart in a random orientation, the reader may or may not be able to read all the tags in the cart The antenna orientation in some tags may interfere with the