Focusing on patient-centered care

The health insurer CSS focuses on patient-oriented care and invests in the start-up "Heartbeat Medical". With this solution, the insurance company wants to define and measure the quality of treatment more precisely. Quality is also to be given greater consideration and rewarded in contracts with hospitals.

Higher quality of medical treatments and more patient-oriented care: This is what CSS is aiming for with its participation in the start-up "Heartbeat Medical". (Image: Pixabay.com)

As CSS itself emphasizes, high-quality and cost-effective healthcare is an important concern for the company. That's why Switzerland's largest basic insurer has been investing in digital start-ups for a year and a half. CSS has now invested in four companies and is now also investing in Heartbeat Medical. This start-up operates a platform that links automated patient surveys with clinical data. Therapy successes thus become measurable and the patients' quality of life moves into the focus of decision-making and treatment. In other words, it's all about more patient-centered care.

Data as a basis for decision-making

Heartbeat Medical's patient-centered surveys are based on the system of so-called "Patient-Reported Outcome Measures" (PROMs). PROMs measure how a patient assesses his or her own state of health and at the same time show the effect of a treatment. Standardized questionnaires are used to digitally record information on quality of life, symptoms or treatment effects before and after an intervention. Medical specialists document additional information from the medical history and supplement it with further clinical data. This makes it possible to compare and measure the patient's perceived state of health during or after treatment. On this data-based foundation, the medical professionals then define the further treatment path together with the patients. More than 30 Swiss hospitals - including the Inselspital Bern - already use the Heartbeat Medical platform, which is registered as a medical device.

Quality-oriented remuneration and patient-centered care in lockstep

The data-based care pathway not only provides measurable outcomes and improved quality of life for patients. The improved quality of care can also have a dampening effect on healthcare costs. CSS also wants to place quality more at the center of treatment and create incentives for its remuneration. The largest basic insurer is working towards the goal of qualitative reimbursement systems with various initiatives. In addition to PROMs, these include the Value Based Health Care approach and the Patient Empowerment Initiative pilot project: CSS, SWICA, PwC, Basel University Hospital and Winterthur Cantonal Hospital are developing a tariff system based on treatment quality and patient benefit. The incentives are set in such a way that hospitals are rewarded for increasing satisfaction and a decreasing number of interventions. 

Source and further information: www.css.ch

ServiceNow publishes Global Impact Report 2022

In 2021, ServiceNow used 100% of renewable electricity and achieved carbon neutrality. Executive compensation was linked to environmental as well as diversity goals, and in 2022, the company will follow up by providing a carbon-neutral cloud for customers. All of this can be seen in ServiceNow's just-released Global Impact Report 2022.

With its Global Impact Report, the company ServiceNow presents its progress on ESG issues. (Image: ServiceNow)

ServiceNow (NYSE: NOW), a company specializing in digital workflows that improve the workplace, recently released its second Global Impact report. According to the report, for the year 2022, ServiceNow has made significant progress in the areas of Environment, society and corporate governance (ESG) made further progress compared to the previous year. "ServiceNow is committed to using the resources of its employees and platform to help the planet and increase equity. At the same time, the company wants to act with integrity and be a catalyst for other organizations pursuing their own ESG goals," said Gina Mastantuono, CFO of ServiceNow. "My role is to ensure that ESG permeates our strategy, our decision-making, as well as our culture. In times of change, challenges and opportunities, we must model responsible corporate governance now and in the decades to come."

In 2021, the software company said it made progress in supporting customers with digital tools to make it easier for them to work in the complex ESG landscape. In 2022, the software company aims to deliver a carbon neutral cloud to its customers. With this commitment, all applications on the ServiceNow platform will be carbon neutral, according to the statement. 

ESG progress accelerated

The Global Impact Report 2022 lists some highlights from the past year. For example, the following milestones were achieved in 2021:

  • Launch of an integrated ESG Command Center solution, including the ESG Management product, to help customers achieve their ESG goals.
  • Use of 100% renewable electricity, achieving carbon neutrality, and approval of ServiceNow's near-term science-based targets through the Science Based Targets Initiative (SBTi).
  • Commitment to "Net Zero" by 2030
  • Linking executive compensation to environmental and diversity goals
  • Develop a new employee value proposition (the "People Pact") that aligns the company's people strategy with its business strategy
  • Systematic wage equality
  • Progress in diversity representation in leadership positions (directors and above).
  • Complete distribution of $100 million equity fund based on ServiceNow's origins in 10 regions across the U.S.
  • Allocation of more than $10 million in cash donations to the community (grants, corporate grants, and rewards)
  • Tripling employee participation in volunteerism
  • Developing an EU-based solution for customers who prefer to have their EU-hosted data processed within EU borders
  • Achieving an average uptime of 99.995%

foresight  

ServiceNow remains committed to increasing its global impact and addressing the challenges and opportunities of the future, the company says. According to the Global Impact Report 2022, in addition to providing a carbon neutral cloud, the company plans to do the following:

  • Develop roadmap for near-term SBTi goals for 2026, with particular focus on supply chain engagement and responsible sourcing
  • Finalize a two-year, $1 million commitment to support decarbonization through nonprofit partnerships
  • Deliver a new, enterprise-wide strategic workforce plan and site strategy that focuses on underserved communities and builds a solid foundation for growth and scale
  • Delivering a new, global framework for diversity, equity and inclusion, and amplifying impact in and through ServiceNow's business
  • Accelerate ServiceNow's impact for the community by increasing corporate giving, employee volunteerism and participation in giving, and scaling the NextGen Professionals digital skills program

Background information on the Global Impact Report

ServiceNow's voluntary ESG reporting is aligned with the Global Reporting Initiative (GRI) and Sustainability Accounting Standards Board (SASB) standards for software and IT services. ServiceNow also aligns with the Taskforce on Climate-related Financial Disclosure (TCFD) and the UN Sustainable Development Goals (UN SDGs). The company's greenhouse gas (GHG) emissions, purchased and generated renewable energy, purchased carbon offsets, and net emissions were verified by Apex, a third party, in accordance with ISO 14064-3.

Source and further information: ServiceNow

Economic crime: It's not just cyberattacks

According to PwC's Global Economic Crime and Fraud Survey 2022, 46 % of companies reported being victims of fraud, corruption or other economic crimes in the past two years.

Economic crimes have different faces: Hackers account for "only" 31 percent of attackers, but there are many other actors with criminal machinations. (Graphic: PwC)

Current environmental, geopolitical, financial and social influences are creating a risk landscape for businesses that is more volatile than ever. These changes are creating gaps that criminal actors are exploiting with increasingly sophisticated attacks, such as the "Global Economic Crime and Fraud Survey 2022." shows. In other words: White-collar crime is no longer limited to cybercrime. 

Expensively paid security holes 

The study results show that crime rates remain stable at a high level. Just under half of the companies surveyed (46%) reported that economic crimes had been committed against them in the last two years. Among companies with annual sales of around CHF 10 billion, the figure was as high as 52%. The impact within this group was significant: almost one in five large companies reported a loss amount of just under 50 million Swiss francs. The proportion of smaller companies defrauded (i.e. with sales of less than 100 million Swiss francs) was lower (38%), of which one in four suffered a total loss of around one million Swiss francs. 

Economic crime: cybercrime remains number 1 threat

The growing number of digital platforms such as social media and e-commerce opens the door to numerous white-collar criminals - around 40% of those affected experienced some form of platform fraud. Across all company sizes, cybercrime topped the list by a wide margin, ahead of customer fraud (2020 rank 1). 42% of large companies reported being a victim of cybercrime in the past two years. 34% were targeted by customer fraud - fraudulent practices related to products or services (e.g., mortgage fraud, credit card fraud). Asset misappropriation ranked third among the top offenses with 24%. 

Combating economic crime across all sectors

Gianfranco Mautone, Partner Forensic Services and Financial Crime Leader at PwC Switzerland, explains: "If cybercriminal attacks are not stopped, they can act as a door opener for numerous forms of white-collar crime. Cyber risks and other forms of fraud are often tackled by separate departments that don't collaborate or share risks - and that's exactly what criminals know. It's imperative that companies find new ways to encourage collaboration among previously isolated departments and identify risk scenarios across functions." 

Future threats require well-armed companies

Emerging risks may take on an increasingly important role in the coming years. Currently, only 6% of the organizations reported that they have been victims of anti-embargo fraud (participation in unauthorized boycott measures by other countries). However, this may change in the next two years as global sanctions are at record levels right now. 8% of affected companies recorded ESG reporting fraud (i.e., falsification of ESG disclosures) As ESG continues to grow in importance, criminals may have an increased incentive to commit more crimes in this area. The COVID-19 pandemic also changed the risk landscape: As a result of the pandemic, one in eight companies experienced instances of supply chain fraud for the first time. 

Source: PwC

Quantum computing: new potentials for automated machine learning

The Fraunhofer Institutes IAO and IPA and industrial partners are jointly developing a first quantum-based cloud solution for automated machine learning. The project is funded by the German Federal Ministry for Economic Affairs and Climate Protection.

Future Work Lab. (Photo: Ludmilla Parsyak, Fraunhofer IAO with the use of nobeastsofierce - stock)

Quantum computing makes it possible to advance computationally intensive technologies such as machine learning (ML). In the "AutoQML" project, eight partners from research and industry are therefore developing solution approaches that link quantum computing and ML. An open-source platform is intended to enable developers to use quantum machine learning algorithms without in-depth specialist knowledge. The Fraunhofer Institute for Manufacturing Engineering and Automation IPA is playing a key role in the project, contributing its expertise in quantum computing and conventional ML methods.

How do companies succeed in exploiting the potential of digitization and remaining competitive? The use of technologies such as artificial intelligence (AI) can help companies to benefit from the digital transformation in the best possible way. ML in particular already plays a major role in the digitization strategy of many companies and enables more efficient processes and new business models, among other things. However, there is often a lack of skilled workers. Thus, the implementation of ML solutions is still often associated with a high workload. From data acquisition and the selection of suitable algorithms to the optimization of training, detailed expertise in ML is necessary.

New approach: quantum computing takes machine learning to a new level

The approach of automated machine learning (AutoML) counteracts these challenges and facilitates the use of AI for specialists. In particular, the choice of concrete ML algorithms is automated. Users thus have to deal with and know less about ML and can focus more on their actual processes. In this context, quantum computing marks a breakthrough into a new technological era, as it can significantly improve the AutoML approach. In addition, quantum computing provides the computing power often required for AutoML.

The joint project "AutoQML" addresses this innovation and pursues two main goals: First, the new approach AutoQML is being developed. This will be extended by newly developed quantum ML algorithms. Second, quantum computing raises the AutoML approach to a new level, because certain problems can be solved faster with the help of quantum computing than with conventional algorithms.

Led by the Fraunhofer Institute for Industrial Engineering IAO, the project provides developers with simplified access to conventional and quantum ML algorithms via an open-source platform. In addition to Fraunhofer, the companies GFT Integrated Systems, USU Software AG, IAV GmbH Ingenieursgesellschaft Auto und Verkehr, KEB Automation KG, TRUMPF Werkzeug-maschinen GmbH + Co. KG and Zeppelin GmbH are participating in the project. The solutions developed will be tested on the basis of specific use cases from the automotive and production sectors.

The best of both worlds: Software library for hybrid total solutions

The project consortium will integrate components of quantum computing into current machine learning solution approaches in order to be able to use the performance, speed and complexity advantages of quantum algorithms in an industrial context. In the so-called AutoQML-Developer Suite - a software library - developed quantum ML components and methods will be brought together in the form of a toolbox and made available to developers in an open-source platform. This will enable users to apply machine learning and quantum machine learning and to develop hybrid overall solutions. The project will run for three years. Further market dissemination by the corporate partners will enable the transfer of research-based high-technology to a broad industrial environment with the aim of significantly strengthening Germany as an industrial location. The project is funded by the German Federal Ministry of Economics and Climate Protection.

Further information: http://www.autoqml.ai/

New beverage filling line for a sustainable future

A modern PET filling line for beverages in wide-neck bottles replaces the existing plant in Sursee (LU) at Ramseier Suisse AG and is a sustainable investment in the future of the company. Thanks to state-of-the-art technology, water and steam consumption as well as the use of cleaning agents, among other things, can be significantly reduced.

The new beverage filling line at Ramseier Suisse AG in Sursee. (Image: zVg / Ramseier)

On Tuesday, April 12, 2022, a new beverage filling line was commissioned at Ramseier Suisse AG in Sursee. According to the company, the total cost of this line was 19 million Swiss francs. As part of the official commissioning, the new product RAMSEIER's Huus-Tee Swiss Fruits was bottled. With this new PET wide-neck filling line, the nationally renowned beverage producer is now able to respond to customer needs in an even more flexible and agile manner, according to the company. The investment is an important part of Ramseier Suisse AG's commitment to sustainability. "The reduced pre- and post-run during filling further reduces product losses per batch and thus food waste," explains Managing Director Christoph Richli. The plant to be replaced had been in operation for 19 years.

The plant was officially commissioned in the presence of Christoph Richli, Managing Director of Ramseier Suisse AG, on April 12, 2022. (Image: zVg / Ramseier)

The bottling hall at the Sursee site was extended in advance to make room for the new line. The new line will be used to bottle still, non-carbonated beverages. The development of this product segment has been very positive in recent years, as evidenced by the popularity of RAMSEIER's Huus tea. For this reason, the company has decided to invest in a line on which only beverages in PET wide-neck bottles are filled. The line has a filling capacity of 12,000 PET bottles per hour. In addition to the new beverage filling line, the Sursee site also operates a PET filling line for narrow-neck bottles, a glass filling line, two lines for soft packs, and a bag-in-box filling line.

www.ramseier.ch

ESPRIX Forum 2022: The Art of Transformation

After postponement due to the pandemic, the ESPRIX Forum 2022 will take place on June 17, 2022 on the topic "The Art of Transformation". The event will also be the setting for the festive presentation of the ESPRIX Swiss Award for Excellence.

Topic of this year's ESPRIX Forum on June 17, 2022 at the Bürgenstock Resort. (Image: ESPRIX)

The ESPRIX Swiss Award for Excellence has been held since 1999. It offers outstanding organizations the opportunity to measure themselves against others and learn from each other. This year, the time has come again: In March, the ESPRIX assessors visited the applicants to identify strengths and potential for improvement and to assess the maturity of the organization. Based on their findings, the ESPRIX jury has now decided on the award. Who is a finalist for the ESPRIX Swiss Award for Excellence, or even who will win, remains a well-kept secret. It will be revealed at the ESPRIX Forum 2022 on June 17, 2022 at the Bürgenstock Resort.

ESPRIX Forum 2022: Keynote by Stefan Brunnhuber

But not only that: Keynote speaker Prof. Dr. Dr. Stefan Brunnhuber will speak on the topic of "The Art of Transformation." His message: We will only be able to live together sustainably if we begin to acknowledge the psychological realities that constantly drive and surround us all. Stefan Brunnhuber is a medical doctor, economic sociologist, psychiatrist and economist. A student of Dahrendorf and a member of the Austrian Chapter of the Club of Rome, Brunnhuber's interests are diverse and include considerations of resource wars and peacekeeping, post-growth and environmental sustainability.

The ESPRIX Forum 2022 will start at 5 pm on June 17, 2022 in the foyer of the Bürgenstock Resort Lake Lucerne for an aperitif. The official program starts at 6 p.m. in the ballroom. Phil Dankner will lead through the program, other guests are the tambour troupe "Stickstoff" from Basel and the singer ELLE. From 10 p.m. there will be an after-show party with the jazz formation Defrank. The cost of the evening is CHF 425, and members of ESPRIX Excellence Suisse will receive a price reduction of CHF 50 per person. Included are the lecture, food and drinks, the entertainment program and the after-show party.

Registration and further information

Workshop: How can companies convincingly implement the circular economy?

In the run-up to the ESPRIX Forum 2022, the ESPRIX Excellence Suisse Foundation, öbu, the association for sustainable business, and Circular Economy Switzerland invite you to an expert workshop. What potentials do the business models "use instead of own" and "use used instead of buying new" offer? What factual and psychological challenges are associated with the implementation of these business models? And how can they be overcome? After exciting keynote speeches by Mobility and revendo AG, we will discuss these and other questions in groups. The event will be rounded off with closing remarks by Prof. Dr. Stefan Brunnhuber and networking.

Registration and further information is available here.

Joining forces to renew the Swiss health insurance ecosystem

Sumex AG, a wholly owned subsidiary of ELCA Group, a leading Swiss engineering, development and business solutions company, and Secon AG, a process and data specialist for the core insurance business, announce the formation of a strategic partnership. Together, the two companies will create a leading provider of technology solutions for the health insurance market in Switzerland.

Health insurers of all sizes should be able to manage their plans through a platform that requires minimal staff. (Image: Pixabay.com)

Diverse technology vendors have made significant investments to address health insurance software developments in terms of complexity, cost and technological innovation. This has resulted in leading-edge solutions that address the needs of both insurance companies and their customers. Offering a better user experience while reducing costs was a challenge that required strong, specific competencies and a mid- to long-term strategic perspective.

Vision: More efficiency in health insurance

Through the merger, Sumex AG and Secon AG say they intend to live up to a shared vision of improving the efficiency of the Swiss healthcare system through highly automated and fully digital end-to-end processes. "The two companies complement each other perfectly and the combination of the two solutions opens up new strategic opportunities," says Felix Musterle, General Manager of Sumex AG. To this end, the focus is concentrated on the following objectives:

  • Lower transaction costs due to a high degree of automation and maximum effectiveness in damage control
  • Separation of complex tasks from standardized activities, which enables optimal use of specialized resources
  • Modular and open software architecture
  • A Swiss solution designed to meet the needs of Swiss insurance companies
  • Expanded know-how and expertise for innovation and functional coverage that enables Swiss insurance companies to take the next step in their digitization strategy

Thanks to stable measurement results: ETH students conquer the edge of the troposphere

Students at ETH Zurich are trying to win the European Rocketery Challenge (EuRoC) in the highest category "Rockets with self-developed propulsion and flight altitude 10,000 meters" with a research rocket christened PICCARD. Reliable measurement results are needed to monitor the stability of the missile. The ETH students rely on special strain gauges for this purpose.

With the arrangement of the strain gauges for the bending moments, the deformations caused by axial forces and temperatures could be compensated. A prerequisite for the successful optimizations was also the stability of the measurement results. (Image: Hottinger Brüel & Kjaer)

In 2020/21, a team of over 50 dedicated students from ETH Zurich, in the association Academic Space Initiative Switzerland (ARIS), realized the 4th research rocket generation to participate in the European Rocketery Challenge (EuRoC) in Portugal. The students had set themselves the goal of winning in the highest category "Rocket with self-developed propulsion and flight altitude 10,000 meters". The functionality of the self-developed hybrid propulsion system was proven by the successful EuRoC launch. The new monitoring system for measuring the load on the research rocket's aerostructure was also decisive for this. 

Reliable measurement results for real occurring loads

The structure of such a rocket is subjected to considerable loads in flight, which can only be partially determined in simulations. For example, influencing factors such as the wind or the shock load when the parachute opens cannot be determined exactly in analyses. However, reliable data for all load-relevant factors are required to realize an aerostructure of the rocket that provides the maximum strength with minimum weight necessary to achieve the goals of the mission. In order to verify and, if necessary, correct the determined loads in flight, a monitoring system for real bending moments and axial forces is required. 

With 4 kilograms at 10,000 m altitude

After the ARIS teams had determined the forces acting on the rocket in flight purely analytically in the past by means of simplified assumptions in simulations, their own monitoring system was used for the first time in the PICCARD mission. Here, the ETH Zurich students relied on strain gauges from Hottinger Brüel & Kjær (HBK), which provide reliable measurement results even under extreme conditions. Accordingly, a complete system was integrated into the rocket. The strain gauges from HBK installed in the system provide essential knowledge about occurring bending moments and axial forces during every phase of the flight. The bending moments and axial forces recorded during the test flight as part of the structural stress analysis subsequently enabled a corresponding weight-optimized design of all load-bearing structural components. The prerequisites for a successful participation in the Spaceport America Cup 2022 in New Mexico could thus be created. Here, the team wants to transport a payload of four kilograms to an altitude of 10,000 meters and bring the research rocket with all its parts safely back to earth.

Ease of integration as a criterion

The fact that strain gages from HBK were chosen for the right measurement technology was on the one hand the result of past positive experience coupled with the international reputation of the company. Another plus point was the ease of integration of the HBK strain gages, which delivered on the promise of "plug and measure" made by the measurement technology experts. 

Source and further information: www.hbkworld.com

Rear area monitoring for more safety in warehouse traffic

When reversing, forklift drivers have a severely restricted view and a large blind spot. Driving assistance systems are therefore being used more and more frequently in intralogistics. Time-of-flight distance measurement reliably detects people as well as objects and prevents collisions by actively reducing speed.

In the RAM 107 rear area monitoring system from tbm hightech control GmbH, a special 3D camera supported by smart image processing monitors the rear area over various safety zones behind the forklift. (Image: tbm hightech control GmbH)

More and more companies are turning to safety and assistance systems to protect employees and goods during production. One area where there is a particularly high potential for danger is plant logistics. In order to avoid accidents and collisions with stored goods or rack walls here, the market offers numerous different solutions, whereby the quality of detection can vary greatly, for example in terms of differentiating between people and objects. More precise systems for rear area monitoring are particularly desirable.

Smart driver assistance systems prevent unnecessary braking

In practice, situations often arise that should make it possible to reduce speed automatically, but at the same time the system must work variably enough to be able to adapt to the potential danger of the situation in question. "In these cases, either all-round protection systems for the forklift or reversing protection systems are then suitable," reports Edgar Nassal, long-standing managing director of tbm hightech control GmbH from Aschheim near Munich. "However, 360° all-round protection for the forklift and the associated transponder systems result in the problem that the forklifts were often slowed down unnecessarily." This is where this company's driver assistance systems provide a remedy. In the RAM-107, the rear area is divided into three adaptive protection zones, with their length automatically adjusting to the truck speed. According to the manufacturer, this is intended to ensure trouble-free travel in narrow areas and when maneuvering, when the vehicle is driven slowly, and thus only short monitoring zones are active. Alarms are thus only triggered when a warning is actually required. This brings a high level of acceptance among drivers, the manufacturer promises.

Back room monitoring all around: 3D sensor technology uses time-of-flight measurement

In practice, this looks like this: From the driver's overhead guard, the RAM-107 monitors the rear of the vehicle with an optimum mounting position, almost without blind spots, directly to the rear of the vehicle. For this purpose, the integrated 3D sensor uses the time-of-flight method by means of patented PMD technology. The area to be monitored is illuminated with a modulated, invisible infrared light and the reflected light in turn hits the PMD sensor. Based on the phase shift between the transmitted and received signal, each pixel of the sensor chip now determines the distances between the stacker and the objects. Signal processing is supported by compact electronics with an intelligent evaluation algorithm, ensuring very high precision. "Unlike comparable systems, we can distinguish very accurately between standing people, people in a stooped position, low-lying trailers or shelf walls, and waist-high cartons," Nassal explains. "The system also reliably detects chasms such as ramps." The smart evaluation unit processes 1,024 pixels (data) per second and detects a test object of 30x30x30 cm at a distance of 3 m and reacts with an alarm signal. In other words, the foot of a person is enough to slow down the vehicle. With a stopping distance of e.g. 2.0 - 2.5 m, this is the necessary safety for pedestrians. 

Visual and audible warning signals

From the cockpit, the driver is shown the three adjustable monitoring zones via a five-inch multifunction color monitor. In addition, the distance to the detected object is displayed both visually (green/yellow/red color change) and acoustically (increasingly faster sound signals). The live image and the real-time warning give the driver a full view of the danger zone at all times, which provides additional safety during storage and retrieval, i.e. daily work. 

Further information on the Internet at: www.tbm.biz

Supply chain attack: When cyber attacks come via update

Attacks on the supply chain - the supply chain - for software (and for hardware) of IT also threaten small and medium-sized enterprises. Updates to services and software are an increasingly dangerous vulnerability, especially as cyber criminals hope to spread attacks to numerous victims by hijacking an update. Small and medium-sized enterprises should not only update their cyber defenses, but also review their supply chains for software, hardware and updates.

A supply chain attack is an increasingly common case of cyber attack and can become a threat to small and medium-sized businesses. (Image: Pixabay.com)

An attack on the IT supply chain aims to manipulate the production process of a third-party software from development to updating, so that malicious code is pushed out instead of an update. This IT supply chain is vulnerable and cyber criminals are increasingly attacking it. This is because such a supply chain attack is efficient for them: when they attack software packages and platforms of software and information systems providers, they reach multiple victims in one fell swoop. It makes little sense for the hacker to attack one company at a time with a complex attack when there may be tens of thousands of companies and organizations using a widely deployed application or service that is efficiently within their reach. The December 2020 attack on Solarwinds' supply chain affected close to 18,000 of Solarwinds' 300,000 customers worldwide. In addition to a mass attack, however, highly targeted attacks via the supply chain are just as possible.

Supply chain attack locations

A compromised supply chain is difficult for affected customers to detect. Therefore, cyber criminals have enough time to cause damage - such as data exfiltration, attacks on systems or disrupting processes. These attacks are different from previous attacks targeting individual customers and pose a challenge even for experts. It is not for nothing that the European Union Agency for Cybersecurity estimates, ENISAThe risk is high even for companies whose IT defenses are actually quite well established.

Phases of a supply chain attack. (Image source: Bitdefender)

An attack can be launched at multiple stages of the supply chain for developing, deploying or updating software. Compromising supplier IT does not constitute a supply chain attack. It involves modifying code sources and writing scripts. Depending on which link in the supply chain the hacker starts at, the skills required of him or the possibilities for the defense to recognize a manipulation are all the more different. The following phases in the supply chain can be distinguished as starting points for an attack:

  • Phase One - Programming: These attacks are relatively easy to detect. They start via targeted mails, exploits and malicious websites to gain access to the programming code. It is relatively easy for a hacker to change the code at that point. But what they have changed is visible in the logs.
  • Phase Two - Versioning: Attackers can drive an attack via a remote desktop protocol (RDP) with little effort. Weak passwords and exploits of an application help them to do so. They can also have modified versions rolled out in a reduced or delayed scope, because they have direct access to source code and logs and leave few traces. But the modified code proves the manipulation.
  • Phase Three - Implementation (Build): This is where it gets more challenging for the hackers, but unfortunately also for the defenses. The means are the old ones and attackers use RDP attacks, weak passwords and exploits in the application. But they need a good understanding of scripts. This is because the necessary modifications to individual builds take a lot of time and are complex. The modified code can be hidden. The defense would also have to check the successive script versions individually to detect manipulations.
  • Phase Four - Signing the components: If the attacker gets involved now, he does not have to manipulate code. He simply replaces the actual code with malicious code. But a validation in the supply chain concept will reject this fake update. Hackers must therefore meet some minimum criteria for legal updates in their fake programs.
  • Phase Five - Delivery: Here, too, an attacker only has to exchange the components. But the malicious components then have no signature and can be recognized by it.

How can SMEs protect themselves?

Although the attacks take place in the update supplier's supply chain, the attacks also affect smaller and medium-sized companies. To arm themselves against the damage of a supposedly legal update, they should follow these measures:

  1. A Implement comprehensive cybersecuritywhich includes Endpoint Detection and Response (EDR), but which, thanks to Threat Intelligence, also sees and reports suspicious data connections. After all, a common symptom of a successful supply chain attack is communication with a malicious command-and-control server. Companies with limited IT resources in particular should also consider a managed detection and response (MDR) service, and with it the expertise and time of IT security analysts. Only by combining EDR and MDR can managers see anomalies as they occur.
  2. Equally important is Educating employees about phishing, to prevent the hijacking of an identity in the supply chain process.
  3. It is central to Know and continuously review a company's supply chain processes. Does an IT manager even know which software or service updates it obtains from whom and when? What hardware does it acquire and how is it protected from receiving malware through this? Every security manager should ask the following questions of his IT supplier:
    - Is the vendor's software/hardware development process documented, traceable, and verifiable?
    - Is fixing known vulnerabilities factored into product design and architecture, runtime protection, and code review?
    - How does the vendor keep a customer informed of emerging vulnerabilities?
    - What options does the vendor have to address "zero-day" vulnerabilities - those vulnerabilities that are designed into software from the beginning and are discovered later?
    - How does the supplier manage and monitor the production processes of a software and update?
    - What does the vendor do to protect its updates from tampering and malware?
    - What type of employee background check is conducted at the provider and how frequently?
    - How secure is the update rollout?

Anyone who receives a software update must be sure that they are not receiving malicious malware: At the end of the day, he has to suffer the consequences of a successful supply chain attack himself. Caution and a well-considered selection of suppliers, combined with comprehensive IT security, are the best helpers against a type of attack whose risk potential is far from exhausted.

Author:
Jörg von der Heydt is Regional Director DACH at Bitdefender.

Ricoh receives gold rating for sustainability activities

Ricoh Company, Ltd. receives a gold rating in EcoVadis' sustainability rating. This puts Ricoh among the top five percent of companies rated in this area.

EcoVadis' gold rating in sustainability for Ricoh. (Image: EcoVadis)

For more than 85 years, Ricoh has fostered innovation and established itself as a leading provider of document management solutions, IT services, communication services, commercial and industrial printing services, digital cameras and industrial systems. Recently, the company again received a Gold rating from EcoVadis for its sustainability activities. This puts Ricoh in the top five percent of companies rated in the industry for sustainability performance. Founded in 2007, EcoVadis is a globally recognized provider of corporate sustainability ratings. It focuses on corporate environmental, social and governance (ESG) practices and helps companies improve their environmental and social activities across their global supply chains. More than 90,0000 companies from over 160 countries and 200 different industries are rated by EcoVadis on their corporate policies, initiatives and performance in four areas: environment, labor and human rights, ethics, and green procurement.

Ricoh received the Gold rating for the first time in 2014 and has confirmed it continuously since then. In particular, Ricoh's commitment in the categories "Environment" and "Green Procurement" is clearly honored in the current EcoVadis rating. This confirms Ricoh's proactive approach to environmental management and sustainable procurement in collaboration with suppliers, according to the statement. In 2019, Ricoh became the first Japanese company to participate in the Business for Inclusive Growth (B4IG) initiative, which works to address inequality in the workplace and supply chains. Ricoh is also a member of the Responsible Business Alliance (RBA), which promotes social responsibility in global supply chains.

To create an effective and global framework for its ESG activities, Ricoh has identified seven focus areas. These are aligned with 12 of the 17 Sustainable Development Goals (SDGs) introduced by the UN, which can be used to address specific issues. In doing so, the Ricoh Group aims to contribute to the development of a sustainable society that actively addresses economic, social and global environmental policies. Ricoh will contribute to the achievement of the SDGs by solving social problems throughout the value chain through its business operations, thus helping to realize a more sustainable society.

Source and further information: Ricoh

Swiss Cyber Security Days 2022 were a complete success

The Swiss Cyber Security Days 2022 offered a high-level knowledge input for the audience and Switzerland with the American Cyber Security Director and advisor to President Joe Biden. He emphasized the importance of good cooperation, as cyberspace knows no national borders.

U.S. President Joe Biden's advisor on cybersecurity issues Chris Inglis stressed the importance of good cooperation, as cyberspace knows no national borders, and praised Switzerland's potential for innovation. (Image: SCSD)

The Swiss Cyber Security Days 2022 (SCSD 2022), the most important meeting on cyber security in Switzerland, brought together key decision-makers and experts in the field of cyber security at national and international level and around 2,000 visitors on Wednesday, April 6 and Thursday, April 7. The first day focused on key global security issues for Switzerland. At the opening ceremony, National Councilor and SCSD President Doris Fiala and Daniel Berger, president of Cyber Resilience Ltd, which is organizing the event, pointed out that the increase in infrastructures and data transfer volumes is leading to ever greater vulnerabilities. Moreover, these processes have been accelerated by the pandemic. Companies and administrations are confronted with and threatened by cybercrime on a daily basis, he said. Olivier Curty, President of the State Council of the Canton of Fribourg, also welcomed the participants on the first day in a welcoming message and underlined the importance of cyber security for the cantons.

Global security issues on the first day of the Swiss Cyber Security Days 2022

Among the highlights of the first day of the congress was the presentation by Chris Inglis, National Cyber Director and Advisor to the President of the United States Joe Biden. He stressed the importance of good cooperation. Cyberspace knows no national borders, Inglis warned, praising the potential of Swiss innovations. Florian Schütz, the Swiss government's delegate for cybersecurity, looked back at developments in recent years. He said the Swiss government has made a lot of progress and is currently working on the second version of the national cyber risk protection strategy. Div. Alan Vuitel, head of the Armed Forces Cyber Command project, looked at cybersecurity from a military perspective. He spoke about the main challenges we currently face from a national security perspective.

SMEs in focus on the second day

On the second day, the event focused on cybersecurity in SMEs. Gerhard Andrey, entrepreneur and member of the National Council, spoke about how the aviation industry has been dealing with technical defects in complex systems for decades. This is achieved by means of precise, complete information transmission and transparency. He calls for this to become the standard in dealing with cybersecurity as well. In a panel organized by the insurance company Mobiliar, Susanne Maurer, Editor Corporate Communication, Andreas Hölzli, Head of Competence Center Cyber Risk, and Thomas Kühne, CIO, discussed a recent GFS study showing that one in three companies has already been the victim of a cyber attack. The greatest risk is and remains the employees themselves, whose awareness makes an important contribution to prevention.

Nicolas Mayencourt, CEO and founder of Dreamlab Technologies, and Prof. Dr. Marc K. Peter, Head of Centre for Digital Transformation at FHNW, presented the annual edition of the State of Swiss Cyberspace. The study conducted a full scan of Switzerland's public attack surface and presented vulnerabilities by sector for the first time. The study found that the three sectors of education, healthcare and government have the most vulnerabilities.

Presentation of the SCION project of ETH

ETH's SCION project was presented to the public for the first time at the SCSD. The secure Internet architecture SCION offers increased security, availability and performance. The SCI-ED project enables secure and highly available communication between institutions of the ETH Domain and partners. The project was presented by Adrian Perrig, ETH / SCION, Martin Bosshardt, Anapaya, Florian Schütz, NCSC, August Benz, SBA, Urs Fischer, HIN, Stefan Berg, Swisscom, and Robert Wigger, Sunrise Impulse.

Swiss Cyber Security Days 2022: 130 conferences, panels, expert discussions

After last year's edition was held entirely online due to the pandemic, they were even more pleased that Cyber Security Days could be held on-site again this year. Béat Kunz, CEO of SCSD, says: "Although we were very satisfied with the virtual edition, it doesn't replace the personal contacts that are made, especially in the exhibition area." More than 100 exhibitors had gathered at Forum Fribourg. During the two days, more than 130 conferences, panels, expert discussions, best practices and round tables took place. In addition to the key-notes, the Expert Tracks offered many interesting technical presentations and innovations on both days and the two Best Practices Tracks were also a great success. This year, for the first time, admission to the exhibition and the Best Practice Tracks (comprising 20 presentations per day) was free of charge. The Swiss Cyber Security Days 2023 will take place on March 29 and 30.

www.swisscybersecuritydays.ch