The old saying used as a title for this blog relates back to an earlier and simpler time – before EDI, that’s for sure – and relates to British currency.  They have the Pound and the Penny and even a Half-Penny, too.  But this was all brought about by topic in the Inovis Trusted Link group (over on Yahoo!) that got Me to thinking about AS2 and costs and related things – again.  Not that I think about AS2 a lot, but…

Anyway, the original poster over there was wondering on where he could receive some “AS2 training” – and everybody then kind of went off into the “oh, we use ______ for our AS2 connection and love it!” kind of comments – but very few seemed to offer an answer to the poster about his question – AS2 TRAINING.

Like there is such a thing!

“But, wait!” You say.  “What does this have to do with being ‘Penny wise and pound foolish?”  I’m getting there, I’m getting there.

Seriously, though, let’s take a look at what AS2 really IS.  It’s a method of communications.  It’s a way to connect.  In a nutshell, AS2 is (from Wikipedia):

“Applicability Statement 2 (AS2) is a specification about how to transport data securely and reliably over the Internet. Security is achieved by using digital certificates and encryption.”

I kind of liken AS2 to DSL/broadband connectivity for surfing the net vs. the “old” dial up that is BSC.  It’s connecting to our trading partners via the same protocol that governs the Internet – the place we surf, download and blog – Hyper Text Transfer Protocol (HTTP).

And did you really need any kind of “training” when you started using your DSL – or your wireless broadband or your cable modem or your ____ connection to the internet…?  Nope.

But back to AS2 and what it’s all about.  AS2 is just a way for us to send data over the internet connection (HTTP) from one system to another.  No muss, no fuss, no bother.  And in some cases – or as many would lead you to believe – at no cost.

But, wait a minute!  Hold on there!  There ARE some costs involved in AS2 communications…!

When it comes to communications – sending our EDI information back and forth – so many people seem to focus solely on the concepts of the “per KC charge” or fee structure for trading data.  Inovis, GEIS, AT&T, Sterling, ICC, and all the rest, charge us (generally) a flat fee for each KC we send or receive.  Depending on how you’ve set up your contract, you may get a flat fee – say, $4000.00 a month – for a flat amount – say 50,000 KCs – of data you send or receive.  Then, after that, they charge you an “over-limit” fee of 5 cents a KC – or more or less – depending upon your contract.

With AS2, those KC charges all go far, far away…  But, what so many seem to forget – or if they’re selling – want you to forget – are the OTHER charges that can be and are associated with AS2.  Depending on what system(s) you may use to translate and transmit your data, there could be some licensing fees associated with setting up AS2.  Maybe, just maybe, your software provider allows one AS2 connection for “free” but charges a license fee for each and every AS2 connection over and above that “freebie”.  Some may not even have AS2 built into their system and you need to “add” programs or modules to your EDI application to get AS2 connectivity.

Then you get to think about the wondrous wonder of the Internet and connectivity – BANDWIDTH.  If you have a narrow “band” for your Internet connection, then this additional data may clog that tunnel.  Just think of the scenes from “Independence Day” and how Will Smith’s girlfriend (fiancé?) was caught in the tunnel as Los Angeles was being blown to bits by the invading alien horde and her and her kid and the dog were trapped in the tunnel as the fireball of alien laser energy was blowing LA apart.

Now, while your bandwidth may not be as limiting as a 2 lane tunnel in LA, it can still have some limits.  And congestion in your tunnel may not be as dire and deadly as it was in “Independence Day” – lives may not be wiped out in seconds.  But it can cause you problems with your ISP if they only give you a limited bandwidth per month.  Now you’re over and you’re getting charged for that overage.

Then there’s the concept of labor…  And right after Labor Day, too.  But there is the cost of the man-hours (or woman-hours!) it takes to set up those connections and maintain those connections.  It may only take a few minutes to set up those AS2 connections and maybe a few more to test that connection, but there are still some costs involved.  And then what if Jane AS2 Master quits and you hire Joe EDI Master who knows NOTHING of AS2 and has to learn by the seat of his pants, on the fly, as he goes along?

Plus, here’s another wrinkle in the smooth fabric of cost – wrong, bad, or error data…  Let’s say that ABC Company’s newest shipping clerk created a shipment (and, therefore, generated the ASN) for a shipment, but missed an entire pick-sheet of cartons in the truck or container.  Once he’s hit send (or whatever) and that shipment notification is generated, he can’t go and fix it – without RESENDING that ASN – corrected, of course.  So now you’ve got 2 documents – one is missing information that the other document contains.  Sure, if the EDI system at ABC Company is set up correctly, that new ASN is sent out as a replacement, but how does YOUR system handle it…?  Does it just delete the old record and rewrite the new record?  Or do you have 2 records in your system…?

So many people and companies seem to focus on the pennies of the situation those darn “per KC charges” and then lose track of the big bucks of the EDI process and programs and all of the other systems that EDI touches.

It’s the same when you get that sales call from some network or VAN claiming they can save you up to half of your VAN costs!  WOW!  Sign Me up!  But, wait a minute!  What about those other costs…?  Beyond those pesky KC charges?  Don’t they matter, too?

The sales folks at those other VANs and providers aren’t thinking about your total dollars – they’re just hitting you with the easiest cost to argue – the KC charge.  They know it’s a high-profile cost of EDI.  It’s one that you have to justify every time the contract comes up or the bill needs approval.  But what of those other costs…?  The costs of downtime – what happens when the network is down…?  What about the time you’ll have to spend on trading partner notifications?  What about the time you may have to spend on reconfiguring your communications systems – or even worse – the translation set up.

So, basically, the concepts of just saving a few cents here or there on KCs are very Penny Wise, Pound Foolish.

I’ve got a bad case of … EDI VIRUS BLUES?

The other day - on, yes, the EDI-L Yahoo Group - I read a post about how an Information Security department of a company was worried about the concepts of viruses and hackers gaining access through the EDI system and the documents we trade via EDI.  Most of the replies were, as you would suspect, “is your infosec group smoking crack..?!?” or something to the same thought..

But it does beg the question - how susceptible to a virus attack, a trojan horse, a hack or some other kind of attack are we through our EDI processes?  There are no virus scanners and other system tools to scan the data as it’s coming into the system via our AS2 or bisync communications sessions.  There’s not much to stop the virus or hack or trojan from getting into the system, now is there…?

Sure, you may have a firewall set-up and the data must pass through the firewall, but you’ve basically given it permission to travel through that wall, anyway, simply by virtue of the face that you’ve given permission to the connection that the data (virus laden or otherwise!) is traveling along.

But that’s about the place when their concept of the attack falls flat…

Look at the way the data is transmitted - more or less as text - viewable as either the hex format or the text format.  And then your translator will go and take those characters and put them, based upon your mapping specs, into your system and populate the various files and data fields that you’ve mapped them to.  That traffic cop of EDI translation is directing the data flow into your system(s) to create orders, receive orders, and so on.

And it’s truly your translator and your map that will end up acting as the virus defense line - by virtue of the fact that the data that they could be sending (that virus code!)  will fail in the translation and never make it into your back-end system.  Even if they use one of the simplest hacks - a buffer overflow - you’re still pretty much safe - simply by virtue of the fact that they can send all the characters and data that they want in the element, but you’re only looking at 10 characters.  Or 12 characters.  Or however long that data field is.

The other thing to remember about these files that we trade back and forth, however, is that they’re treated and send (basically) as a text document.  Nearly all virus programs and worms and trojan horses are programs… They’re EXECUTABLE files.  They’re sent as screen-savers or zip files or whatever - but, at their root - they’re an executable file - a program.  This concept was brought up in the thread on the group, too.  And of course, the doomsday nay-sayers kept on about how you could get the malicious code into your system.

The best counter example to this, however, was the concept that I could create a wonderfully wicked virus - something that would truly erase all of your files on the hard-drive, recreate your “Favorites” (for Internet Explorer) with porn sites all about farm animals, recreate the Unabomber’s manifesto (as written by you, of course) and change all of your image files to naked images of the gender you least want to see naked…  And they’ll all be over 400 lbs of fleshy beauty.  Oh, yes, and your computer will blast - not just play - show tunes and 20s-flapper jazz at full volume…  Yeah, now that’s a VIRUS!!!

But the truth is, I could create this showstopper virus and send you the code - as a .txt file that you could open and view in Notepad or Word (or whatever writing program you use).  But will it cause any harm to your system..?  Nope…  Will those aforementioned show tunes and nudie shots render your system a disaster area..?  Nope.  All because it’s a set of instructions, but they’re not presented in a way that the computer will actually process them and follow them.  They’re nothing more than words - letters, numbers, symbols - characters - that you can view.

EDI documents are the same thing - they’re just characters that you (or your system) reads and populates into those certain fields and files.  They don’t do anything other than that.  It won’t open your ports, start the modem in a receive mode or anything else that could compromise your system.  It won’t go digging into your financial data and give access to any of the credit card data you’ve got stored or give the hacker the keys to your checking account.  They’re just text - readable collections of characters. 

So, go ahead.  I dare you.  I double dare you.  I triple-ripple, double-dog dare you.  Create a virus to be sent via EDI.  And see how many systems you infect.

One of the other things to consider - even if it WAS possible to create a virus and send it via EDI - would it be truly worth it..?  One of the bombs that often shows up on the battlegrounds of the Apple Mac vs. Windows PC wars is how safe the Macs are from viruses and attacks.  And it’s not that they’re truly safer or more secure.  Instead, it’s the law of “supply & demand”.  You’ve got hundreds of thousands of Windows PCs out there in the world.  Millions.  But only a few thousand Macs (by comparison).  So, where are you likely to get the most “bang for your buck” when creating a virus, hack or trojan horse?  By infecting 10% of the population?  Or is it by doing the 90% of the population?  That’s right - it’s the 90% group you’re going after…  You’ve got the most chances for your seeds of evil to dig in and root and create the mayhem and carnage you’re hoping for.

EDI provides that same kind of safety, as well.  There has to be so much forethought and planning on the part of the hacker - he’d have to create a document format in a document you trade AND he’d have to create the map with the specific communications parameters (qualifer, ID, network, etc.) and all of it in a format that your system would allow to translate AND move into your production fields and files. 

Sorry - ain’t never gonna happen….

But, what’s YOUR take on the chances of virus attacks in EDI..?