Buzz: Electronic commerce dos and dont's

Contact Senior Editor Ellen Messmer

Electronic commerce resources

EDI Directory from the University of Texas

Electronic commerce dos and don'ts

By Ellen Messmer
Network World, 9/29/97

The concept of electronic commerce has been around since the time the telegraph was invented. But electronic exchange of business documents didn't take root until the early 1980s, after the transportation industry created a set of standard data elements so railroads and steel mills could signal computer to computer that railcars were en route. Electronic commerce has been on the fast track since.

With the wide, if bumpy, road of the Internet now in place, plus the multimedia World Wide Web, more businesses than ever are thinking hard about electronic commerce. Here are routes to take and obstacles to avoid along the electronic commerce path.

Steps to take

Define your business goals

Do you simply want to advertise your products or services on the Web, but stick to the phone, fax or mail to handle actual purchase transactions? Do you intend to market to your established trading partners or seek out new business? Or do you intend to use the Web to advertise and sell to consumers? Business factors such as these will make a difference in how you design your electronic commerce system.

To market to consumers, your Web server would probably display standard pricing, though merchant servers can be set up to personalize the shopping experience for repeat customers.

In contrast, your corporate trading partners generally work under prearranged contracts with unique product pricing based on volume and payment terms. You may decide to let your trading partners into a specially secured part of your intranet to share business data.

Follow the money trail

Businesses selling goods over the 'Net to consumers need to decide whether or not to accept credit cards from strangers. Some businesses do not because of concerns about fraud. They prefer to set up registered accounts for customers after verifying basic background information. Those that do accept card numbers process these orders using Secure Sockets Layer (SSL) session encryption, technology widely supported in Web browsers and servers. However, SSL leaves the card information decrypted on the server, which can expose the information to hackers or even unscrupulous employees.

Get set for SET

Visa International, Inc. and MasterCard International, Inc. are not giving their official blessing to credit cards over the Internet until a standard called Secure Electronic Transaction (SET), finalized in June, gets implemented in merchant servers and Web browsers.

In order for SET to work, merchants, banks and credit card users will need to receive "digital certificates'' to authenticate buyers and sellers. This is expected to occur during the second half of this year.

It will cost online merchants some dough to upgrade their merchant servers to be SET-compliant, but the card associations are expected to make it worthwhile by reducing the rates they charge to merchants.

Why so generous? SET is expected to lower the risk of bad credit transactions on the 'Net because an end-to-end encrypted authentication process between consumer, merchant, bank and card association can occur in a standard way.

Know where you've been

For more than a decade, larger companies have used electronic data interchange and value-added network (VAN) services to exchange important and time-sensitive documents such as freight notices and purchase orders. Now companies are beginning to view Internet e-mail, file transfer and Web forms as an alternative to EDI software.

They also are considering VANs because VANs use proprietary protocols and typically charge by the byte.

However, companies have invested millions of dollars in EDI data-mapping and translation applications that run on mainframes and Unix systems tightly integrated into back-end financial systems for automated processing.

So the challenge is to gracefully combine the old and the new.

Take your EDI manager to lunch. You will find out a few secrets about what it takes to get technical, accounting and marketing people to work together on an electronic commerce project.

Join your vertical industry flock

Like birds of a feather, businesses flock together, whether they be electric power plants, automakers or insurance companies.

A number of important industry-specific electronic commerce efforts are under way, such as Detroit's Automotive Network Exchange, headed by Chrysler Corp., General Motors Corp. and Ford Motor Co. There also are more generalized technical frameworks, such as the Open Buying on the Internet specification, which wants to make exchanging purchase orders on the Internet more secure.

Keep an eye on the feds

By 2001, U.S. government agencies plan to be issuing requests for quotes from suppliers and awarding contracts almost exclusively over what's called the Federal Acquisition Computer Network (FACNET).

You probably shouldn't ignore FACNET, and if you want to get registered as a federal contractor under the electronic commerce rules, you'll have to do so by next March.

You'll also have to find out what software and VANs have been accredited by Uncle Sam for electronic commerce. A good place to start is www.acq.osd.mil/ec or call (800) 334-3414. Since the FACNET project started five years ago, the Department of Defense has blasted out some mission-impossible technical changes, so brace yourself.

In another area of federal electronic commerce, the Department of the Treasury this year began requiring thousands of businesses, based on their revenues, to file payroll-related taxes electronically instead of mailing in a check.

Worry about security

This is an area in which you can never stop worrying because there's no such thing as total security. If you're lucky, you will have a security guru on staff who can make sense of the alphabet soup of security acronyms, such as S/MIME, SSL, SET, IPSec, OPSEC, RADIUS, RSA and PGP.

It's hard to find objective information about security because vendors tend to have their own agenda, and no one wants to admit their products may not solve the whole security puzzle. However, the Carlisle, Pa.-based trade group National Computer Security Association provides benchmarks and other information about firewalls, computer viruses and hacker gambits, such as sniffing passwords or breaking into Web sites by exploiting buffer overflows.

Encrypted passwords may help you elude the wily hacker, but companies should examine how more advanced technologies such as public-key certificates, single sign-on or dynamic-password tokens, can be used for authentication.

Outsource, outsource, outsource

Chances are, you can't assign every task associated with an electronic commerce project to someone within your company. Your staff just won't have the time or the skills. You may well need outside help in Web development and Web server outsourcing.

The bigger Internet service providers are ready to help, but their terms differ greatly. If your company has some favorite systems integrators it has used in the past, call them up. Many have worked hard to gain Web-related skills, and the companies are already familiar with your back-end systems.

Some of the newer Web-development firms certainly deserve a look.

Get the entire organization on board

The "Dilbert'' comic strip aptly illustrates the emnity that often exists between technical and marketing departments within organizations. But coordination between marketing and the network division must occur for a successful electronic commerce project. You need a team, a project leader and buy-in from upper management.

Don't overlook upper management buy-in because this is going to cost some money and maybe a lot of it. Some estimates have the cost of a Web site running from half a million to $1 million dollars and more.

Mistakes to avoid

Don't ignore cyberspace legal issues

Your business may be on the 'Net, but that doesn't mean you have somehow been transported outside existing law. If anything, life could get more complex as states and countries demand taxes on sales made over the Internet or if Congress makes new Internet laws. KPMG Peat Marwick for one has assembled a stable of accountants that specialize in electronic commerce tax issues. And more lawyers appear to be getting cybersavvy as they realize that part of guarding their clients' interests may involve fighting over domain names or copyright violations on the Web.

In addition, because your electronic commerce effort will likely involve use of encryption, you need to know that encryption is regarded by many governments - including the U.S. - as a military weapon, and it is regulated accordingly. The Department of Commerce or security product vendors can provide some information in this area. But unfortunately, you'll probably need to check with a law firm that specializes in this to make sure you're not violating the law in other countries.

Don't spam

Sure, maybe the hundreds of thousands of people on the 'Net would buy your company's widget if they only knew about it. But spamming them with unsolicited e-mail will only get you angry e-mail bombs, not to mention a bad reputation. Some of the ISPs will kick you off their networks, too.

Don't play Big Brother on the Web

As a Web merchant, your first instinct will be to collect every scrap of information you can glean from your Web visitor for marketing purposes. And you may not want to disclose to your visitor what you do with that data or give the visitor a chance to opt out of giving it to you.

But European nations, and now the U.S. government's Federal Trade Commission, are voicing fierce opposition to certain data collection practices. Collecting information about children, in particular, is becoming a hot potato. Your Web practices could actually make you a criminal in some European nations, such as Belgium.

So you might be better off taking the high ground, as McGraw-Hill, Inc. has done, by publishing a privacy policy accessible to Web site visitors. For tips on devising such a policy, check with the Direct Marketing Association or Computer Professionals for Social Responsibility, both of which are in Washington, D.C.

Don't underestimate hackers

Some of them are just young, smart and testing the limits of your security vulnerabilities for the hell of it. But others are ruthless and destructive. They'll steal credit card numbers off your Web server if you store the numbers there and break into your network through your Web server. All in all, hackers pose perhaps the single greatest threat to electronic commerce because they have the power to erode merchant and consumer confidence.

Try hacking into your own network using vulnerability-assessment tools such as those from Internet Security Systems, Inc., Haystack Labs, Inc., Bellcore or Wheelgroup, Inc. Also, run operating system audits using tools from companies such as Axent Technologies, Inc. You can even try out hackers' tools, such as Crack. Here's hoping you won't find it too easy to break in.

Don't disrupt your distributor relationships

More than ever, the Web offers the potential to bypass your distributor chain and go directly to your customer. So your company will have to fully evaluate how the Web will affect the distributor relationships that could be the lifeblood of your firm.

Think positively: In one interesting "extranet'' application, a manufacturer gave authorized access to shipping data to a major distributor, which delivered this information on demand to second-tier distributors electronically. In general, remember that your online operations have to make sense within the context of the rest of your business.

Don't stop thinking about tomorrow

Once that Web site for handling transactions or publishing business information is up, at least one person, and perhaps several, are going to have to update the content. And someone will have to respond to customer inquiries or troubleshoot problems. Make sure that electronic commerce upkeep is well defined.

In addition, one of the hardest things to do is to improve something immediately after it's done. But hardly anyone gets it right the first time. Stay on the lookout for new chat, video and push technologies that will assist you in reaching customers more effectively or building communities of interest. New electronic payment technologies, such as those from CyberCash, Inc. and Mondex International, Ltd. are not mainstream yet, but they are worth keeping an eye on.

Don't ignore your competition's efforts

As you're sketching out your electronic commerce plans, check out what your competition is doing whenever possible. United Parcel Service of America, Inc. and Federal Express Corp. say they watch what the other is doing. Some analysts predict that consumer shopping on the Web will be driven by a race to find the least expensive prices possible on goods because automated Web searches to find such supersale prices will be common.

Don't overdesign your Web site

Simple is beautiful. No visitor wants to spend more than a few moments downloading graphics from your site, especially if the graphics consist of only banner advertising. Virtual Reality Modeling Language is an intriguing technology for creating alternate realities. But with the Internet bandwidth situation what it is these days, you're lucky to get any reality at all.

Don't think the Web is a magic wand for money

There's been a wonderful electronic commerce device out for about 100 years now. It's called the telephone. And now there are fax machines, too. Together, these devices handle most electronic commerce transactions. Contrary to some of the hype, Web-based electronic commerce is not going to eliminate 800-number call centers.

But Web technologies increasingly are going to be used in call centers. Most Americans, born before the age of the computer, are still getting used to the Web. But the next generation will not know life without it, so there's every reason to believe that electronic commerce will grow up fast.

Feedback | Network World, Inc. | Sponsor index
How to Advertise | Copyright

�