Security Engineering Services. Scalaris GRC Day 2011

Transcription

1 Scalaris GRC Day 2011 Wednesday Feb. 2 nd /01/2011 1

2 Presentation of Vesdo 11/01/2011 2

3 About Vesdo As internationally operating consulting engineers we exclusively focus on layout and realization of comprehensive, industrial security infrastructures in large companies to protect them against product piracy: Vesdo is a fully independent service provider Recognized as pioneer in the product security industry We don t sell any software or hardware Located in Switzerland Active since 2000 No commissions accepted for sales of suppliers We insist on total confidentiality in our assignments Vesdo project managers are multi-lingual and have one or several university degrees 11/01/2011 3

4 Activities of Vesdo Development of Product Security Strategies Implementation of Product Security Infrastructures Research projects 11/01/2011 4

5 11/01/2011 5

6 Product piracy covers a multitude of frauds Counterfeiting Gray market diversion Illegal repackaging Recycling used packages Sales of rejects Smuggling Tampering Upgrading in product hierarchy/ dosage Brand owner Theft Changing expiry date 11/01/2011 6

7 Counterfeiting is mass killing of innocent people Over the last 40 years, more than 65,000 people have been killed or injured in transnational terrorist incidents,......while estimates of deaths caused by fake medicines range from tens of thousands to hundreds of thousands annually. In China, almost 200,000 individuals died in a single year from fake medicines : Ronald K. Noble, INTERPOL Secretary General, Opening Remarks IPC workshop Nairobi, 2008 FDA reports: 81 death in 2007/2008 due to counterfeited Heparine low molecular weight. 11/01/2011 7

8 Counterfeiting is lucrative Ref: Pfizer 11/01/2011 8

9 Counterfeiters becomes more sophisticated Low End Counterfeiter Refilling or poor copy of original packaging No API, diluted API, or wrong API No continuity, hit and run business model Garage operation Counterfeited products usually easy to identify Brand damage to original manufacturer Extremely high risk for patients Sophisticated Counterfeiter Full counterfeit of product and packaging API often of acceptable quality Sustainable business Organized crime using high end equipment Counterfeited products very difficult to identify Business damage to original manufacturer Comparatively lower risk for patients 11/01/2011 9

10 Coding Technologies 11/01/

11 Basic principle of serialization Each product gets an individual unique code Today Mass of anonimous products Tomorrow Each item has an individual number EFPIA Code Structure Data Matrix (01) 14 Ziffern (10) Lot (17) Exp digits (10) (17) (21) EAN Serialisierung 11/01/

12 The transparent global Supply Chain is not possible! ILLUSION! 11/01/

13 Track- and Trace Reality Protection of the distribution channels Legal manufacturer Distributor Patient Trusted Distribution Channel Trusted Distribution Channel Checking required (Time/ Location)? Unknown source Distributor /01/2011 Page 13 13

14 Serialized Packaging hierarchy required for tracing the products Data Matrix Code Apply tracing label Apply shipping label Product Folding box Bundle/ Display carton Palette box/ (int. palette) Shipping box/ Shipping palette Scan folding box label Scan tracing label Scan palette label Scan shipping label Correlate Correlate Correlate /01/2011 Page 14 14

15 IT- architecture for serializing / Track- & Trace ERP 4 MES 3 SCADA 2 PLC 1 Parts Abfüllanlagen assembly lines 1 Packlinie Packlinie Packaging lines Serialisierung No Killer solution available today 11/01/

16 Security Technologies 11/01/

17 Authentication processes Security aspects: Selectivity of readings Interpretation of readings Disclosure of secrets to authenticator Technical aspects: Calibration of instruments Maintenance of instruments Process aspects: Availability of instruments Training of inspectors Maintain the chain of evidence /01/2011 Page 17 17

18 Overview on security technologies Security Technologies Serializing Authentication Technologies Tamper Evidence Identification Logical Physical Labeling Track-& Trace Cryptographic Overt Gluing Structure Covert Deliberate Mistakes 11/01/

19 Overview on Security Technologies 11/01/

20 Effectiveness of different technologies against various frauds Fraud Security technology Serialization Authentication Tamper proof Counterfeiting Diversiont Counterfeiting new product Changing expiry date (Without Repacking) Cumulation of remaining drugs (Lucentis) Illegal upgrading within product hierarchy (Example: Drug dosage; Roche Avastin case) Contraband/ Product shift in gray markets Repackaging in counterfeited packages Tampering Tampering / Diluting Recycling of used packages Theft /01/2011 Page 20 20

21 Physical security elements require a protected supply chain Supply chain security elements Manufacturing Seurity transport Security storing Audit Order Surveillance Controlled supply Balancing Authentication processes Manufacturing Distribution Primary supply chain /01/2011 Page 21 21

22 Main functionalities of security database Authentications Statistics Internals External Prepress Units Scan Systems Registration of scanner IO/ OQ of system What packaging mat. has which features Feature Integrations Audit trail Search support Packaging Materials Security Database v4 Organizations Specification of features Security features Users External Internal Feature quality of packaging lot Incoming Quality Controls Roles User Mgt. Manuals Repositories System Administration 11/01/

23 Development 11/01/

24 Objective of a security strategy Threat Type of product piracy (Counterfeiting/ Contraband/ ) Protection level Company structure Sales Volumes & Packaging technology Market Affected product ranges Legal & Prosecution Company Potential damage Security strategy Technical- & business processes 11/01/

25 Strategic Concept Products Risk based Assessment Life saving Counterfeiting Risk Commercial value Basic Requirement Folding box Coding Authentication Technology Tamper Evidence Higher level functionality Security Track & Trace Higher level security Primary package protection Higher level folding box 11/01/

26 Development of a comprehensive security strategy Step 1 Step 2 Step 3 Analysis Concept Planning Identification of stakeholders (Persons/ Departments) Analysis existing systems (Security / Supply Chain) Analysis of threat (Actual/ future) Protection requirements (Definition of needs) Basic concept (Operational/ technical) Specifications Technical issues Business processes Security Evaluation of suppliers (Request for Information/ Proposal) Lab testing (Key elements/ -technologies) Cost estimation (Expected running cost) Investment planning (Required investments) Project planning (Time- & ressource planning) Project documentation (Report/ presentation) /01/2011 Page 26 26

27 11/01/