Risk and responsibility in the sustainable fashion industry.

How can technology help us build a more sustainable and responsible world?

The fashion industry has been labelled the second most damaging industry to the environment only after oil and gas. The UN claim that it is responsible for more CO2 emissions than all the international flights and shipping in the world COMBINED.

As a consumer and lover of fashion this was a realisation I struggled with. I couldn’t believe this industry could be so destructive. I looked deeper and saw things like the rise of fast fashion companies uploading over 500 new garments per week to their websites. The UN claim that it takes 10,000 litres (about 3000 gallons) of water to make one single pair of jeans. To put that into context a human being needs to drink around 3 litres of water a day which means this is over 9 years of drinking water for an adult just for one pair of jeans.

High street fashion labels seemed to ignore the impact of their actions or pay lip service to it. Whilst researching this article I saw a high street retailer place “made from 100% recycled material” on a garment label, it was then discovered this ONLY related to the cardboard label and not the garment to which it attached.

Trust

This starts to erode the trust consumers place in brands. While this example is deliberately deceptive, there is a serious point about these companies generally not knowing where the components in their products are coming from. We as consumers don’t TRUST fashion brands to be transparent about their supply chains. Do they really know where the ingredients come from, and how do they keep control of it?

I launched a poll on Twitter, asking people whether they trusted fashion brands when they claim their clothing lines are “environmentally friendly”. Out of the 191 votes 98% said “no - they would want to see proof”.

Unruly Suppliers

The fashion industry is far from the Wild West though. In order to launch ethical or sustainable garments there are certificates that need to be obtained. There needs to be proof that the supply chain honours environmentally friendly practices, human rights, and that safe and sustainable work conditions are met. The trouble is supply chains can be large unruly beasts. Ever changing with many dependencies. If I have suppliers in India, Vietnam and Italy, how do I as a brand keep track of their compliance with the ethical standards, I have promised my consumers? How do I prove this to consumers?

Supply chains can be difficult to manage at the best of times. When they are geographically spread out and using different levels and types of technology it can feel like an impossible task to manage. These supply chains are not always transparent for the brand, let alone for the consumer to interrogate before purchasing.

It made me think - In this blockchain world surely data could be utilised more effectively for all concerned?

This is a problem for many companies in the fashion industry. Consumers are becoming more interested in ensuring the items they purchase are ethically sourced. A recent study discovered that 89% of Generation Z respondents said they would rather buy from a company that was addressing social and environmental issues. This demographic is important as they now make up around 40% of global consumers. It isn’t enough to just claim “we didn’t know that was going on” anymore.

Fashion and Blockchain

During my research I came across a company called Retraced, a start-up and participant in the Oracle for Start-ups program. They have done something rather interesting. Using Oracle’s Autonomous blockchain service they have handed the empowerment and transparency back to all the concerned parties by allowing you to track compliance certificates and visually map out your entire supply chain.

I got in touch with the guys at Retraced. They were kind enough to talk to me and show me how their tool actually works. The software allows fashion brands to fully map out their supply chains, see where risks are and provide a single point of proof of environmental compliance for brands and their customers. The brands using Retraced’s platform have also been afforded another advantage during the pandemic. They can see exactly what is going on in every element of their supply chain. This allowed some of the brand to switch to new ways of working faster and with less friction.

Retraced told me that for brands and consumers to build sustainable futures, there needs to be a high degree of transparency. Part of this can be achieved by suppliers uploading certificates that prove compliance with ethical and environmental standards. The brand can quickly see who has uploaded a certificate and when that expires and needs to be renewed. Retraced are definitely not a certification authority. They use Oracle’s Autonomous Blockchain to maintain the integrity of the transactions and the history.

They told me “transparency is a journey. We are looking for progress not perfection”. This is something we need to remember both in security and in building more environmentally friendly practices.

The Security Problem

There is a problem though. Companies like Retraced are start-ups. Hugely innovative and likely to yield big changes in the world but low on resources. Obviously as a security professional I had to ask them how they were managing the cloud working environment from a security perspective. A data breach for any business could be devastating but for a start-up it could be fatal. According to the Business Impact of the Modern Data Breach report the most likely impacts of a breach as the loss of ability to provide services (45%) and loss of customers (43%). Both clearly could be the end for any business let alone a start-up.

What the Infosec Community said...

Start-ups are clearly the answer to bringing innovative solutions forward to save the environment but are low on resources to secure their estate and data. Intrigued by this issue, and the dire consequences of getting it wrong, I ran some polls on LinkedIn and Twitter. I asked whether start-ups and small companies are actually more secure by outsourcing their security and database management to large providers, such as Oracle, allowing them to focus on the core commercial activities. On both platforms a resounding 71% of security professionals said yes. What was more telling were the comments. There was interesting feedback on priorities, with people adding “concentrate on the core business” and “small companies should focus on doing what they do best. If that is security great. If not, treat like utilities”. Another suggested playing to your strengths and using the expertise, platform and resources of a larger company to do the rest.

Security First

Today’s businesses are having to embark on rapid digital transformation especially in the pandemic. In some cases they have had to rethink entire business processes and models. The global adoption of cloud applications undoubtedly helped support remote workers during the pandemic, but has also furnished cyber criminals with unprecedented levels of opportunity. The rapid migration to the cloud saw security often being an afterthought. An untenable situation. It is an opportunity though for businesses to foster a “security first” culture.

Cloud working is great. Business has continued in the pandemic remote working scenario which is a resounding success. Suddenly our expensive firewalls have been replaced with a ￡25 router at home. This was true for all Retraced’s fashion brand clients and their suppliers too.

Shared Responsibility

Everyone uses the cloud but that doesn’t mean they all understand what responsibility they still have for the data. We need to be aware of the concept of “shared responsibility”. I heard Greg Jensen from Oracle interviewed on Smashing Security. He described the concept of shared responsibility brilliantly. He said it was akin to the differences in responsibility between owning a car, renting a car and using an Uber. Even in the latter case, whilst not responsible for the vehicle you responsibilities to check the licence record and conduct yourself in an appropriate manner. So the balance of responsibility shifts but there is always a shared responsibility for data. You and your cloud provider need to work together, both doing your respective parts, to manage data properly. If one party fails you both fail. Shockingly when I read the report “Demystifying the Cloud Shared Responsibility Security Model” I saw that only 8% of businesses are confident in their ability to manage their part of the shared responsibility model.

This finding is mirrored in the Oracle and KPMG Cloud Threat Report 2020. They discovered that 92% of businesses felt they had a cloud security readiness gap. They were not fully confident in their own ability to manage things securely. Shared responsibility is a key concept that cloud providers are trying to stress.

This got me thinking. Greg Jensen’s comments about “shared responsibility” made me think that this isn’t just a concept that should be limited to the cloud and data management. It works and applies to all the global issues today: sustainability; security; diversity; equality; and wealth inequality. We are all responsible for our own data, the products we buy, the way we treat our kin, the culture in our organisations, the recruiting practices, the brands we support. We all have a part to play in cloud security and we all have a part to play in supporting responsible and sustainable fashion. So consider what is your responsibility for the data you have? And what is your responsibility for that pair of jeans you are wearing? Just because you don’t own the car doesn’t mean you have no responsibility.

Links

Twitter poll on the level of trust in fashion brands: https://twitter.com/LisaForteUK/status/1305461337359880192?s=20

Twitter poll on security issues: https://twitter.com/LisaForteUK/status/1308038041861324800?s=20

Oracle and KPMG Report: https://www.oracle.com/a/ocom/docs/cloud/oracle-ctr-2020-impacts-of-data-breach.pdf