Situation
Nike’s ED&A organization ran the company’s data analytics stack and was duplicating it inside China, covering supply chain, warehouse, distribution, and online and retail sales. Nike was also acquiring Zodiac, a data-analytics and marketing firm. Separately, Nike’s Tech Innovation team wanted to build NFTs on Ethereum on Azure, and the first build of the contracts was not working.
Objective
Help the ED&A VP own and manage ED&A’s security risk, using the embedded-consultant model from the CIS mission. On the innovation side, get Nike’s NFT effort working and show what it could become.
Approach
Embedded AppSec for ED&A. I was the assigned security consultant to the VP of ED&A, aligned to that VP and helping manage that VP’s risk.
- A risk-register tool. For myself and my peers, I built a web app that pulled our VP’s risk-register entries, flagged open issues and outstanding actions, and rolled them into a report we could annotate, for example “we’ll facilitate filing an exception,” before passing it to the VP. It made the embedded-consultant job systematic.
- The China analytics build. My biggest focus was security for duplicating ED&A’s full analytics stack in China. AWS in China was about 2 to 3 years behind AWS US, so many of the patterns we relied on were not available yet, which meant work across the whole stack.
- The Zodiac acquisition. I was on Nike’s due-diligence team as ED&A’s AppSec consultant, then supported the post-acquisition migration and integration on the security side.
Half-time Tech Innovation project. I took the NFT effort as a half-time stretch assignment and built and proposed:
- A clone of CryptoKitties, rebuilt for Nike.
- A GAN for image generation, for “people who don’t exist.”
- An extension fusing the two, so the GAN could take a shoe’s design language, description and details and generate a near-photorealistic NFT for any given Nike shoe.
- A “Collab” mechanic: two holders each stake an NFT they own, and the GAN generates a new shoe from their combined “DNA.”
- Nike NFTs tied to customer accounts, issued on purchase confirmation.
- A Nike stablecoin to replace the Nike gift-card system, proposed and prototyped.
- A full Azure provider for Terraform, since this was Nike’s first Azure project and Nike was a Terraform shop.
I also visited a local tokens and NFT company with the Tech Innovation lead.
Net results
- ED&A reached the fewest open risks of any org I supported.
- My peers used the risk-register tool in their own embedded work.
- The China analytics build landed.
- The innovation project produced working NFT, GAN and stablecoin prototypes and a Nike Azure provider for Terraform. When COVID hit, Nike cancelled the innovation projects. Nike later entered NFT sneakers through its RTFKT acquisition, the space prototyped here.
Takeaway: partnering inside the business org is what drove its open risks down.
Scope and technologies
AWS, US and China. Azure, Nike’s first Azure project. Terraform, with a full Azure provider I built. Ethereum, NFTs and smart contracts. GANs for generative image synthesis. CryptoKitties-style on-chain mechanics. A custom risk-register web app. The ED&A data analytics stack, covering supply chain, warehouse, distribution, and online and retail.