# Leveraging the Internet of Things and Blockchain Technology in Supply Chain Management
## 3 The Internet of Things and Its Application in Supply Chains
### IoT in Supply Chains: Weaknesses and Threats  
IoT has the potential to 'connect the unconnected' and can help to optimize supply chain operations [60] substantially. It addresses several supply chain challenges including the growing business need to enhance supply chain information transparency and improve the integrity of production data and the identity of products (i.e., the right products, at the right time, place, quantity, condition, at the right cost) [39]. However, as IoT will generate massive volumes of data across the supply chain, this data often resides in silos, which are generally underutilized and fail to extract real-time business insights. As such, data silos can be seen as trapped or hidden sources of potential business insights and value. Global analysts firm Gartner refer to data silos as 'dark data' and suggest that firms are often guilty of data hoarding ([[https://www.gartner.com/smarterwithgartner/how-to-tackle-dark-data/](https://www.gartner.com/smarterwithgartner/how-to-tackle-dark-data/)]([https://www.gartner.com/smarterwithgartner/how-to-tackle-dark-data/](https://www.gartner.com/smarterwithgartner/how-to-tackle-dark-data/))). Several issues regarding IoT security need to be addressed [61], including IoT device trust, access control, data integrity, physical tampering, and user privacy. One study revealed that 70% of IoT devices have vulnerabilities due to a lack of encryption, unprotected interfaces, poor software protection, and inadequate authorization [43]. In discussing various security and privacy challenges, [PERSON] et al. [60] argue that contemporary security solutions are inadequate because of scalability issues to process and analyze data transmitted from large networks of heterogeneous devices and the need to satisfy real-time requirements. Conventional security and privacy approaches are considered inapplicable to IoT ecosystems due to their dynamic topology and distributed nature. Besides, the current Internet architecture with its server-based infrastructure might not be able to deal with a countless number of devices and large amounts of data because individual servers may pose a single point of failure for cyber-attacks and physical damage. For instance, IoT devices are at risk from DDoS attacks, data theft, and remote hijacking. Furthermore, [PERSON] et al. [62] assert that some IoT systems lack a service level agreement to protect personally identifiable information (PII) demanded by privacy laws. Hence, this can negatively affect data integrity and security and may lead to negative repercussions in privacy protection for both individuals and firms [63]. Additionally, supply chain exchange partners may have concerns regarding the physical security and confidentiality of product information as it moves along the supply chain. Even though IoT helps supply chain exchange partners to validate and verify the authenticity of items in the supply chain, there are still some concerns about the vulnerability of IoT devices to counterfeiting, cloning, and fraudulent practices, such as unauthorized access, tampering, and manipulation of content. For example, if RFID tags are compromised, it may be possible to bypass security measures and to introduce new vulnerabilities during automatic verification processes [64]. Moreover, the manual retrieval and storage of information regarding unique tag identities in a centralized database enables the reproducing or forging of this information at any time [65]. Therefore, it is difficult to identify counterfeit products accompanied by misleading provenance histories [59]. Finally, centralized systems may pose a weakness for IoT deployments in the supply chain for traceability purposes. The existence of centralized institutions may lead to distrust (or suspicion), which may limit the further improvement of supply chains [66]. A centralized approach for data hosting and control can lead to several business risks and operational issues related to data integrity, security, and privacy.