Security Breach at Tjx free essay sample

Top-level executives need to understand that IT security is a business issue and not just a technology issue. As seen by the attack, an IT security breach can mean hundreds of millions of dollars in losses, which definitely has an adverse affect on the bottom-line of the business. Further, as a Level 1 business (those that processed over six million credit card transactions per year), the PCI DSS auditor had failed to accurately assess TJX’s network, missing three of twelve encryption requirements: absence of network monitoring, absence of logs, and the presence of unencrypted data stored on the system. The lack of thoroughness on the auditor’s part certainly made the penetration of the system by attacks easier, to the point where they were so confident that they would send each other encrypted messages through the backend of the system. Furthermore, the in-store clerks dropped the ball by not monitoring the self-checkout kiosks more heavily, which resulted in attackers using USB drives to upload software on those terminals! Work process failure points that require attention are the personal information required for non-receipt merchandise returns, such as driver’s license and social security numbers. We will write a custom essay sample on Security Breach at Tjx or any similar topic specifically for you Do Not WasteYour Time HIRE WRITER Only 13.90 / page Either do not allow returns without a receipt or implement a system for nonreceipt returns that does not require the customer to give out very personal information. Technology failure points at TJX that need attention are stronger wireless protection, more complicated and unintelligible encryption, stronger firewall configuration to protect cardholder data, updated anti-virus software, and a regularly used log so that there was a track record of added, changed, and accessed information. 2. How should the company’s IT security be improved and strengthened? What should its short-term priorities and long-term plans be? Hiring Richel as the Chief Security Officer was one big step towards a better IT security program at TJX; he’s an executive who understands the harsh and costly consequences of a weak IT security system and has plans to implement the strongest system possible. Short term priorities include 1) addressing Mary Smith’s letter and taking care of the $5,000 theft, 2) implement network monitoring, 3) implement logs, 4) encrypt ALL data and minimize the time where data goes from ‘scrambled’ to ‘unscrambled’, and 5) update all components of the system, both hardware and software, to the most modern and secure in the industry. Long-term priorities should include minimizing risk by making everyone in the company, not just top-level executives, aware of the potential of another massive attack on their system. The reason why I think store clerks and managers should be made aware of their respective branch’s IT system (wireless, kiosks, card swipers, etc) is so that they know what an attack looks like when it is happening. More times than not, the invasion is happening right in front of the cashier’s face yet they have absolutely no idea. Increasing training and updating systems regularly will help ensure another attack from not happening. 3. Was TJX a victim of ingenious cyber crooks or did it create risk by cutting corners? How do smart, profitable retail organizations get into this kind of situation? Based on the article, I really have to place most of the blame on PCI DSS’ auditor. TJX is not in the business of IT Security, they are in the business of selling apparel and home goods at discount prices, and they do it on a massive level. TJX hired a company who specializes in IT Security and they failed to properly analyze their system. Nevertheless, the CTO/CSO at the time should have been well aware of minimum system requirements for a Level 1 company and could have remedied the situation long before the attacks. When you are the biggest and most profitable business in ANY industry, you become the most vulnerable for attacks, mainly because attackers get more out of the time they spend hacking. Bigger systems mean more loop holes, and the attackers won on this one.