Tonisha Miller
IT/205
Jennifer Gilmore
CheckPoint: TJX Companies
The old Wired Equivalent Privacy (WEP) encryption system was the security controls in place. A Wired Equivalent Privacy (WEP) is not very effective. WEP is built into all standard 802.11 products, but its use is optional. Many users neglect to use WEP security features, leaving them unprotected. The basic WEP specification calls for an access point and all of its users to share the same 40-bit encrypted password, which can be easily decrypted by hackers from a small amount of traffic. Stronger encryption and authentication systems are now available, but users must be willing to install them. TJX had also neglected to install firewalls and data encryption on many of the computers using the wireless network, and didn’t properly install another layer of security software it had purchased. TJX acknowledged in a Securities and Exchange Commission filing that it transmitted credit card data to banks without encryption, violating credit card company guidelines. TJX also retained cardholder data in its systems much longer than stipulated by industry rules for storing such data.
The tools and technologies that could have been used to fix the weaknesses are some of the following: General controls govern the design, security, and use of computer programs and the security of data files in general throughout the organization’s information technology infrastructure. On the whole, general controls apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.
A risk assessment determines the level of risk to the firm if a specific activity or process is not properly controlled. Not all risks can be anticipated and measured, but most businesses will be able to acquire some understanding of the risks they face. Business managers working with information systems specialists should try to determine the value of information assets, points of vulnerability, the likely frequency of a problem, and the potential for damage.
A security policy consists of statements ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving these goals.
Authorization policies determine differing levels of access to information assets for different levels of users. Authorization management systems establish where and when a user is permitted to access certain parts of a Web site or a corporate database.
Disaster recovery planning devises plans for the restoration of computing and communications services after they have been disrupted. Disaster recovery plans focus primarily on the technical issues involved in keeping systems up and running, such as which files to backup and the maintenance of backup computer systems or disaster recovery services.
Business continuity planning focuses on how the company can restore business operations after a disaster strikes. The business continuity plan identifies critical business processes and determines action plans for handling mission-critical functions if systems go down.
An MIS audit examines the firm’s overall security environment as well as controls governing individual information systems. The auditor should trace the flow of sample transactions through the system and perform tests, using, if appropriate, automated audit software. The MIS audit may also examine data quality.
The business effect of TJX’s data loss on TJX, consumers, and banks were things as such in March 2008, TJX management agreed to strengthen the company’s information system security. It also agreed to have third-party auditors review security measures every 2 years for the next 20 years. TJX has already spent over $202 million to deal with its data theft, including legal settlements. Forrester Research estimates that the cost to TJX for the data breach could surpass $1 billion over five years, including costs for consultants, security upgrades, attorney fees, and additional marketing to reassure customers. Hannaford Bros. also started implementing additional security safeguards. It updated firewalls, installed a round-the-clock security monitoring and detection service from IBM, and also began encrypting traffic flowing over a private network from its store registers to its credit card processor. (The existing Payment Card Industry Data Security Standard [PCI DSS] guidelines, which apply to all companies processing credit cards, only require encryption of data transmitted over public networks.)
The moral dimensions that could be applied in this situation are such as moral judgment or a moral obligation because the company knew that they did not have adequate security and tried to get away with it, but got damaged through their trust from others in the process and got caught, and after it was their obligation to take care of the problem as they did.