Get Rich or Die Tryin’ ITT Technical Institute Michael Sheldon 10-30-13

Get Rich or Die Tryin’

The IT security breach, caused by one Albert Gonzalez and his accomplices, is one of the most expensive lessons in corporate data security policies. For TJX this is more so as it is not only just that, it’s a black spot on the companies security record and has earned quite the problem as people no longer trust the company due to just how many security issues came to light with Albert’s breach. The TJX stores were foolishly using the relatively weak Wired Equivalent Privacy (WEP) protocol instead of updating to the stronger Wi-Fi Protected Access (WAP) protocol, making it much easier for the breaches to occur. However, the real damage came from the fact that the intruders were able to access the TJX internal systems, being able to move around freely for almost two years. The breaches occurred from the middle of the year 2005 and ran through December 2006, while an estimated 47.5 million records were stolen during that time period. TJX’s other security problem was because they allowed the hackers free roam for pretty much 18 months, showing the company didn’t keep proper traffic logs for their system, the company being unable to find them due to the need to look through all of their systems to try and determine just who it was that took what data, from where, where it was sent, and so on. Because of this, the investigation into the matter took them months and months, giving their opposition all that time to continue messing around their database. It’s also expected that TJX might not even have saved proper logs, forcing them to search through system forensics rather than log analysis in order to figure out just whom it was that stole the data and how managed to do it. If the company had just properly collected and analyzed log data, their investigation would have gone a lot easier and would have dealt with the hackers before they did the damage they did.

TJX's second mistake came from storing vital credit card information, such as the data hidden in the card's magnetic strip, on local machines. This is a mistake as it easily allowed the hackers/counterfeiters to make fake cards… which they did. Next came in the form of lack of in-store security and not just through the computer, as the hackers used USB drives along with in-store kiosks to upload software onto the kiosks themselves, turning them into terminals that would remotely connect to TJX’s networks. This brings forth the issue of negligence, lack of monitoring and securing physical in-store IT assets. More than the mentioned bits, this also brings up the lack of proper firewalls, given how easily they could upload a program onto the in-store kiosks that allowed them to hack into the network. Moving on, TJX was transmitting data to its payment card issuers without encryption, something the Hackers were easily able to intercept for themselves. TJX has even stated in a public statement that the hackers had access to the decryption tool for the encryption software used by TJX. With all these issues and perhaps even more, it’s not hard to see how this all turned into a massive breach that was exploited against the TJX company, the company REALLY needs to get with the modern day security issues that most companies implement to protect itself, its clients, and to just stop being lazy while trying to save money… lest they end up ruined.

References
Patrizio, A. (2007, December 05). How tjx became a lesson in proper security. Retrieved from http://www.internetnews.com/ent-news/article.php/3714611