...Questions for Security Breach at TJX 1. What are the (a) people, (b) work process and (c) technology failure points that require attention? Discuss each of the three issues in detail. 2. Provide a set of recommendations that can be used to improve and strengthen TJX’s IT security. What should be the short term priorities and long term plans for TJX in handling IT security? 3. Was TJX a victim of ingenious cyber crooks or did it create risk by cutting corners? How did a smart and profitable retail organization get into this kind of situation? Case Analysis Questions for Security Breach at TJX 1. What are the (a) people, (b) work process and (c) technology failure points that require attention? Discuss each of the three issues in detail. 2. Provide a set of recommendations that can be used to improve and strengthen TJX’s IT security. What should be the short term priorities and long term plans for TJX in handling IT security? 3. Was TJX a victim of ingenious cyber crooks or did it create risk by cutting corners? How did a smart and profitable retail organization get into this kind of situation? Case Analysis Questions for Security Breach at TJX 1. What are the (a) people, (b) work process and (c) technology failure points that require attention? Discuss each of the three issues in detail. 2. Provide a set of recommendations that can be used to improve and strengthen TJX’s IT security. What should be the short term priorities and long term plans for TJX in handling...
Words: 785 - Pages: 4
...Security Breach at TJX 1. Identify & describe the failure points in TJX's security that requires attention (including, but not limited to: People, Work Process, and Technology)? After analyzing the Ivey case on TJX data fiasco, I would say there were three major failure points that caused this $168MM financial hit to the corporation. * Technology: it is obvious that TJX had several technology deficiencies mainly driven by systems limitations and vulnerability. For example, inadequate wireless network security allowed the hackers to attack specific stores just by using a laptop and an antenna which permitted the thieves access to the central database. As it was mentioned in the business case, TJX was using (WEP) as the security protocol and it is well-known in the e-commerce arena that WEP encryption can be deciphered in less than one minute which makes it very unreliable and risky for business transactions. Last but not least, TJX failed to encrypt customer data. * Auditors: it is concerning that TJX passed a PCI DSS check up and that non auditor noticed the technology issues TJX was facing. * Executives at TJX: It is evident that the company wasn’t in compliance with the Payment Card Industry (PCI) standards. Primarily, the person in charge of the IT department should have been on top of ensuring TJX to be in compliance, by setting expectations and objectives pertained to security within its organization. In addition to the head of IT, I...
Words: 826 - Pages: 4
...Question 1 TJX is the parent company of popular off-price retailers like TJ Maxx and Marshalls. Based in Framingham, Massachusetts, TJX has over 2,400 stores worldwide and earned US$17.4 billion in sales during the 2007 fiscal period. On December 18th, 2007, TJX discovered that it fell victim to one of the largest data theft cases in American history. Approximately 94 million credit and debit cardholders were affected by the attack. The American Secret Service and FBI had to investigate the breach and TJX lost millions of dollars in the following years due to class-action lawsuits and investigation costs. This report will analyze the causes of TJX’s IT security weaknesses and provide recommendations on what the company should do in the short-term and long-term to ensure something like this never happens again. Question 2 Management – TJX’s management needs to move fast and implement better IT security measures to prevent an attack like this from ever happening again. They must accomplish this while balancing lawsuits from credit card companies & customers and ongoing federal investigations while still managing day-to-day operations. TJX has already booked a provision of $168 million related to the attack and does not want to suffer any more financial loss. It also needs to regain customer confidence, which is crucial to maintaining its market leadership and sales. Customers – TJX’s customers have lost confidence in the company’s ability to store its sensitive...
Words: 2721 - Pages: 11
...How was TJX vulnerable to breaches? How did the situation escalated into a full scale breach. TJX was vulnerable to the breach because of failed attempts to update security which could have prevented the breach. TJX performed an audit and it found that it was non-compliant with 9 of the 12 requirements for a secure payment transaction. Gonzalez used a simple packet sniffer to hack into the system. The packet sniffer Gonzalez used went undetected for several months. TJX failed to notice any data being transferred from their own server which allowed them to lose 80 GB of data. Gonzalez had blind servers in Latvia and Ukraine that were used to breach the system (NT2580: Week 1). Gonzalez performed reconnaissance on their retail stores. Then Gonzalez determined a weakness in the payment systems and utilized malware to intercept credit card information. Gonzalez committed this crime between 2006 through 2008 before being caught. Gonzalez was an informant for the Secret Service which Gonzalez took part in an undercover operation related to a card theft case (Sileo, Operation Get Rich or Die Tryin' Still Lives). Gonzalez was sentenced for the largest computer crime case that has been documented. The only motive Gonzalez has was technical curiosity and obsession with conquering computer networks. Gonzalez’s attorney argued that some of the loses were the result of TJX’s own negligence. If security upgrades were done then it may have prevented the breach (Zetter,TJX Hacker Gets...
Words: 407 - Pages: 2
...Check point TJX Company IT/205 MAY 24, 2012 Check point TJX Company Information security means protecting information systems from unauthorized access. To my understanding TJX failed to properly encrypt data on many of the employee computers that were using the wireless network, and did not have an effective firewall installed. In the reading it indicated that TJX was still using the old Wired Equivalent Privacy (WEP) encryption system, which is relatively easy for hackers to crack. The Wi-Fi equivalent privacy (WEP) was considered old, weak and ineffective, therefore I could say the security breach that TJX had experience was a resulted by using a cheap and inexpensive wireless Wi-Fi network like the Wired Equivalent Privacy (WEP) encryption system, which make it easy for hackers to navigate. This is why it is important that TJX should have invested in using the wireless Wi-Fi Protective access 2 (WPA2) The Wi-Fi Protected Access 2 (WPA2) standard in conjunction with a sophisticated encryption system could have been used to replace the WEP. In that situation an effective firewall would have prevent unauthorized users from accessing private networks, meaning firewall acts like a gatekeeper who examines each user’s credentials before access is granted to a network. An effective Firewall could have reduced the ability for hackers to gain access to sensitive information. A data security breach could result a variety of issues some of them could be loosing of confidence...
Words: 436 - Pages: 2
...Executive Summary The TJX Corporation is a large retailor with stores throughout the United States,, Puerto Rico and United Kingdom. In 2005, a security breach of credit card information occurred through a seventeen-month period. The intrusion of customer personal information has grossed the concern of the security among their IT infrastructure. The following criteria based upon their security concerns and customer relationships recovery. Their growth as a discount retailer is dependent on the course of action they must take. They will adhere to a secure network, protect their stored data, prevent future intrusion of their system, restrict access to unauthorized users and frequently test for the implementation of their security measures. TJX will focus on establishing IT governance, mitigate risk, and develop a management strategy through the following alternatives. They will focus on hardware and software upgrades to prevent future attacks of their communication lines and their network through enhanced software and data encryptions. A Payment Card industry Data Security standard has been established and must be maintained by TJX, an implementation from the IT security team will be completed on a regular basis ensuring that all files and file transfers are appropriately encrypted. Internal and external security and network audits will need to be performed on a regular basis to comply with the PCIDSS. This will allow for testing of their system access and identify concerns within...
Words: 3688 - Pages: 15
...Problem Statement The main problem of the case is: • How should TJX improve and strengthen its IT security? What should be its short-term and long-term goals in-order to achieve this goal of strengthening its IT security? Inorder to solve this problem, TJX should identify and solve the following issues: • What are the people, work processes and technology failure points that require attention? • What practices led to the security breach in TJX and why did such a smart andprofitable organization as TJX face such a situation? • Was TJX a victim of ingenious cyber crooks or did it create risk by cutting corners? Financial Losses and related remedies: 1. TJX had booked a cost of $168 million for the data breach it had announced in February 2007. 2. $21 million is projected as a possible hit for 2008. 3. Three years of credit monitoring and identity theft insurance coverage for all the customers, whose identification information was compromised. 4. Offer vouchers to customers who shopped at TJX during security violation and who had incurred certain costs as a result of intrusion. b. Describe the industry situation Customers 1. Many customers use credit and debit cards for their shopping. 2. Customers take security issues very seriously and file class actions in the court against the company in any such critical situations. Traditional Competitors 1. Department and specialty stores. ...
Words: 733 - Pages: 3
...card information. One of these corporations just happened to be TJX. The TJX network was not secure enough from the start. The company was using inadequate wireless security protocols. They used WEP security (wired equivalent privacy) which is easy to crack and a good hacker could break into this type of network security really fast. A hacker with a laptop could simply sit outside the store and break into the network in less than a minute. TJX should have been using the much stronger wireless security protocol WPA (WI-FI Protected Access Protocol). TJX also stored card data improperly. They stored credit card information such as pin codes and cvc codes which are on the back of most credit cards. PCI Data security standards states that sensitive data such as the PIN and CVC codes should not be stored. So the company broke protocol by storing this information. Even though a network breach occurred, this vital card information may have not been exposed if it wasn’t stored on the company network. Finally, the stored data was not encrypted. Another PDI protocol was broken by not properly encrypting the data. Any account number should be rendered unreadable according to the security protocols. TJX did not do this either which meant another protocol broken. These breaches of security had a significant impact on the TJX Company. Over 45 million card numbers were stolen which cost customers over 4 billion dollars. TJX was sued by the major card companies and by the...
Words: 396 - Pages: 2
...Analysis of TJX Vulnerabilities Chantelle M. Jones ITT Technical Institute Online NT 2580 The breach that was made from “Operation Get Rich or Die Tryin’” compromised the customer’s credit card information when performing transactions with TJX. The credit card information was obtained and sold which forced the company to lose out on millions of dollars and their customers became victims of identity theft. TJX was vulnerable to breaches because they failed to implement a proper IT security infrastructure within their network. Customer confidential information was saved in plain text. It was not encrypted which makes it easier for attackers to obtain the information. They were not to be in compliance with payment card industry (PCI) security standards. TJX also did not restrict wireless access to their network and failed to notice 80 GB of stored data being transferred from their servers. They also did not follow up on security warnings and intruder alerts. It took IT seven months to discover the packet sniffer then failed to notify their customers. The attack escalated to a full-scale breach because even after the packet sniffer was discovered, there was no disaster recovery plan put into motion in order to stop the threat from doing more damage. They were noncompliant with numerous requirements for secure payment and transactions. One of which is the absence of logs. It would be much more difficult to eradicate threats without knowing when, how or where they took place....
Words: 280 - Pages: 2
...The IT security breach, caused by one Albert Gonzalez and his accomplices, is one of the most expensive lessons in corporate data security policies. For TJX this is more so as it is not only just that, it’s a black spot on the companies security record and has earned quite the problem as people no longer trust the company due to just how many security issues came to light with Albert’s breach. The TJX stores were foolishly using the relatively weak Wired Equivalent Privacy (WEP) protocol instead of updating to the stronger Wi-Fi Protected Access (WAP) protocol, making it much easier for the breaches to occur. However, the real damage came from the fact that the intruders were able to access the TJX internal systems, being able to move around freely for almost two years. The breaches occurred from the middle of the year 2005 and ran through December 2006, while an estimated 47.5 million records were stolen during that time period. TJX’s other security problem was because they allowed the hackers free roam for pretty much 18 months, showing the company didn’t keep proper traffic logs for their system, the company being unable to find them due to the need to look through all of their systems to try and determine just who it was that took what data, from where, where it was sent, and so on. Because of this, the investigation into the matter took them months and months, giving their opposition all that time to continue messing around their database. It’s also expected that TJX might...
Words: 625 - Pages: 3
...Checkpoint - TJX Companies IT/205 March 1, 2013 Checkpoint - TJX Companies This week’s checkpoint deals with the credit card data theft at TJX companies which occurred in July of 2005. According to the book Essentials of MIS, the thieves used a vulnerable wireless network from one of the department stores on the TJX network to gain access. (Laudon & Laudon, 2011, p. 243) After the thieves had access to the network the installed a sniffer program on one of the main computers of the network. They then were able to download any information that they needed to. The TJX Company was still using outdated weak wireless security encryption called WEP, (Wired Equivalent Privacy), instead of upgrading to a more secure version of wireless security, WPA, (Wi-Fi Protected Access). They also did not have any firewalls or data encryption in place. (Laudon & Laudon, 2011, p. 243). The tools that was needed to be in place to help stop this from happening was, the stronger wireless security of Wi-Fi Protected Access (WPA) standard with more complex encryption, they also needed to install strong firewalls, data encryption on computers, and to transmit credit card data to banks with encryption. This breach had some lasting effects on the TJX Company. One of the first effects was that the company had to strengthen the company’s information system security. They also had to agree to have a third-party auditor review their security measures every two years for the next twenty years...
Words: 388 - Pages: 2
...Week 1: Understanding IT Infrastructure Security Case Study Hello my name is YGS and I am an Independent contractor for TJX, they have requested my assistant and I will be in charge of all IT matter at TJX. In recent happenings at TJX you should by now be aware that this company was breached by a hacker by the name of the Albert Gonzalez. He stole over $170 million dollars of customer’s credit card information. As a result TJX has taken a major financial loss and our honor and credibility is in question. The reason we are in question is because it turns out the matter was not discovered until an outside source (our gateway/payment-card processing) partners came in and performed an audit to then discover we were breached. Before the audit we should have caught the transfer of 80 GB of stored data by Mr. Gonzalez. Prior to any breach of this company TJX should have been compliant with the payment card industry compliance and validation regulations. In complying with the Federal Trade Commission (FTC) under FTC jurisdiction our IT team should be consistently taking measures in place to keep customer information secure at all times. By being on top of things we would have been less vulnerable to an attack of this size and speared the embarrassment of not discovering the breach for over seven months. To of eradicated this from ever happening TJX should have made sure that our payment gateway client was compliant with their firewall configuration, protect stored cardholder...
Words: 361 - Pages: 2
...January of 2007 the parent company of TJMaxx and Marshalls known as TJX reported an IT security breach. The intrusion involved the portion of its network that handles credit card, debit card, check, and merchandise return functions. Facts slowly began to emerge that roughly 94 million customers’ credit card numbers were stolen from TJMaxx and Marshalls throughout 2006. It was believed that hackers sat in the parking lots and infiltrated TJX using their wireless network. Most retailers use wireless networks to transmit data throughout the stores main computers and for credit card approval. The wireless data is in the air and leaks out beyond the store’s walls. TJX used an encryption code that was developed just as retailers began going wireless. Wired Equivalent Privacy or WEP is a wireless encryption code developed in 1999 that retailers began to implement. Within a couple of years hackers broke the encryption code and rendered WEP obsolete. Many retailers In January of 2007 the parent company of TJMaxx and Marshalls known as TJX reported an IT security breach. The intrusion involved the portion of its network that handles credit card, debit card, check, and merchandise return functions. Facts slowly began to emerge that roughly 94 million customers’ credit card numbers were stolen from TJMaxx and Marshalls throughout 2006. It was believed that hackers sat in the parking lots and infiltrated TJX using their wireless network. Most retailers use wireless networks...
Words: 314 - Pages: 2
...Computer Security & Privacy - TJX Case Backgroud: TJX, largest apparel and home fashions retailers in the off-price segment was struck with Security Breach in all of its eight business units in US, Canada and Europe. Intruder had illegally accessed TJX payment system to hack personal and credit/debit card information of an unspecified number of customers. Security breach had affected Customers - pay for the purchases made by the intruders/ card invalidated / expiring the spending power, Financial Institutions –re-issue the cards for those customers whose information was compromised, Store Associates –change their credentials for system access, Vendors, Merchandisers - Modify the information shared due to mutual network and Richel Owen, CSO- design long and short term strategy to address the security breach issue. Intruders utilized the data stolen to produce bogus credit/debit cards that can be used at self-checkouts without any risks, and had also employed gift card float technique. Case Analysis: TJX learnt about the hacking on December, 2006 through the presence of suspicious software and immediately called in Security consultants for assistance. TJX had been intruded at multiple vulnerable points – Encryption, Wireless attack, USB drives, Processing logs, Compliance and Auditing practice. Encryption - Intruder had accessed the card information during the approval process and had the decryption key for the encryption software used in TJX. This can be addressed by purchasing...
Words: 620 - Pages: 3
...Findings……………………………………………………………………..4 3.1 Issues of Online Identity Theft …………………………………………...4 3.2 Trends of Online Identity Theft……………………………………………5 4. Case Study………………………………………………………………………..7 4.1 Background…………………………………………………………………..8 4.2 Analysis……………………………………………………………………….8 5. Recommendations and Conclusions……………………………………..…9 Executive Summary Identity theft make a lot of customers and organisations suffer serious loss both financially and emotionally. It is necessary to build acknowledge of identity theft to protect the interest of customers and organisations. This report finds the different methods and trends of identity theft and gives some advices for protection. A case study of TJX breach case shows the harm of identity theft in an organisation. 1. Introduction The internet technology has greatly changed the world in which human live since 1990s. Nowadays, internet has gone deep into people’s daily life and its high productivity, efficiency and convince make people deeply rely on it. Online business and social network have become the most important contributions of internet. As the growth of e-commerce and number of users of social networking websites, the target of identity theft has broadened. In e-commerce, identity theft threats not only the customers’ information and property safety but also the interest of corporate. On the social networking websites such as Facebook, users usually use their real e-mail address...
Words: 2731 - Pages: 11
