Question 1

TJX is the parent company of popular off-price retailers like TJ Maxx and Marshalls. Based in Framingham, Massachusetts, TJX has over 2,400 stores worldwide and earned US$17.4 billion in sales during the 2007 fiscal period. On December 18th, 2007, TJX discovered that it fell victim to one of the largest data theft cases in American history. Approximately 94 million credit and debit cardholders were affected by the attack. The American Secret Service and FBI had to investigate the breach and TJX lost millions of dollars in the following years due to class-action lawsuits and investigation costs. This report will analyze the causes of TJX’s IT security weaknesses and provide recommendations on what the company should do in the short-term and long-term to ensure something like this never happens again.

Question 2

Management – TJX’s management needs to move fast and implement better IT security measures to prevent an attack like this from ever happening again. They must accomplish this while balancing lawsuits from credit card companies & customers and ongoing federal investigations while still managing day-to-day operations. TJX has already booked a provision of $168 million related to the attack and does not want to suffer any more financial loss. It also needs to regain customer confidence, which is crucial to maintaining its market leadership and sales.

Customers – TJX’s customers have lost confidence in the company’s ability to store its sensitive data. Customers are very dissatisfied with the situation and many are planning to take legal action against TJX. Customers needs TJX to reassure them that it has the ability and resources to protect their data

Federal Government – They need to track down the people responsible for this intrusion but they also need to investigate why TJX’s systems were so vulnerable. If the government concludes that TJX was negligent in their IT security measures, the government may be forced to shut down TJX until it can re-establish its IT security practices.

Payment Card Industry (PCI) Auditors – These auditors were responsible for ensuring TJX was compliant to the Data Security Standards outlined by the PCI but according to court documents, TJX did not meet 9 of the 12 requirements. Therefore the professional conduct of these auditors will be questioned subsequent to an investigation because they signed off on TJX’s systems as having no issues

Question 3

IT plays a major role in TJX and the retail industry. IT provides TJX the ability to manage up-to-date information about its inventory and its customer’s purchasing behaviour. This information is essential in creating and maintaining strong Supply Chain Management and Customer Relationship Management practices. TJX also earns billions of dollars in income through millions of transactions each year and thus, TJX needs reliable IT infrastructure and security to manage all of this traffic in a safe, private and confidential way. Finally, E-Commerce plays a huge role in today’s economy. Without dynamic IT services, companies will not be able to capitalize on the opportunities that E-Commerce present. Therefore, in order to expand its revenue streams and increase its profit margins, TJX needs to implement IT strategies that effectively support its E-Commerce endeavours.

Question 4

1. Operational Efficiency – TJX’s profit margins are very low, therefore it needs to ensure it is minimizing its operation costs as much as it can. Doing this will boost company performance. 2. Supplier Relationships – TJX depends on manufacturers and department stores to provide it with excess and off-season inventory, which it can then sell to its customers. Without strong supplier relationships, TJX risks having to operate with a lack of inventory on the sales floor, which is highly inefficient. 3. Customer Relationships – TJX’s profit margins are very low on its transactions. However, the company can combat this by strengthening its customer relationships using CRM methods.

Question 5 - People Failure Points

Lack of User Account Management: TJX’s people did not have any user account internal controls in place. If they did, the intruders would not have been able to create user accounts on the central network without being detected. Someone in TJX’s Human Resources and IT departments should have realized an excess amount of network user accounts that did not correlate to the number of TJX’s staff. However, this was not caught internally. It was also not caught externally by TJX’s financial statement auditors or the auditors responsible for ensuring TJX’s complied with PCS DSS standards. External auditors are responsible for reviewing their clients’ internal controls to make sure they are working effectively. Not only did TJX’s internal staff fail the company with respect to user account management, the external financial auditors and PCI DSS auditors did too.

Unacceptable Network Monitoring: TJX’s people failed to monitor the company’s central networks properly because intruders gained access to it for several months without being detected. This is a clear indication that TJX’s intrusion detection/prevention program was not working and the people responsible for designing this program failed the company. What is unclear is whether this was due to a lack of resources or incompetence.

Failure to Comply with Payment Card Industry Data Security Standards: According to case documents, TJX did not meet 9 of the 12 PCI DSS requirements covering encryption, access controls and firewalls. If these security features are not implemented correctly, networks will have loopholes and vulnerabilities which hackers can take advantage of. This is why the PCI DSS standards exist, to ensure companies are up-to-date with the risks facing network security. The people responsible for TJX’s failure to comply and the auditors who signed off on TJX’s practices need to be reprimanded immediately, as their actions collectively cost the company millions of dollars.

Work Process Failures

Encryption Process Failures: A major failure in TJX’s encryption process was its use of the wireless equivalency privacy (WEP) software for its encryption algorithm. This WEP encryption algorithm was TJX’s main line of defense for its wireless networks. However, according to the case, information on how to crack WEP is widely available online via simple Google searches. To make matters worse, the intruders had the actual decryption key for the WEP software in use at TJX. WEP software does not provide acceptable defence for TJX. WEP is more applicable for household use. For example, most people who have Wi-Fi at home protect it with a WEP key. It is totally unacceptable for a company like TJX, which stores millions of customers’ private information to be using WEP software to protect its wireless networks. Also, TJX did not start encrypting customer data until after April 7, 2004. However, because TJX was not purging its customer data regularly as required by PCI DSS, the intruders had access to customer data that was acquired by TJX as far back as 2002. This data that was received since 2002 was not encrypted because encryption was only implemented by TJX in 2004, therefore the intruders had easy access to it.

Processing Logs Process Failures: TJX did not keep logs that provided key information about files on its central system. Information kept in logs includes: when files were created, deleted, moved and accessed. Logs also provide network administrators with user information that describes which employee deleted/created/accessed certain files. If TJX maintained a processing log, it not only would have detected the intruders’ suspicious files earlier, it also would have been able to gain a better understanding of the scale of the intrusion.

In-Store Kiosk Process Failures: The internal processes regarding the in-store kiosks were not effective. Why weren’t the in-store kiosks locked? Why weren’t USB driver hardware covered so that the intruders could not stick their flash drives into the machine? TJX could have installed an alarm lock, so that if the kiosks were broken into, a sound would go off to alert store employees.

Firewall Processes: TJX’s firewalls were not set-up to defend against traffic coming from in-store kiosks. This process deficiency left TJX’s central networks very vulnerable. Every device that offers a point of access to TJX’s networks needs to have a firewall defending it. Further questions can be asked about why in-store kiosks were given direct access to the Framingham network in the first place. Such small, high-risk devices should not have direct access to TJX’s central networks.

No Business Continuity Plan or Disaster Recovery Plan: Both of these plans are necessary emergency responses that need to be designed and implemented by companies that store sensitive information. However, both did not seem to be in effect at TJX since upon discovery of the intrusion, TJX had to call in external companies to determine what was going on. TJX’s internal processes were not even able to confirm whether or not an actual intrusion had taken place.

Specific Technology Failure Points

Firewalls: Because there was no firewall technology implemented to analyze the information being transmitted from in-store kiosks, the intruders were able to gain access into the central networks housed in Framingham undetected. This could have been avoided if a firewall was installed.

Encryption: TJX’s use of WEP encryption software instead of Wireless Application Protocol (WPA-2) software was another technology failure. WEP encryption software is not safe enough to be used to guard TJX’s wireless network because hackers can find ways to gain access to the decryption keys. On the other hand, WPA software standardizes the way that wireless devices can be used. Therefore, even if a hacker was able to gain control of a device encrypted with WPA-2, it would not be able to access TJX’s central networks because the device would not have been granted access to do so by network administrators.

Question 6 - Short Term Priorities

Regain Compliance with PCI DSS Immediately: TJX needs to make the necessary adjustments to its network systems to ensure compliance with the PCI standards. The fact that TJX is a level 1 PCI company, yet it failed to comply with the data security standards is totally unacceptable.

User Access/Account Controls: TJX did not have any effective data encryption on its networks. There were also no signs of user account internal controls in place. I recommend TJX implement an Advanced Data Encryption Standard, a user access auditing system and a single sign on solution. By implementing a single sign on solution, network administrators can be more accountable over who is actually singing onto the central networks. They do not have to sift through the multiple access points that were previously available in TJX’s legacy systems. Now with a single sign on solution, if an intrusion is detected, TJX’s IT Security team can quickly pinpoint which user is abusing the system.

Firewalls and Encryption Technology: TJX needs to plug loopholes regarding its firewall and encryption software. TJX needs to develop firewalls that monitor information received from any device that has access to the central network. This includes developing firewalls to guard against data being received from in-store kiosks. With regards to encryption, TJX needs to update its wireless network encryption software from WEP to WPA-2 immediately because the intruders have the decryption key for the WEP software currently being used by TJX.

Create a Disaster Recovery Plan and Use Tiger Teams to Test Vulnerabilities: TJX needs to have a disaster recovery plan in place. Without one, it leaves itself open to numerous risks subsequent to the discovery of an IT system issues. These risks can be avoided if a thorough disaster plan is in place. Furthermore, TJX should employ Tiger Teams to come in periodically to test for loopholes and vulnerabilities in its IT networks. A Tiger Team is a team of expert hackers who try to hack into a company’s networks in order to identify any potential threats or points of failures in an IT environment. By implementing Tiger Teams, TJX can always be on guard for new threats to its system and make the necessary adjustments and adaptations to remain safe. Outsource IT Security to Trusted Outside Vendors: Storing data is not one of TJX’s core competencies. The company is a trusted off-price retailer. Therefore, TJX should consider outsourcing its IT Security Processes to trusted vendors instead of internalizing it. The following process can be easily outsourced at a fairly low cost:

Transactional Data and Point of Sale Process (POS): TJX’s customers have lost confidence in the company’s ability to store their transactional data. TJX handles millions of transactions every year and many of them involve credit cards, debit cards and cheques. Because TJX has proven it does not currently have the ability to keep this data safe in its networks, it would be best for TJX to outsource this process in order to regain customer confidence. There are many firms that offer merchant services for an affordable price. These companies will store the customer data on behalf of TJX for a small fee per transaction. TJX should look into companies like Merchant Warehouse and TransFast, who charges 19 cents per transaction. TJX should consider outsourcing its data warehousing within the next 6 months. Doing this would shift accountability of customer data away from TJX and will help re-establish assurance for customers because their information is kept with a trusted business that specializes in data warehousing.

High Level Long-Term Recommendations

1. Expand IT Security and Compliance Staff to maintain the progress made once short-term recommendations are implemented. This team of staff needs to be highly qualified and must be given the adequate financial and technical resources needed to ensure TJX’s networks are protected and the company is compliant with PCI DSS 2. Create a new committee on the board of directors that monitors the company’s IT security processes. This committee will ensure the company is making a commitment to being up-to-date with current IT technologies. Therefore, when something changes in the marketplace, TJX will be proactive and make the necessary adjustments to its networks to plug all loopholes. With this committee, TJX will ensure it is progressive in its IT policies and implementation. 3. Create lasting partnership with outside IT vendors that specialist in data security and processing. Similar to TJX’s strategic partnerships with clothes manufactures and department stores, if TJX can negotiate effectively with IT vendors, it can develop a strategy to outsource its IT needs at a price that is cost effective. Doing this will free up human capital and will allow TJX to focus on its core competencies.

Question 7
TJX cut corners, which created risks. TJX cut corners by keeping WEP as its encryption software instead of updating to WPA-2. It also cut corners by not updating its firewalls to ensure kiosk data was being analyzed. At the minimum, the company should have ensured it was compliant with PCI DSS standards, which it was not. The retail environment is very competitive. In order to sustain success, companies must find ways to create operational efficiencies. However, IT infrastructure and security is not an area that should be lacking resources. Companies need to understand that IT is not just an isolated department. It is a business issue that affects the entire firm. TJX was definitely not a victim in this situation. The intruders’ ease of access into TJX’s central system and the time spent without being detected prove TJX did not have sufficient resources and infrastructure dedicated to its IT department.

Smart, profitable retail organizations get into these types of situations because data warehousing and IT security is not one of their core competencies and thus they fail to provide it with the necessary resources to ensure hackers do not compromise the systems. It boils down to placing a value on customer confidence. TJX kept trying to cut corners by not updating its technologies (e.g. Continued using WEP key, lack of firewalls, etc.) but failed to understand that if things went wrong, which they did, customer confidence would plummet. Now, it may be difficult to put a price on customer confidence but it is a form of goodwill that takes years to build up and just days to lose. TJX had to incur costs of $168 million directly related to the attack. It is uncertain just how much the company stands to lose from former customers who do not trust TJX with its information anymore.