Analysis of TJX Vulnerabilities

Chantelle M. Jones

ITT Technical Institute Online
NT 2580

The breach that was made from “Operation Get Rich or Die Tryin’” compromised the customer’s credit card information when performing transactions with TJX. The credit card information was obtained and sold which forced the company to lose out on millions of dollars and their customers became victims of identity theft. TJX was vulnerable to breaches because they failed to implement a proper IT security infrastructure within their network. Customer confidential information was saved in plain text. It was not encrypted which makes it easier for attackers to obtain the information. They were not to be in compliance with payment card industry (PCI) security standards. TJX also did not restrict wireless access to their network and failed to notice 80 GB of stored data being transferred from their servers. They also did not follow up on security warnings and intruder alerts. It took IT seven months to discover the packet sniffer then failed to notify their customers. The attack escalated to a full-scale breach because even after the packet sniffer was discovered, there was no disaster recovery plan put into motion in order to stop the threat from doing more damage. They were noncompliant with numerous requirements for secure payment and transactions. One of which is the absence of logs. It would be much more difficult to eradicate threats without knowing when, how or where they took place. Logs are a critical part of the security infrastructure.
References
Clark, C. (2009, December). How ethics can enhance information security: Lessons from the ChoicePoint and TJX Data breaches. Retrieved from academia.edu: http://www.academia.edu/1091975/How_ethics_can_enhance_information_security_Lessons_from_the_ChoicePoint_and_TJX_Data_breaches