Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »
Webcast: In the Google Apps Cloud: How to Achieve Your Business Objectives
Dec 3rd, '09, 1 - 2 pm US/Eastern (GMT-5)
Join Council member Brent Hoag, Director, Global IT, at JohnsonDiversey, as he discusses the adoption of Google Apps which has helped meet four corporate goals; sustainability, simplification, increased employee productivity and global collaboration.
Webcast: Collaboration Initiatives: Benchmarks & Best Practices
Dec 15th, '09, 4 - 5 pm US/Eastern (GMT-5)
Join Council members Ruth Thorpe, VP & CIO at the U.S. Pharmaceutical Operations of Sanofi-Aventis, and Gary Kuyper, CIO at Bethany Christian Services, as they speak about their collaboration initiatives and experiences in how and why they chose the social networking and collaboration tools they are using and their business goals for collaboration, and facing culture change challenges.
Data Overview: Collaboration Initiatives Field Guide: Benchmarks & Best Practices
This appendix to the Council Field Guide provides an analysis which discusses benchmarks for collaboration IT implementation costs, adoption rates and payoffs. The overview identifies top IT and business goals and satisfaction rates for collaboration initiatives as well as best practices and lessons learned for implementing collaboration IT.
Learn more about the CIO Executive Council »March 22, 2007 — CIO —
What makes the TJX data breach different from the many that came before it? This marks one of the first times banks or consumers have linked a specific incidence of credit card fraud to a security breach at a specific company, says Jim Lewis, a security expert at the Center for Strategic and International Studies.
Plus, bank executives are fed up and they aren't going to take it anymore.
That seemed to be the message delivered by the financial community in the wake of the security breach announced by TJX in January. TJX, the Framingham, Mass., parent company of discount stores including TJ Maxx and Marshalls, revealed that hackers had stolen an undisclosed number of customer credit card numbers (estimates are in the millions). The reaction to the break-in was swift: The Massachusetts Bankers Association said some of its member banks had been able to trace recent fraudulent purchases on credit cards to the TJX breach.
"We believe the financial responsibility for covering losses because of fraud is on the company where the breach occurred," says association spokesman Bruce Spitzer. "This is something we are pursuing."
As are others. So far, at least two class-action lawsuits have been filed against TJX (one by banks in Alabama and Ohio, and another by an individual in West Virginia). The Massachusetts Attorney General's office is investigating TJX's security practices. The suits and investigations have altered the security breach landscape. "You will see banks start to attempt to hold retailers and other merchants liable" for losses on credit cards, says Behnam Dayanim, a privacy attorney with Paul, Hastings, Janofsky & Walker in Washington, D.C.
As CIO, how do you protect your company from a similar mess? The first thing CIOs should do is discuss with business unit leaders whether personal information (such as addresses, driver's license data and Social Security numbers) needs to be stored at all. If there's no compelling business reason to keep it, then the company should discard it after processing any transaction, be it in a brick-and-mortar store or online. But if the storage of the information is viewed as key to increasing sales then the firm must secure the data.
Encryption is one answer. The California security breach notification law (the standard for such laws, which requires businesses to notify customers when personal data has been exposed) permits companies to forgo notification if the personal data was encrypted. But use strong encryption, because lawyers can argue that weak encryption is no protection at all, Dayanim warns.