IT DRILLDOWN
 
NEWSLETTERS
 

CIO.com updates, insights and advice on technology, management and your career.

 
 
 
LEADERSHIP
 
CIO Executive Programs
The Leader in Face-to-Face Education for Senior Executives

Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »

 
CIO Executive Council
A Peer-Advisory Service and Professional Association for CIOs

Social Responsibility's Strategic Benefits

December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)

Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.

Working With and Communicating to Your Board of Directors

January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)

CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.

IT's Role in Growing Mid-Market Companies

January 14, 4:00 PM - 5:00 PM ET (GMT-5)

Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.

More / Register »

Learn more about the CIO Executive Council »



 
 
RESOURCE CENTER
 
 
 
SUBSCRIBE TO CIO
 
Are you involved in setting the direction for your company's IT budget or strategy?

Apply today for a FREE subscription to CIO Magazine!

 
 

Banks Fed Up With Retailers' Security Gaffes

 

March 22, 2007CIO — What makes the TJX data breach different from the many that came before it? This marks one of the first times banks or consumers have linked a specific incidence of credit card fraud to a security breach at a specific company, says Jim Lewis, a security expert at the Center for Strategic and International Studies.

Plus, bank executives are fed up and they aren't going to take it anymore.

That seemed to be the message delivered by the financial community in the wake of the security breach announced by TJX in January. TJX, the Framing­ham, Mass., parent company of discount stores including TJ Maxx and Marshalls, revealed that hackers had stolen an undisclosed number of customer credit card numbers (estimates are in the millions). The reaction to the break-in was swift: The Massa­chusetts Bankers Association said some of its member banks had been able to trace recent fraudulent purchases on credit cards to the TJX breach.

"We believe the financial responsibility for covering losses because of fraud is on the company where the breach occurred," says association spokesman Bruce Spitzer. "This is something we are pursuing."

As are others. So far, at least two class-action lawsuits have been filed against TJX (one by banks in Alabama and Ohio, and another by an individual in West Virginia). The Massachusetts Attorney General's office is investigating TJX's security practices. The suits and investigations have altered the security breach landscape. "You will see banks start to attempt to hold retailers and other merchants liable" for losses on credit cards, says Behnam Dayanim, a privacy attorney with Paul, Hastings, Janofsky & Walker in Washington, D.C.

As CIO, how do you protect your company from a similar mess? The first thing CIOs should do is discuss with business unit leaders whether personal information (such as addresses, driver's license data and Social Security numbers) needs to be stored at all. If there's no compelling business reason to keep it, then the company should discard it after processing any transaction, be it in a brick-and-mortar store or online. But if the storage of the information is viewed as key to increasing sales then the firm must secure the data.

Encryption is one answer. The Cali­fornia security breach notification law (the standard for such laws, which requires businesses to notify customers when personal data has been exposed) permits companies to forgo notification if the personal data was encrypted. But use strong encryption, because lawyers can argue that weak encryption is no protection at all, Dayanim warns.

Loading...
 
 
ABCs
 

Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.

Over 25 tutorials on everything from business intelligence to virtualization.

 
 
FEATURED SPONSORS
 
 
 
SPONSORED LINKS
 

Operational Excellence Is Key to Maximizing IT Investments

The Right and Wrong Master Data Management Strategies to Start Small and Grow Big

Paving the Way for Trusted Collaboration

First-hand look at this never before seen research

Effectively Managing High-Performing, Business-Critical Web Applications

Managing Service Level Agreements to Achieve Business Goals

APM Solutions: A Window into Complex Web Applications

APM Solutions Offer Insight into Complex Web Applications

Five Best Practices for Enterprise Collaboration Success

Expand High-Performance Computing (HPC) Capabilities

Power the Platform of Choice for Virtualization in the Enterprise

Deliver Social Computing Business Value

Make Hidden Trends, Inter-Relationships and Influences Visible.

7 Requirements of Data Loss Prevention

A Guide to Understanding Hosted and Managed Messaging

Google Apps Premier Edition Helps Indoff Manage E-mail More Effectively

CapGemini Cut Call Center Costs with Google Apps Premier Edition

Comprehensive Review of Security and Vulnerability Protections for Google Apps

Web 2.0 The New Face of the Web

Mission Impossible: Building the Right Project Metrics

Project Portfolio Management - Boost the Value of IT

Embedding Architecture into the Organization

Data Center Asset Planning - Regaining Control of the Data Center

Develop new insights that deliver better business results

"Enterprise-Proven" is the Prerequisite for Enterprise SaaS Portal Solutions

Learning from BPM Leaders

Webcast: Mitigate Operational Risk- Real Answers for Tough Times

Fulfill Your Remote Access Strategy for Mobile Users

State of the Market: Application Performance Management

Proactively Identify and Resolve Performance Issues

Union Bank of California Improves its Online Banking Services

The Link Between APM and Customer Satisfaction

Providing Around-the-Clock Customer Satisfaction

Enabling the Global Enterprise Webcast: Learn why businesses are turning to wide-area data services

High-performance computing is no longer just for Big Business

The Nokia and Cisco mobility solution that has created true business transformation.

The ECM Paradox: Extending Local Flexibility to Strengthen Central Control

Customer Insight Yields Sales, Marketing Gains

Best Practices in Choosing and Consuming Managed Security Services

A Guide to Messaging Archiving

2008 Google Communications Intelligence Report

The Impact of Messaging and Web Threats

Comparing Google and Other Leading Messaging Security Solutions

Put Enterprise Communications on Autopilot

Portfolio Management for Effective IT Governance

Making Enterprise Architecture Work within the Organization

Telepresence - A Realistic Solution Connecting a Global Workforce

Enabling Enterprise 2.0

Customer Hubs Deliver on the Failed Promises of CRM

Live Webcast - Ensuring Business Services Delivery