Jeanswest: Protecting the brand

Protecting a well-established brand in the face of compromised systems is something Brad Clarence, the systems and support administrator at iconic fashion retailer, Jeanswest, knows a fair bit about. Despite his somewhat misleading title, Clarence is responsible for Jeanswest’s entire network and systems infrastructure in Australia and New Zealand.

This includes every switch and router, all EFTPOS and point of sale systems, as well as the rest of the technology that supports Jeanswest’s 2500 employees, who are spread across the company’s 240 stores, four distribution centres and five state offices in the region.

Read about Security breach.

In January of 2010 Jeanswest was in the middle of an infrastructure refresh #8212; and moving from an old security provider to a new enterprise-wide system supplied by Sophos #8212; when Clarence noticed strange things happening on the company’s network.

“We started to see odd fluctuations in bandwidth usage, local network congestion and a few users reported abnormal behaviour on their machines,” Clarence says.

It turns out a worm had invaded Jeanwest’s network. Before the problem had even been properly identified, the company’s e-mail addresses started appearing on DNS blacklists.

“The existing security provider hadn’t been accurately picking up what was going on, so we couldn’t tell what the problem was at first,” Clarence says.

“Before we knew it, we were blacklisted. For a company like Jeanswest to be identified as a spammer was an absolute nightmare for us.”

Clarence stresses that at no point were the details of Jeanswest’s customers put in jeopardy, but the event did cripple the company’s backend infrastructure for three days.

Jeanswest deals with a vast network of suppliers and manufacturers, and its marketing department also works closely with several advertising agencies, so the problems caused by the worm simultaneously inconvenienced many areas of the business. All Jeanswest’s business partners and other clients had to be informed about the issues the company was facing #8212; no small task when you can’t send nor receive e-mails.

Nevertheless, Clarence and other key staff at Jeanswest were committed to ensuring partners were made aware of what was happening #8212; and why #8212; which greatly reduced the negative impact of the ‘blacklisted’ notifications clients were receiving.

“There were a lot of phone calls made over those few days,” Clarence says.

“Staff had to get inventive #8212; our fax machine got its biggest workout in years.”

Instead of a slow, gradual implementation of the new security system, Clarence was forced to compress the planned rollout from two weeks to three days.

With the Sophos system in place the worm was rolled back quickly, much to everybody’s relief, but Clarence maintains it was also the company’s commitment to keeping business partners informed that kept the damage from spiralling out of control.

“The attack affected productivity and made everyone’s days a lot longer, but even though the back-of-house systems were affected seriously, from a customer perspective everything remained business as usual,” he says.

Planning for breach

According to Rob McMillan, research director in Gartner’s ITL Systems Security and Risk team, the most important thing a CIO can do to mitigate the impact of a data breach is to have a plan in place to deal with the event before it happens.

“The very first step is to acknowledge that you may well have a breach someday,” says McMillan, who was co-founder and general manager of AusCERT and also served as executive manager in charge of security at the Commonwealth Bank before joining Gartner.

This might seem obvious, but McMillan cites figures from Gartner’s 2011 Global Privacy Survey (which includes responses from Australian organisations) which show many companies have not even considered the issue.

“In our survey, only 12 per cent of organisations said they feel their security is ‘bullet-proof’,” McMillan says, “which means 88 per cent of organisations know that a breach is possible.”

Page Break

In the same survey, 55 per cent of all respondents either had no breach disclosure process in place or, worse, hadn’t even thought about it.

“What that tells is that somewhere between 43 and 55 per cent of respondents know they could have a breach but have done no planning around that possibility,” he says.

The single biggest lesson for CIOs, therefore, is to start making plans now for what to do when a breach occurs.

“Don’t ignore the possibility of something going wrong,” McMillan says.

“If you know your organisation is at risk but choose to do nothing, it is going to be very difficult to explain to customers, shareholders and regulators #8212; or to a court.”

The first two steps of any data breach plan are pretty straightforward, McMillan says. First, identify the source of the breach. Second, re-establish the integrity of your IT and communications systems, because you will rely on them greatly in the days to come. After that, mitigation plans depend very much on the type of incident that occurs.

McMillan recommends CIOs formulate several plans to respond to different situations. If the breach occurred through a Web-based application, for example, you’ll want to fix the application, ascertain exactly what data was compromised and advise those affected #8212; most likely to tell them to monitor their credit reference files closely.

On the other hand, if no personally identifying information has been compromised and the only thing stolen is intellectual property, chances are there is an insurance claim to get underway. If there are signs of illegal activity, such as somebody using your website as drop site for illegal material, it’s probably time to call the police.

As Jeanswest’s example shows, if you do have to alert other parties that your systems have been compromised, the best policy is to be prompt and truthful with your messages.

“Be honest with them,” McMillan says.

“Don’t underplay it, but don’t overplay it either. Tell people exactly what happened and give them some idea of what they need to do to protect themselves.”

When it comes to contacting affected parties, McMillan advises organisations to take a cue from well-run rail services, like the London Underground, which inform people when and why a train is running late.

“People tend to deal with bad news better if they’re told about it honestly,” McMillan says.

“When there’s a sensible reason as to why an event happened, people are more likely to understand and accept it.”

It also helps to offer assistance in whatever way you can. Here, McMillan cites the case of breaches in the US where organisations have offered to pay for extra monitoring of credit reference files.

“What you don’t want is for the first time a customer learns about the problem to be when something bad happens to them,” he says.

“You also want to avoid getting a reputation for being hard to reach or avoiding questions after the incident has occurred.”

According to the UNSW Cyberspace Law and Policy Centre’s Vaile, the recent Sony PlayStation Network hack is a prime example of what not to do. When users first had trouble signing in to the service the company offered no explanation why, then waited five days before coming clean with customers about what caused the outage.

“For a long time Sony failed to pass on information and be as frank as possible, and that has left people thinking the company can’t be trusted when something goes wrong,” Vaile says.

Speaking with the privacy commissioner is another option that organisations should consider. In Australia, voluntary disclosure breach guidelines were issued by the former Privacy Commissioner which, while not mandatory, still provide a useful starting point for any organisation that suffers a breach.

“There might not be a mandatory disclosure scheme in Australia, but you can definitely help to limit damage to your brand by being seen to work co-operatively with the authorities,” McMillan says.

“Remember, it’s not just about the direct effect a breach has on your business, your shareholders and your customers #8212; it’s also about the long term effects this kind of incident can have on your brand,” he says.

“If you handle a breach promptly and correctly, hopefully your customers will forget about it quickly. But handle it wrongly, and your brand could have a ‘whiff’ about it for years to come.”

Follow CIO Australia on Twitter: @CIO_Australia

Copyright © 2011 IDG Communications, Inc.

6 digital transformation success stories