LESSONS FROM COMPUTER INTRUSION AT TJX Benjamin Ngugi Suffolk University Glenn S Dardick Longwood University Gina Vega Salem, Salem State College ANNOUNCEMENT OF COMPUTER INTRUSION AT TJX The TJX Companies, Inc. today announced that it has suffered an unauthorized intrusion into its computer systems that process and store information related to customer transactions. While TJX has specifically identified some customer information that has been stolen from its systems, the full extent of the theft and affected customers are not yet known, read Dennis Frank from the TJX press statement [1] dated January 17, 2007. It was almost the end of the fall 2007 semester. Dennis, an assistant professor of Information Technology at a Boston university, was preparing a class presentation from his home office on the importance of customer data protection when his mind immediately focused on the computer intrusion at TJX earlier in the year. No other computer intrusion case could have been more relevant; he knew that several of his students were either directly affected or knew someone who had been affected by the TJX computer intrusion. Further, some of the issues that led to the TJX intrusion were now finding their way to the public via the media and the Internet, so the students would have ready access to research materials. He began analyzing all the TJX press statements about the computer intrusion. Dennis was distracted briefly by his wife who was furiously typing a holiday shopping list on her computer. The holiday season had arrived and they were inundated with special offers from the retail companies. First there was the Thanksgiving series of sales, and now the Christmas series had started. He wondered whether to warn her to use cash when doing her shopping, as credit cards were becoming unsafe despite their many benefits and the purchase protection they afforded. He went back to the article that he was reading. This intrusion involves the portion of TJX’s computer network that handles credit card, debit card, checks, and merchandise return transactions for customers of its T.J. Maxx, Marshalls, HomeGoods and A.J. Wright stores in the U.S. and Puerto Rico, and its Winners and HomeSense stores in Canada, and may involve customers of its T.K. Maxx stores in the U.K. and Ireland. The intrusion could also extend to TJX’s Bob’s Stores in the U.S. “This has the potential of becoming a real disaster,” thought Dennis. “The stolen cards’ customer information could be used to make counterfeit cards which could lead to an identity theft crisis.” Complicating matters further was the fact that the theft was across the majority of the subsidiary companies, which increased the scale of affected customers. The Company immediately alerted law enforcement authorities of the crime and is working closely with them to help identify those responsible. TJX is also cooperating with credit and debit card issuers and providing them with information on the intrusion, the press release continued. How long had it taken the company to disclose the computer intrusion to the public? Every day wasted could make a difference in a victim’s journey through identity theft. However, the company had to balance the need for disclosure with the conflicting need to keep quiet long enough to give the law enforcement agencies time to catch up with the hackers. With the help of leading computer security experts, TJX has significantly strengthened the security of its computer systems. While no computer security can completely guarantee the safety of data, these experts have confirmed that the containment plan adopted by TJX is appropriate to prevent future intrusions and to protect the safety of credit card, debit card and other customer transactions in its stores. Dennis was happy to see that the company had sought advice from experts on strengthening its defense. The worst thing that could happen would be to have a repeat attack and theft of data. That could take away any remaining investor-confidence in the company. He wondered how the data thieves had penetrated the company’s security network and what layers of defense the company had now erected to deter similar types of attacks in the future. The TJX Companies, Inc The TJX companies, Incorporated was one of the leading retailers of apparel and home fashions in the USA and worldwide with annual sales hitting $17.4 billion in 2006 under the leadership of Bernard Cammarata, Chairman of the Board, and Carrol Meyrowitz, President and Chief Executive Officer [2]. The mission of the company was the delivery of an exciting, fresh and rapidly changing assortment of brand-name merchandise at excellent values to their customers [2]. TJX traced its origin from the first Zayre discount department store [3] opened by cousins Stanley and Sumner Feldberg in 1956 in Hyannis, Massachusetts. Zayre later incorporated in 1962 and went on to acquire several other companies. Zayres, Inc. was later renamed TJX Inc. As of 2008, TJX operated eight businesses, including T.J. Maxx, Marshalls, Home goods, Bob’s Stores and A.J Wright in the USA, Winners and Homesense in Canada, and T.K Maxx in Europe [2]. The group had over 2,400 stores with approximately 125,000 associates and placed 133rd in the Fortune 500 company ranking [2]. Update on the Computer Intrusion at TJX Dennis moved on to the second press release from TJX dated February 21, 2007 [4] giving an update on the computer intrusion. While the company previously believed that the intrusion took place only from May, 2006 to January, 2007, TJX now believes its computing system was also intruded upon in July 2005 and on various subsequent dates in 2005. Dennis could not believe what he was reading. Did this mean that the data thieves hacked into the system and continued stealing customer data from July, 2005 all the way to December, 2006 without being detected? How could such a large company not detect an intrusion for eighteen months? What level of IT security personnel were responsible for IT network security? Did they have a specific group within the IT organization that was responsible for IT network security? Did they have a layered network security plan in place? At a minimum, didn’t they employ intrusion detection systems? Didn’t they examine their logs to check for unauthorized file access? Dennis had worked in the IT security industry and knew that it was now standard policy in most organizations to employ top notch network security personnel. Such people would design the right security policies and then institute several layers of security controls to enforce the policies. Such controls would include segmenting the network into manageable units and putting in firewalls and intrusion detection systems (IDS) to protect the data. The IDS would monitor and detect abnormal/fraudulent user behavior and alert the network security officer. It was also now standard procedure to monitor server log files to see who was accessing sensitive data files. He felt it would not be asking too much to expect such a company to be doing the same. In addition to the customer data the Company previously reported as compromised, the Company now believes that information regarding portions of the credit and debit card transactions at its U.S., Puerto Rican and Canadian stores (excluding debit card transactions with cards issued by Canadian banks) from January, 2003 through June, 2004 was compromised. Dennis could understand why so many people were worried. Customers who had ever bought something at any of the TJX group of companies had reason to fear that they would become victims of identity theft, and things were getting worse. The hackers had accessed credit and debit card information and were in a position to use this information to purchase things which would be billed to the customers’ accounts. TJX has found additional drivers' license numbers together with related names and addresses that it believes were compromised. Why was the company keeping driving license numbers? Dennis was even more worried when he remembered that some customers used their social security numbers as their driver’s license numbers, making that group the most vulnerable to identity thieves. He wanted a lot of answers and decided to look for an investigative report from a law enforcement agency or some other independent institution. He searched the Internet for “investigation on TJX computer intrusion,” and he got several hits. One was an investigation by the Canadian privacy commissioner[5]. He downloaded the full report from the commissioner’s website and sat down to read it. Report of an Investigation into the Security, Collection and Retention of Personal Information at TJX[5] On January 17, 2007, the Office of the Privacy Commissioner of Canada (OPC) and the Office of the Information and Privacy Commissioner of Alberta (AB OIPC) were notified by TJX and by Visa that TJX had suffered a network computer intrusion affecting the personal information of an estimated 45 million payment cards in Canada, the United States, Puerto Rico, the United Kingdom and Ireland. Dennis sighed with consternation. Forty-five million customers were now at risk because of the TJX computer intrusion. This would go down in history as one of the biggest hacks ever. He could not remember any other computer intrusion with such a large number of affected customers. The stakes were high, and the business case for putting safeguards into such an organization was strong, as the damage would be enormous. He wondered if he was jumping to conclusions and should first try to find out how the intruders had hacked into the TJX system. He came to the paragraph describing the penetration: TJX informed the investigators that “the intruder may have gained entry into the system outside of two stores in Miami, Florida.” Dennis almost missed it. From outside a store? Without going inside? Of course! The intruders must have hacked into the wireless system by positioning themselves strategically outside the two stores where they could get the wireless signal without going through the security guard at the door. This was getting interesting. He wondered whether the company had performed a wireless security risk analysis to identify the vulnerabilities of wireless security systems. What kind of security safeguards did the company have in place to prevent this kind of attack? He continued to the next paragraph. At the time of the breach, TJX had in place various technical measures in its North American stores to protect personal information, including the Wired Equivalent Privacy (WEP) encryption protocol. Dennis immediately identified one problem; WEP had been an obsolete encryption technology for several years. Earlier in the year, he had attended a seminar on wireless security and was well versed in the different wireless encryption technologies. The WEP protocol had been known to be unsafe [6] since 2001; in fact, several programs were widely available on the Internet that could be used to crack it in minutes. They could even be executed on an IPAQ PDA (a small personal device) that could be brought into a store undetected. The Institute of Electrical and Electronics Engineers (IEEE) was the original drafter of the WEP standard. They later rejected WEP due to its insecurities and strongly recommended that users should move to the new WPA (WI-FI protected access) encryption system which had a more sophisticated algorithm and was, therefore, harder to break [7]. Dennis wondered why a company of TJX’s size and available resources in terms of money and manpower would still be using such an outdated system. He read on. The “intruders then used deletion technology to cover their tracks thus making it impossible for TJX to determine the contents of the files created and downloaded by the intruder.” Dennis could tell that these were professional hackers, not the usual high school kids out to impress their peers with their computer hacking prowess. These were experts who deleted the server logs to stymie detection of the intrusion and took pains to cover their tracks so that they would not get caught by the law enforcement agencies. TJX could have avoided compromising important data like credit card data files and the server logs by making regular back-ups and keeping them at a different site. The backed up data could then have been used to track the hackers. He went on to review the objectives and findings of the Canadian probe in the TJX computer intrusion. The goal of the investigation was to “examine the collection, retention and safeguarding practices of the organization, in order to determine whether the breach could have been prevented.” The investigators had set the right objectives. The issues of collection, retention and safeguarding should form the core of a company’s information system security blueprint. “Prevention is better than cure,” went the old adage. Keeping the collected information to an absolute minimum would reduce the extent of the damage that could befall an organization like TJX. Likewise, if only the absolute minimum of the collected information were retained, then the amount of information to be protected was minimized. And finally, if the organization had strong safeguards, then it meant that the information retained would be protected and therefore so costly for hackers to access that it would not be worth the effort. The first issue that the investigators were concerned with was “whether TJX had a reasonable purpose for collecting the personal information affected by the breach.” This was very much in line with the view of many IT security experts: only information that met a certain purpose should be collected. Anything more would represent an unnecessary liability. Dennis could understand why a company would want to collect names and addresses for credit card verification. However, he could not understand why they had to store driver license numbers. If they wanted a photo ID, they could ask for the driver’s license and compare it with the credit card, but they did not need to enter this into the computer system. The second issue that the investigators sought confirmation of was whether TJX’s retention of customer data practice was in compliance with Canadian regulations. The investigators found that the “collection of names and addresses was acceptable but that of driver license ID numbers was excessive and contrary” to Canadian privacy laws. They determined that the TJX practice contravened the privacy laws and regulations. Collecting and retaining unnecessary personal data must have exacerbated the situation. The third issue that the commission investigated was whether TJX had made reasonable security arrangements to protect the personal information in its custody. Dennis knew that the responsibility for protecting customer data lay with the company collecting the information. He personally felt that the company should not have been using the WEP encryption protocol after the IEEE declared it insecure. At the end of September, 2005, TJX made a decision to improve the protection of its wireless networks by installing the Wi-Fi Protected Access (WPA) encryption protocols in its stores. Dennis sighed; it was good the company had eventually realized the danger of using WEP, but it was too late by then. The press update [4] had stated that the first TJX intrusion was in July, 2005, so by the time they started upgrading to WPA the intruders were already into the system, siphoning customer data out. If they had changed to WPA earlier, they might have prevented the intrusion. Dennis was pleased to see that the “organization undertook forensic and other investigations to audit and analyze the security of the TJX computer system, and to enhance the security of the TJX computer system in a continuing effort by TJX to safeguard against future attempted unauthorized intrusions” and was taking steps to rectify the situation, but he wondered why they had to be hacked to do what they should have done earlier. He was angry that so much had been lost because of something that could have been prevented. The total losses from the intrusion would not be known for some time. By the second quarter earning report [8] in August, 2007, TJX had put aside $196 million before taxes as an estimated provision to cover the liabilities in anticipation of the suits that were bound to follow. This was in addition to the $25 million charge before taxes that they had taken earlier. The quarterly report further suggested that the company might have “to take an extra $35 million in the next financial year.” This totaled about $256 million, and the figure was increasing. In fact, some research firms estimated that “the total loss from the breach could reach $1 billion once settlement and lost sales were tallied.” [3[9] This was a monumental figure by any account. It would be good to compare the total loss with what TJX would have spent to fix the initial WEP problem and safeguard the customer data, thus avoiding the computer intrusion. Dennis could not get any exact figure so he decided to make a rough estimate. He knew that retailers like TJX that processed debit/credit cards from the major four credit card issuers (Visa, MasterCard, American Express and Discover) had to meet certain standards [10] set by the payment card industry (PCI). These consisted of twelve rules which were explicit in the layers of security controls that had to be erected to protect credit card data. The rules called for the proper installation of firewalls, access controls, encryption of data across open networks, regular software updates and monitoring of networks, and maintaining a sound information security policy. This layered defense would provide a formidable obstacle to hacking. (See Appendix A for an illustration of the Defense-in-Depth Strategy). Dennis emailed one of the leading security consultants he knew for an approximate figure on what a company like TJX would have incurred in becoming PCI compliant. “I cannot address TJX in particular but I know of an information-intensive company that has spent more than $20 million in order to be PCI compliant. This was a company that possessed many, many millions of individual personal identifiers, including social security numbers and had to be PCI compliant, level one, because it processes in excess of six million credit card transactions annually. So obviously, it has a significant retail operation,” replied the security consultant. After chatting a bit longer, Dennis returned to his course preparation and decided to use the given figure as an upper limit. He did further investigation searching for real companies that had gone through PCI compliance. The Wall Street Journal [11] reported that the “musical-instruments retailer Guitar Center Inc, which operates more than 210 stores nationwide and processes several million paymentcard transactions a year, had purchased nearly $500,000 of new technology in the past year in order to comply with the PCI standards.” Dennis could not do a direct comparison as this company had 210 stores while TJX had 2,400 stores, so he computed the cost per store of about $2,380. Multiplying the cost per store by TJX total stores gave a figure of about $5.7 million. The same article stated that “the biggest merchants, those that process six million or more payment-card transactions a year from any single card brand, spent an average of $568,000 on new technologies to comply with the PCI security standards, according to estimates from Gartner, Inc.” In the case of TJX, there were embedded eight such large merchant businesses. T.J. Maxx, Marshalls, Home goods, Bob’s Stores, and A.J Wright in the USA, Winners and Homesense in Canada, and T.K Max in Europe were all subsidiaries of TJX and each processed six million or more payment-card transactions a year from any single card brand. Another way of getting an approximate figure would be to multiply the average cost by eight which gave $4.8 million. Dennis concluded that TJX would have invested about $5-20 million to become PCI compliant, but the final cost of the effects of the intrusion was going to be more than ten times what it would have cost to fix the system in the beginning. “Here’s a lesson,” Dennis thought, “for all companies about the importance of data security.” Dennis wondered whether other retailers had learned the same lesson that TJX had learned. Most of the retailers all over the United States used similar payment systems and were being guided by the same PCI rules; how well were they implementing these rules? How well were they protecting themselves now that they had seen one of their own lose so much and get so much negative publicity? He decided to find out. He remembered reading that AirDefense, one of the leading companies in wireless security, was doing a comprehensive national survey on the wireless security of retail stores. He searched for the survey results from the company’s website to see what they found out. What he was about to discover would shake his faith in the retail industry. On November 15, 2007, AirDefense published a survey [12] of the wireless data security and physical security practices in place at more than 3,000 stores nationwide and also in parts of Europe. Cities monitored were Atlanta, Boston, Chicago, Los Angeles, New York City, San Francisco, London and Paris. Research was conducted in some of the busiest shopping areas in the country, including: Rodeo Drive in Beverly Hills, Madison Avenue and 5th Avenue in New York City, Michigan Avenue in Chicago, and Union Square and Market Street in San Francisco. The company monitored 5,000 access points that connected wireless devices to wired computer networks. The results were shocking. Twenty-five percent of the networks were found to be unencrypted, meaning that anybody could access them. Another 25 percent were using Wired Equivalency Privacy (WEP), the same encryption protocol that had allowed the intrusion at TJX. The rest of the retail stores were using WPA, which was the recommended encryption protocol. Dennis was amazed. He wondered what it would take for the retail stores to take information security seriously. The net determination of the survey was that 50 percent of the retailers’ wireless access points were not safe. This left the shopper at the mercy of hackers. It was as if the retailers had learned nothing from the TJX computer intrusion. He wondered how long it would take before another computer intrusion was perpetrated. For the second time that morning, he wondered whether to advise his wife not to use her credit card at the retail stores. REFERENCES 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. TJX Incorporation, The TJX Companies Incorporation Victimized by Computer Systems Intrusion: Provides Information to Help Protect Customers in Business Wire. 2007, TJX, Inc.: Framingham, Massachusetts. TJX Incorporation, 2006 Annual Report. 2007: Framingham, Massachusetts. Funding Universe. TJX Incorporation-Company History. 2002 [cited 2008 February]; Available from: http://www.fundinguniverse.com/company-histories/The-TJXCompanies-Inc-Company-History.html. TJX Incorporation, The TJX Companies Incorporation Updates Information on Computer Systems Intrusion in Business Wire. 2007. Privacy Commissioner -Canada and Information & Privacy Commissioner-Alberta, Report of an Investigation into the Security, Collection and Retention of Personal Information at TJX. 2007. Borisov, N., I. Goldberg, and D. Wagner. Intercepting Mobile Communications: The Insecurity of 802.11. in 7th Annual Conference on Mobile Computing and Networking (MOBICOM). 2001. Rome, Italy: ACM Press. IEEE Computer Society, IEEE Standard 802.11i for Information Technology Telecommunications and Information Exchanges between Systems -Local and Metropolitan Area Networks-Specific Requirements. 2004, IEEE: NewYork, USA. TJX Incorporation, The TJX Companies, Inc. Reports Strong Second Quarter FY08 Operating Results; Estimates Liability from Computer Systems Intrusion(s). 2007: Framingham, Massachusetts. Goodin, D., TJX Breach was Twice as Big as Admitted, Bank Says, in Channel Register. 2007. PCI Security Standard Council, Payment Card Industry (PCI) Data Security Standard. 2006: Wakefield, MA USA. Tam, P.-W. and R. Sidel, Business Technology: Security-Software Industry's Miniboom; As Merchants Upgrade Systems to Meet New Rules, Tech Firms Benefit, in Wall Street Journal. 2007: New York, N.Y. AirDefense. AirDefense's Comprehensive Survey of 3,000 Retail Stores Finds Many Wireless Data Security Vulnerabilities as Holiday Shopping Season Nears. 2007 [cited 2008 March, 25th]; Available from: http://www.airdefense.net/newsandpress/11_15_07.php. Whitman, M. and H. Mattord, Principles of Information Security. 2nd ed. 2005, Boston, Massachusetts, USA: Course Technology. Appendix A: Defense-in-depth Strategy Fig 1: Illustration of the Defense-in-Depth Strategy [13] The “defense-in-depth” strategy illustrated in Fig 1 involves setting up of overlapping layers of security controls so that an intruder will have to overcome one level after the other before reaching the protected resource. The weakness of one layer of security control is compensated by the strength of another. The overall goal is to vigorously prevent, detect and mitigate intrusions. Most intruders will give up after facing multiple layers. The type of controls should have a mix of both technology- and people-oriented solutions. Figure 1 shows several examples of technology based solutions that includes a firewall protecting the network and an intrusion detection systems within the network monitoring for unusual behavior. Likewise, the figure includes some people based solutions. Security to a large extent depends on having the right policies and regulations. Equally important is well trained and compensated personnel who will vigorously work to prevent, detect and mitigate security issues. The users should also be well educated and aware of the common threats facing the organization; because they are on the ground, they would be the first to notice unusual behavior or even attacks. Each of these solutions supplements the other in different ways.
Purchase answer to see full attachment