T. J. Maxx breach, Computer sciences and Information technology enter the Number or College 7th December, 2011.
• Major characteristics of incident and losses of confidentiality, integrity, and availability
The most infuriating and annoying part of the TJX cyber security issues is that it could have been avoided because the way of encryption used for the wireless internet used by the company was an obsolete one (Stevens, 2010, p. 2). The cyber security incident of the TJX was the worst one for the customers, the banks and TJX itself. According to Matwyshyn (2009, p. 9), losses of confidentiality, integrity, and availability are important because they are private and confidential data of the customers. Customers lose their confidence in the companies as well as they get the impression that company does not give importance to the protection of their private and confidential data. Due to the TJX breach not only TJX had to suffer but also different banks had to pay the penalty by reissuing the cards to their customers. Gifford (2009, p 65) states that the protocol in WEP was insecure as it was not encrypted properly. TJX Co. did not apply the obfuscation and encryption policies to protect the consumer data. The security software purchased by TJX was not implemented correctly by the IT department of TJX Co. weak firewall rules are also a major characteristic of the cyber security incident. TJX had to pay around $80 -$100 million as a cost of settlement. Hence, it is important to secure data instead to pay penalties (Matwyshyn, 2009, p. 9).
• Technological improvements that would help prevent recurrence
According to Matwyshyn (2009, p. 10), risk management is an important factor which should be implemented in order to prevent recurrence. This made the attack more vulnerable in nature as it did not have to undergo any type of hindrance. A chief information security officer should be allocated who has information of where the customer data is stored and moreover which of the third parties have access to it. Matwyshyn (2009, p. 11) suggests that the external reports of the breach should be given importance. for example if a customer gets access to other customer’s data on a website and reports to the company then it should be checked instead of ignoring the issue. There should be regular monitoring of the customer data and its screening should also be done on regular basis. This helps keeping an eye on the usage of data and to remain up to date. The access to data by the employees should also be limited. According to Ballad, Ballad and Banks (2010, p. 110) privileges and access to databases should be given only to the people related to information security of the organization. There should be an eye kept on the employees who want to access data, harm it or use it for some other purposes (Menn, 2010, p. 179).
Hence, I conclude that with little check on the security systems of TJX the data theft could have been avoided. For future, the organization should encrypt its data and continuously check the weak links in the security systems. This would help in avoiding further such incidents as they are terrible for the company, customers and other associations related with it for example the banks.
References
Matwyshyn, A., M., (2009). Harboring data: information security, law, and the corporation, Stanford University Press. Vol. 20 (7), pp. 9-11.
Gifford, N., (2009). Information security: managing the legal risks, CCH Australia Limited. Vol. 1, pp. 65.
Stevens, G., (2010). Federal Information Security and Data Breach Notification Laws, CRS Report for Congress, pp. 2. Available at http://www. fas. org/sgp/crs/secrecy/RL34120. pdf. Retrieved December 7, 2011.
Ballad, B., Ballad, T., Banks, E., (2010). Access Control, Authentication, and Public Key Infrastructure, Jones & Bartlett Publishers. Vol. 1, pp. 110.
Menn, J., (2010). Fatal system error: the hunt for the new crime lords who are bringing down the Internet, Public Affairs. Vol. 1, pp. 179.
