Security Practices Of Electronic Commerce Companies Should Follow

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

In January 2007, TJX Companies Inc. released a statement to the press that an estimated 40 million of their customer’s credit card accounts had been compromised (although final reports state that over 94 million accounts were affected) (Berg 2008). Through the company’s POS (Point of Sales) system, credit card information was stolen by a ring of hackers and approximately $4.5 billion spent on these cards (Berg 2008). What the hackers did was intercepted the credit card information from customers who swiped their cards at the store and then created their own physical cards using this information. Then they sold the credit cards to people, who turned around and used these cards at retail stores, like Walmart (Agrawal 2011). Three areas of weakness within the company’s IT systems that allowed for an attack of this scale were: inadequate wireless security, improper storage of customer data and failure to encrypt customer account data (Berg 2008).

Identity theft is, unfortunately, a commonplace in today’s world. Technology is ever advancing and evolving making today’s purchases obsolete. The obsolesces of technology plagued TJX. The company was attempting to get through under the radar with the enterprise security systems. “Because of the lax security systems at TJX, the hackers had an open doorway to the company 's entire computer system” (Weiss, 2014). TJX was cognizant of the breach and withheld information from stakeholders of the business. “Once a breach is discovered notification to consumers is paramount.”

In December of 2013, over 40 million credit card information was stolen from 2000 Target stores. This paper will explore the known issues in the Target breach and consider some of the Critical Controls that could have been used to prevent this breach and mitigate the losses. There are multiple factors that led to the largest data loss in history. Vendors were subject to various phishing attacks, memory scraping malware and detection used by Target that failed. One of the possible solutions for preventing and mitigating similar breaches is using a multi-layered security strategy, and to consider human factors that may be contributed to the loss of this information.

E-commerce security threats and technology solution dimensions consist of integrity, authenticity, confidentiality, privacy, availability, etc. (Laudon & Traver, 2012, p.268). The internet can serve as a very useful tool or it can be a tool manipulated to perform unethical actions. Its function as tool all depends on what the user and what they intend to do with the information they download, view or share. Many analysts trace the increase in the number of issues faced by consumers today to the internet. Internet access has transitioned from a luxury to a common household utility. This shift in demand makes it increasingly easy for criminals such as hackers to gain access to a larger pool of information. This growing pool of

As technology grows and information has become a critical asset companies currently are devoted their resource and money to protect their data as important as their finance and human resource assets.

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

In recent years breaches in data security have become common place. When breaches occur, a consumer’s personal and financial information are put at risk. Cyber criminals most frequently target retailers that make a practice of storing a customer’s credit card information beyond the necessary time frame and in many cases do have in the place appropriate security protocols.

Information security refers to confidentiality (accessible only to authorized individuals), availability (available when requested by an authorized person), and integrity (only authorized removal or alteration of information) of information (Yngstrom and Carlsen, 1997). And information security is required to retain a balance between various users of information (Kranakis et al., 2008). Such protocols have been violated by Noodles & Company as the theft of credit and debit card information has jeopardized the customers’ sensitive financial information. Noodles & Company’s payment system was targeted (Reuters, 2016). In their attempt, the hackers tried and accessed to the company’s payment system. This access enabled the hackers to access the financial information of the company’s customers. Subsequently, it cannot be denied that the hackers may have used the customers’ debit and credit card information for drawing money from the customers or they may have sold to any anonymous third party. In other words, this access has made private and sensitive information a public or sellable item in the black market. Additionally, many customers may have lost hundreds of dollars.

The massive security breach at TJX companies in 2005 has become a lesson in proper security in retail stores across the world. This breach that led to the loss of personal information on millions of customers is a direct result of inadequate security safeguards. Managing risk over critical information can always be tricky, but it is important to integrate security standards and privacy requirements across each company. TJX companies certainly put their customers information at risk by relying on weak encryption technology to protect this information. With the proper security measures, this record breaking data breach could have been avoided.

The purpose of this IT Security Compliance Policy is to recognize the legal aspects of the information security triad: availability, integrity, and confidentiality as it applies to the Department of State at U.S. Diplomatic Embassies across the globe. This document also covers the concept of privacy and its legal protections for privately-owned information by the U.S. government and government employee’s use of network resources. A detailed risk analysis and response procedures may also be found at the end of this policy.

The low cost computing power has also enabled organizations to aggregate a wide variety of consumer information like credit card details, Social Security Number (SSN) etc., which when fallen into wrong hands could jeopardise the security of common people. The cancellation of UK National Identity Card due to this very reason is a classic example of the dangers of collecting personal information of consumers (Davies, 2011). A breach could also result in loss of revenues and credibility to organizations. For example, the data breach at Target in the year 2013 resulted in 46% fall in revenues and costed over $61 million in expense

One of the worst problems for consumers is unauthorized access to their financial information. Criminals are able to access this information and steal their identity and steal their money and open up credit card accounts. Phishing is another security risk where criminals send emails messages to consumers in reference to online stores and banking. E-commerce services are driven by money and attract hackers trying to find some kind of loophole to steal bits of information from the company or the individual. The email looks real to the consumer and when the consumer reacts to the email and input their information there account is hacked. Data theft has increased 33% in 2010 according to the Identity Theft Resource Center, “Corporations are not yet taking identity theft and data breach seriously enough to properly train their employees, executives, and board on the BOTTOM-LINE DESTRUCTION caused by data breach.” The survey goes on to state “According to the same study, the average cost for a business to recover from a data breach is $6.75 Million. The average cost to implement identity theft, social engineering and data breach training? In most cases, less than $50,000.

The initial step of an effective security policy lies in determining the employees and their responsibilities, use of the resources and how sensitive they must be handled, effective usage and restricted acts. These policies help in building up company’s resources, its critical assets, methodologies and way of protecting them.

E-commerce Security is protecting assets of e-commerce from any unauthorized access, modification or deletion. E-commerce Security should follow the basic CIA model i.e. confidentiality, integrity, availability of Information Security. With the growing demand of E-commerce in the market, exploitation of its security is also subjected to increase, thus increasing the potential for white collar crimes. Internet Banking is a flexible and easy mode of online payment provided by banking sectors to e-commerce but as every coin has two faces, the benefits come with some hidden flaws. The possibility of fraud is seen as the major reason why today’s companies are spending billions of dollars on computer security. In this paper we discuss overview