Technology And The Security Of The Public Confidence

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

The use of security alert programs, scanning services, or software can be used to warn the merchant of any vulnerable information. Software can be installed to recognize any modification by unauthorized personnel. Also, as mentioned before, vendor supplied security patches must be installed within one month to avoid exposing cardholder data. Furthermore, all information being transmitted must be encrypted when using the public networks. Network and platform vulnerabilities can also be assessed by a vulnerability scan. A vulnerability scan involves an automated tool that checks a merchant or service provider’s systems for vulnerabilities (pcicomplianceguide.org, 2015). The tool will conduct a non-intrusive scan to remotely review networks and Web applications based on the external-facing Internet protocol addresses provided by the merchant or service provider (pcicomplianceguide.org, 2015). The scan identifies vulnerabilities in operating systems, services and devices that could be used by hackers to target the company’s private network (pcicomplianceguide.org, 2015). As provided by an Approved Scanning Vendors (ASV’s) such as ControlScan, the scan does not require the merchant or service provider to install any software on their systems, and no denial-of-service attacks will be performed

To start off with I chose to go with our banking or financial industry. The banking industry is constantly getting attacked by various methods on a daily basis. I chose this industry because I happen to know someone who works in the security sector at Wells Fargo Bank, he was a good person to get information on what he sees on a daily or weekly basis. This paper is the opinion of myself and with gathered information from various resources.

Restaurants have a tendency to be targets for cyber criminals. These criminals steal and reconfigure the payment card data for their own purposes. At the Heartland Cafe, Tom has a chance to be a target for a cyber attack by being in a high-traffic area. If the customer is compromised, Heartland Cafe will quickly lose public trust and perhaps Tom will lose the business altogether. Extra measures toward risk management should be taken to ensure that the business itself remains safe. Compliance with PCI-DSS protocols, PTS requirements and the franchisor should inform the franchisee of any software that could translate

In December of 2013, target corporation faced a serious security breach where over 40 million credit cards were stolen from different target stores. This paper is going to explore the problem, the background information about the problem, the controls that could have been in place to prevent the issue, the intended plan of control and the associated risks involved.

In January 2007, TJX Companies Inc. released a statement to the press that an estimated 40 million of their customer’s credit card accounts had been compromised (although final reports state that over 94 million accounts were affected) (Berg 2008). Through the company’s POS (Point of Sales) system, credit card information was stolen by a ring of hackers and approximately $4.5 billion spent on these cards (Berg 2008). What the hackers did was intercepted the credit card information from customers who swiped their cards at the store and then created their own physical cards using this information. Then they sold the credit cards to people, who turned around and used these cards at retail stores, like Walmart (Agrawal 2011). Three areas of weakness within the company’s IT systems that allowed for an attack of this scale were: inadequate wireless security, improper storage of customer data and failure to encrypt customer account data (Berg 2008).

In the middle of the holiday season, Target shoppers were knocked off their feet with the news that in December 2013 that 40 million Target credit card numbers had been stolen (Krebs, 2013f) by someone accessing Target’s data on their point of sale (POS) systems (Krebs, 2014b). To make matters worst Target later revised their number to include the private data for 70 million of their customers (Target, 2014). The breach took place period of November 27 through December 15th 2013 (Clark, 2014). Target had gotten taken for over 11 GB of their data that had been stolen (Poulin, 2014). Target did not catch their internal alerts and was informed about the breach when they were contacted by the Department of Justice (Riley, Elgin,

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

On January 2007 a press release was issued according to CPA journal article “Analyzing the TJ Maxx Data Security Fiasco” that TJX Companies, Inc. the parent company to retail stores like TJ Maxx, Marshalls, HomeGoods, and A.J Wright stores; computer systems had been breached and that customers’ information had been stolen. (Berg, G. 2008, August) This data breach became the largest one of it’s kind because during the investigation there was reported that approximately 94 million Visa and MasterCard accounts had been compromised (Berg, G. 2008, August).

When online commerce first emerged, many consumers were wary of supplying their credit cards and giving their personal information to online stores. This led to the development of websites such as Paypal, which restricts the access a retailer has to one’s credit card number (Einstein). The threat of fraud has always been a worry for online consumers, but consumers face the same threats when shopping in a brick and mortar store (Chadwick).

Home Depot’s breach has hit close to home for a lot of citizens. In a statement made by Wall Street Journal’s Robin Sidel, A new encryption system, which went live in the U.S. on Sept. 13, "locks down payment data" by scrambling the card information to make it unreadable and "virtually useless to hackers,"(Sidel, 2014). The actions that Home Depot are implementing may be an excellent reduction in criminal activity, although you can only do so much with security systems.

Between the period of November 27th to December 15th 2013, over 11 gigabytes of data, personal and credit card details from 70 million customers was stolen. The details were stolen mainly through the hacking of Point of Sale (POS) machines, however there was a clear structure to the attack as shown below.

ATM machines with exorbitant fees have been thought to be acting as highway robbers, now they may even have a thieving companion; Card scanners. By stealing the information off the credit card as it is swiped the consumer is not even aware they have been attacked. Even if the consumer is careful to hide their hand as they enter the PIN in order to withdraw money from an ATM, the larcenist might still have a hidden camera or card reader to steal the card information. Erin Lowry, a content director for a popular magazine was a victim of two different attacks on her credit identity; she had $600 stolen from her account after using a shady ATM with a hidden scanner inside. The use of a low security ATM is a consumer error, but with everyday stresses sometimes common sense is abandoned in place of convenience. Larcenists will place these scanners inside ATM’s located in low socioeconomic areas with the intent to instantly copy the card numbers onto an embedded micro storage

Since the birth of the computer and the internet we have witnessed almost every business worldwide discard the timely usage of paper documents and filing systems and welcome the use of database servers which has enabled greater productivity, accuracy and availability. Many businesses like banks obtain highly sensitive personal information from their clients which is stored on database servers and encrypted with the goal of protecting their data from unauthorized users. Data being stored on servers creates an illusion of safety with them often being operated from a different geographic location, criminals can no longer physically take this data from a business’s premises as it is not stored locally, although cyber criminals have evolved along with these times and have proven time and time again that data security measures are still very exploitable across networks. The emerging digital age we now live in has become an extremely vulnerable and volatile environment and with networks becoming increasingly vast, it has become apparent with hackers constantly exploiting security measures that our data is never 100% safe. In 2005 a 24 year old Cuban-American by the name of Albert Gonzalez masterminded an attack which saw “over 150 million credit card and ATM numbers between 2005 and 2007” (Ottman, 2011) stolen and subsequently sold on the black market which has been labelled the biggest such fraud in history. Although millions of dollars are spent trying to catch cyber criminals

Financial institutions continues to be challenged by the inherent risks that are associated to the loss of customer data through the compromise of security controls. As Information Security continues to grow, the lack of effective security controls such as authentication continues to one of the key components leading to data breaches across all industries.