APolicy EASy Security Project Analysis and Recommendations for TJX Companies, Inc.

Security Incident - Agenda Background Vulnerabilities Recommendations Plan of Action Summary

Security Incident - Background 45 million credit and debit card numbers stolen Over an 18-month period Estimated cost = $4.5 billion

Security Incident - Vulnerabilities Insecure wireless network Vulnerable POS scanners Inadequate policies and procedures Insufficient security control systems and tools

Security Incident: Recommendations COBIT DS5 Objectives Not Met 5.1 Manage Security Measures5.14 Transaction Authorization 5.2 Identification, Authentication and Access 5.16 Trusted Path 5.7 Security Surveillance5.17 Protection of Security Functions 5.8 Data Classification5.18 Cryptographic Key Management 5.10 Violation and Security Activity Report5.19 Malicious Software Prevention, Detection and Correction 5.11 Incident Handling 5.20 Firewall Architectures and Connections with Public Networks 5.12 Reaccreditation 5.21 Protection of Electronic Value

Recommendations Improved Policies and Procedures Data ownership/classification Data retention Encryption standards Log management Incident handling Reaccreditation

Recommendations Adherence to PCI Standards PCI Requirements 3: Protect stored cardholder data 4: Encrypt transmission of cardholder data across open, public networks 11: Regularly test security systems and processes

Recommendations Infrastructure Improvements Implement Stateful Packet Inspection (SPI) firewall Utilize Active Directory Improve wireless devices Secure POS credit card scanners

Security Incident: Plan of Action

Plan of Action Institute a Network Security Team (NST) Team of 3 to 5 full-time employees Estimated total salaries $150K - $500K Develop, implement, and oversee security policies and procedures Implement the layered security approach: physical security technical security administrative security

Plan of Action Implement Security Information Event Management (SIEM) software Centralized log system Enable log management for incident identification and tracking FortiAnalyzer 4000B appliance Estimated cost of $40,000

Plan of Action Implement Infrastructure Changes Corporate-wide involvement Active Directory: $18-30K for licenses and servers AD administrator: $45-80K annual Implement Stateful Packet Inspection (SPI) firewall: approximately $5,000 Secure the POS credit card scanners: $1,000 each store

Costs Security Incident Approximate Cost Estimated $100 per lost record or $4.5 billion $118 million reserved for security breach 2009, $51 million and other undisclosed costs spent Average cost for PCI Security Compliance $568,000 on new technologies to comply with the PCI security standard $51 Million $118 Million $4.5 Billion $568 Thousand

Summary Prevention is key PCI and security = the cost of doing business

Questions? Project detail and references are contained in the Apolicy wiki Pam Sebesta Anne Drake Tom Schaefer Mike Grambow