Paying breach bill may not buy Hannaford full data protection

Comments

Related

Active Comments

Danny Lieberman says: I'm seeing headlines like - "Millions of dollars on IT security upgrades" and PCI consultants praising replacement of all the...

Read the rest | Reply

Michael Cherry says: I think everyone who wants to avoid a future lawsuit should follow Hannaford’s lead and encrypt their customer’s credit card...

Read the rest | Reply

All Comments (7) | Post New

• Nokia heralds N97 as most powerful mobile phone yet
• Too good to ignore: 6 alternative browsers
• 7 ways to cut your software costs during the economic downturn
• Major e-stores malfunction on Black Friday and Cyber Monday
• MIT researchers boost the power of solar energy

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

April 28, 2008 (Computerworld) Hannaford Bros. Co. said last week that it expects to spend "millions" of dollars on IT security upgrades in response to the recent theft of up to 4.2 million credit and debit card numbers from its systems.

Some of the new measures that the grocer outlined go beyond the controls mandated by the Payment Card Industry Data Security Standard, or PCI. But it isn't clear whether they actually will address the issues that led to the data breach.

The planned upgrades include the installation of intrusion-prevention systems on Hannaford's corporate network and the systems at its stores, plus the deployment in checkout aisles of new PIN entry devices with Triple DES encryption.

Hannaford also said it has signed IBM to do around-the-clock network monitoring, and the Scarborough, Maine-based grocer vowed to encrypt all payment card data on its internal network. The goal, Hannaford CEO Ronald Hodge said during a press conference, is to put "military- and industrial-strength" security controls on the company's systems.

The level of encryption that Hannaford has in mind isn't required by the PCI rules, which specify that card data needs to be encrypted only if it's being transmitted across open public networks.

Despite the lack of more-stringent requirements, encrypting card numbers on point-of-sale devices is "the most significant action" that retailers can take to stop attacks such as the one that hit Hannaford, said Gartner Inc. analyst Avivah Litan.

But that doesn't necessarily mean that the new security measures will make Hannaford — or other companies that follow its lead — immune to future attacks.

Jim Huguelet, an independent PCI consultant in Bolingbrook, Ill., praised some of the steps Hannaford is taking, including an earlier decision to replace all of the company's store servers. As part of the breach, malware was placed on the systems and then used to intercept the payment card numbers.

Huguelet said that the planned end-to-end encryption of card data also sounds good — on paper. But to make the data hacker-proof, he added, it would have to be encrypted from the PIN entry devices in stores to the systems of the payment-processing firm that authorizes card transactions.

And because almost no payment processors accept encrypted data at this point, Hannaford would likely need to convince the firm it works with to make system changes as well. "It's a tricky thing," Huguelet said.

Similarly, Hannaford's decision to replace all of its existing PIN entry devices puts it ahead of the curve in meeting a PCI mandate that companies must start using models with built-in support for Triple DES by July 2010.

But in most cases, the Triple DES technology encrypts only a customer's PIN, according to Huguelet. So even if Hannaford was already using such devices, it's unlikely that they would have prevented the card numbers from being compromised, he said.