Evan Schuman's StorefrontBacktalk

This sort of retro attack (it's like the Pong of computer break-ins) would be charming, except that it's growing rapidly. A year ago, almost no attackers used Telnet. But by the third quarter of 2010 (the last period for which Akamai has released data), Telnet attacks had jumped to one out of every six attacks.Read more...

The clues are in the mismatched description on Target.com for the product, which the small print describes as the "PlayStation Move sharp shooter." It turns out there is a new add-on for the PlayStation with that name. According to Sony, its list price is $39.99 (which matches the Target.com page) and it is scheduled to be available in February (which matches the description on Target's page that reads, "Arriving soon! Order now for shipment in 2 to 4 weeks").Read more...

The Cisco survey was comprehensive, with over 500 responses from IT executives across a wide range of vertical industries. Respondents included large Level 1 merchants and smaller, Level 2 and 3 merchants. The survey has a lot of good news. Respondents were familiar with PCI requirements, and 70 percent said their organizations were more secure because of PCI compliance than they would have been otherwise. Meanwhile, the NRF/First Data survey of small to midsize retailers revealed that the overwhelming majority of businesses (86 percent) care about protecting their customers' card data and feel payment card security is important to their business. That certainly is great news, but what followed left Walt scratching his head.Read more...

In South Carolina, Expedia made the standard E-Commerce arguments, namely that it doesn't do its business in South Carolina and that it's not really in the hotel business, as it doesn't own any hotels. The Supreme Court saw matters differently.Read more...

When RadioShack announced Monday (Jan. 24) that its board had chosen CFO Jim Gooch as its new CEO, it went out of its way to mention Gooch’s background in supply chain management and IT. This is just the latest example of retail boards showing new found respect for IT experience when sizing up folk for the big CEO corner office, including Home Depot, which is watching its own CFO’s IT chops when evaluating her for the CEO gig plus related IT respect demonstrations from Sears, Macy’s and Borders.

This IT love-fest is consistent with a move—started about 5 to 10 years ago—of assigning the CFO to oversee IT. Before that, it was more common for CIOs to report into COOs or often CEOs. The shift to having CIOs report into the financial group is an acknowledgement that IT is becoming more strategic and that it’s an area that CFOs must master if they want to run the whole ship.…

There’s a bittersweet aspect to JCPenney formally and officially wiping its catalog off the planet, as it did Monday (Jan. 24). Yes, it’s long overdue and others—including Bloomingdale’s—have already taken the anti-paper plunge. But the JCPenney catalog has been such a powerful part of retail Americana for so long that it’s hard to dismiss it as simply another retail channel that has completed its usefulness—even though that’s exactly what it is.

CEO Mike Ullman dusted off one of those all-purpose corporate explanations that could be used to justify almost any move: “The actions we are announcing today are significant steps in an ongoing process to ensure we are best managing costs and allocating our resources effectively to the strategies that will allow us to improve margins and drive profitable sales over the long term.” It would have been a lot more comforting had the statement instead said that the monies saved from the catalog and catalog stores would be reinvested into state-of-the-art mobile payment and item-level RFID projects. This statement seems instead to be just a cutback. Please stop me if I try saying Penney-wise and pound-foolish.…

When Google this weekend confirmed that the search giant—whose algorithms control a stunningly high percentage of E-Commerce sales—was giving a $100 million equity award to CEO-For-The-Moment Eric Schmidt, some thought the move unusual. After all, these unvested packages of stock and stock options typically go to new CEOs as part of a recruitment package. In Schmidt’s case, though, Google just announced that he will be replaced as CEO in April by co-founder Larry Page. (Schmidt will become executive chairman, presumably also acting as the head of the search committee to find the next CEO.)

The fact that Schmidt’s package vests over four years and that it’s the first time Google has given this type of an award to Schmidt, who’s been a successful CEO there since 2001, makes this situation seem more ordinary. Perhaps a golden parachute? There’s little precedent for this approach; CEO’s typically leave when the stock and profits are down or when they have been accused of something nasty. In this instance, however, the CEO seems to be leaving while doing an excellent job. Besides, the fact that it’s unvested stock and options means the package may be worth little if Google doesn’t continue to do well, thereby giving Schmidt an incentive to be a really aggressive executive chairman. …

Google's financials for 2009 starkly point out that 97 percent of revenues come from advertising. Everything else makes up 3 percent. Now, if you were Google, would you consider how to further develop the services that make you the most money, or would you decide to dabble in a highly competitive legacy industry where the constituents fight for scraps of interchange and transaction fees? Read more...

Citigroup has long been considered the most influential technology tracker on Wall Street, so these annual lists are not to be dismissed. IT used to be a backstage corporate function in Wall Street's eyes, but there are more indicators lately that the money folk are carefully watching the tech folk.Read more...

Another lesson is that the use of sophisticated personal technology is increasing, and with it comes further risk of a data leak. Many employees are returning to work in this new year with all manner of shiny new laptops, tablet computers, smartphones and other personal devices that Santa dropped off. Many of these devices will connect to your corporate network in some fashion and then to the Internet, where they will send, receive and process E-mail and other files. From a PCI point of view, pens PCI Columnist Walt Conway, these devices increase your risk, and that is why they are already included in PCI 2.0. Read more...

And if that list sounds familiar, it's because Interval sued all those companies last August for patent infringement. That suit was thrown out for being too vague about what the defendants had done wrong. The new version is very specific—and what happens to the Big Three of office supplies in this case will pretty much dictate what all other E-tailers can and can't do.Read more...

It's another example of how tricky E-Commerce can get when you put the work in the hands of a third party who has as much loyalty to your competition as it has to your business—and is taking money from all sides. But there's a deeper question: If no one at either retailer insisted that the third-party vendor protect branding with a unique Web site look, what else is unprotected from competitors? Customer recommendations? Sales data? CRM information?Read more...

Publicly held companies have to wrestle with a delightfully subjective concept known as material information. Its essence is, "would this information be something that would likely impact how an investor makes decisions?" On Monday (Jan. 3), Borders filed an 8-K form to the U.S. Securities and Exchange Commission, notifying the investing public that the chain's CIO—D. Scott Laverty—had left Borders after about 20 months. And it said that he had resigned that same day. But in early November 2010, when Sears parted ways with its CIO—Timothy Kasbe—it felt the need to say nothing. No SEC filing, no news release or statement whatsoever. What does that say about how much the two chains value IT? Is Sears saying that the loss of its IT chief wouldn't make a difference to any investor? Does Borders see its technology as more strategic?Read more...

Although initially this sounds like a perfectly reasonable question, it is based on the dangerous assumption that a $26 billion, 4,800-store retail chain can crash repeatedly during two weekdays and people won't notice. How did we learn about it? Two site tracking services, readers visiting the site, our visiting the site and multiple Twitter messages (including one from Rite-Aid itself). But how you learn about an outage is irrelevant. Retailers have to assume that customers (and, for what it's worth, competitors and investors) know about their crashes, and they need to be able to explain them. Rite-Aid didn't. And that was Problem Two.Read more...

When PCI was created, it was given a massive burden: to come up with a comprehensive set of security guidelines for any business that accepts payment cards, from Wal-Mart down to the two-store Phil’s Bait Shop chain. Today, that burden is at the center of a key PCI debate: clarity versus flexibility. Is it better to have concrete requirements, so everyone knows what to expect, or to have more options, so PCI rules can be more easily adopted to a wide range of merchants? It’s the topic debated in this week’s PCI podcast.

The changes in PCI 2.0 that add flexibility will definitely open the door for more debate and potential conflict, says Aaron Reynolds of Verizon Business. “Most of the clients are really frustrated,” he adds. “What most organizations are looking for is really, ‘how do I get there, and how can I get there with assurances that I’m not doing all of this for naught and the rug’s going to be ripped out from under me?'” Reynolds drills into the benefits and downsides to the new rules in the latest StorefrontBacktalk podcast on security. To listen to the podcast, please click here.…

This question also applies to other end of the transaction. Should a retailer feel more secure if it uses a card processor that suffered a data breach in the past but has fully remediated and is now validated (or revalidated) as PCI compliant today? Conversely, should a processor feel increased confidence in signing a merchant that has emerged from a data breach and has now validated its PCI compliance? PCI Columnist Walt Conway ponders this philosophical issue this week. Read more...

The chief anti-fraudster at the $50 billion chain, Paul Stone, wasn't even accused of anything (well, not until he walked into court, at least). He showed up in court to ask the judge to give a harsh sentence to some Best Buy contractors—who were convicted of overcharging Best Buy to the tune of almost $33 million—along with a former Best Buy manager who supposedly let the fraud happen, for kickbacks. But in the eyes of Michael Davis, who is the chief federal judge for Minnesota, the lackluster mechanisms and processes that Stone's LP group put in place allowed the crime to happen and Stone should have been punished.Read more...

Timothy Kasbe, a celebrated IT exec who arrived at the chain in February 2009 after having served as the CIO of India's largest retail chain, quietly left the company early last month. Very quietly.Read more...

Best Buy killed its profitable restocking fee policy and Amazon offered free super-saver shipping later than in any other holiday season, sweetening the deal with free next-day shipments for a large percentage of its hottest camera and video products.Read more...

Walt's first request is for the PCI Council to publish a full, one-year schedule of training sessions. The Council's training programs are excellent. Because of that, they are very popular and fill up quickly. As of this writing, the Council has not yet posted future training classes on its Web site. When that list is posted, Walt's wish is that it be a complete schedule for all 2011 courses. Read more...

A key takeaway from these attacks is that retailers are becoming increasingly at risk for data losses from systems they can't control. This goes beyond E-mail campaigns and includes a wide range of mobile programs, in addition to social site campaigns.Read more...

Right around this time, Amazon was very publicly hit with a DDoS attack by programmers retaliating against the E-tailer having cut off the hosting for WikiLeaks. But unlike fellow WikiLeaks targeted sites at MasterCard, Visa and PayPal—which all were crashed for brief periods—the extra capacity of Amazon's servers sustained the attack and didn't skip an HREF.Read more...

Why little pain? A $399,000 settlement is not a huge deterrent for a $50 billion chain, but it might become more annoying if it spreads to many other states. The actions required—the halting of the deceptive kiosk program—are also trivial, as that program had basically run its course and mobile devices pretty much make it irrelevant.Read more...

On Monday (Dec. 13), eBay announced a term it wanted to standardize: “Mobile Sunday.” This news prompted us to declare Tarantula Tuesday, the day when Web spiders work harder than any other day of the year. Or perhaps Webcast Wednesday, to celebrate the highest traffic day of the year for Webcasts that declare some other stupid made-up-day event. But wait, the eBay news release gets even better.

Quoteth the release: eBay “sets records on the busiest mobile shopping day ever,” a feat that is even more impressive because it’s the “second year in a row” such mobile records have been broken. Isn’t this akin to a retailer in 1995 declaring that it just had the highest E-Commerce traffic ever? M-Commerce is just kicking in, so of course everybody is having their highest mobile year ever. In fact, I’ll bet that everyone is experiencing amazing triple-digit percentage growth in mobile, too. Retail stats are confusing enough without marketing making up bogus days and offering silly comparisons.…

The ability to quickly scale up processing power is one of the chief attractions of cloud computing, and there's no doubt it works in at least some cases. For example, Amazon's ability to ramp up capacity via the cloud doesn't just keep the E-tailer rock solid during the holiday peak; it also probably keeps it going in the face of denial-of-service attacks. Still, getting everything in the cloud working correctly to handle a sudden surge isn't as easy as cloud boosters make it sound—and Tesco is Exhibit A.Read more...