Evan Schuman's StorefrontBacktalk

Of all the threats that make security executives sweat at night—including terrorism, profit-hungry cyberthieves, careless employees and the so-called disgruntled workers—the most dangerous and the least feared is simple capitalism. Put even more directly, the companies with the greatest ability to impact security generally have the least financial incentives to do so.

The most obvious example of this is payment card procedures. Retailers have begged the banks and card brands for years to take over card security. Given a choice between Myron’s House Of Gravel (one location) and Chase Manhattan, which do you think is better positioned to secure payment card information? But the banks and the brands have the power to refuse, we write in this week’s security column on McAfee’s blog, so it’s the merchants who have to house and protect the data.…

We're asking the question because a lot of major retailers today seem to be designing their Web apps based on the assumption that consumers are also using their desktops and that their mobile devices are simply a very temporary point of convenience. But is that how many consumers view mobile devices? What if we zero in on Gen-Y members, who seem to have an effortless natural affinity for these radiation-emitting thumb-typing mini-boxes?Read more...

Braden Black, a senior enterprise architect (and security specialist) for 305-store shoe chain DSW, said that, in his opinion, the biggest problem with chip-and-PIN—as it's currently deployed—is that banks have little incentive to make these systems secure because they no longer have any liability if they're repeatedly breached. That liability has been pushed to the retailers. "The ramifications of this attack are most disturbing when viewed in light of the fraud liability regulations that were adopted alongside the technology. Essentially, the banks offloaded fraud liability to merchants and cardholders." Read more...

From a security perspective, PCI Columnist Walt Conway pens, retail CIOs should understand a few things about these chip cards or smart cards (i.e., payment cards with an embedded integrated circuit or microchip). Chip cards can reduce fraud losses, but chip-and-PIN zealots can overstate the benefits.Read more...

Saying that it was "a result of additional market feedback," the Council ruled that the sensitive payment date on the digital recordings could be retained if the retailer can prove that the data in question can't be queried. "The Council is now saying that call centers can keep this data—even if digital—so long as they protect it per PCI. That is big," said Walter Conway, a 403 Labs QSA who is also StorefrontBacktalk’s PCI columnist.Read more...

Franchisee Columnist Todd Michaud adds that the kicker is that most retailers don’t even know it’s happening. We're talking about your closest competitors having access to some of your customer profiles (at a much deeper level than what you probably are aware of), the purchase patterns of those customers and the amount they are spending on each visit. And you have no idea. Sound scary? It is.Read more...

Concors said he was lucky; his senior management team is open to creativity and was willing to roll the pizza dough dice on what sounded like an interesting idea for the world's largest pizza chain, with its more than 7,500 U.S. restaurants and more than 5,600 shops in 97 countries and territories globally. But few CIOs are in that position, and that's a piece of reality that could cripple the nascent retail mobile app space. "A lot of companies are struggling with whether to enter this space because of the ROI issue," Concors said. A big part of the problem is that far too many retailers are deploying mobile apps for the wrong reason or doing it the wrong way.Read more...

No, this isn't some IT apparel version of Revenge of the Sith (although that would be cool, in a sort of geeky wool-blend kind of way). It's merely the unexpected path taken by the 53-store chain’s IT leader, who wanted to see how much of a Butterfly Effect he could cause in E-Commerce customer satisfaction by making small improvements in fulfillment operations. The computers in question are not of the Cyborg type, and they look less like C3PO and more like a cross between R2D2 and what Rodgers calls a "giant Roomba"—you know, those robotic self-running vacuum cleaners. They're orange and made by a robotics startup called Kiva Systems, which has placed these squat robots in the warehouses of retailers including Gap, Crate & Barrel, Walgreens and Staples.Read more...

"Visa sent customized settlement information packets to the affected financial institutions on January 14, 2010. In order to accept the settlement, a financial institution was required to affirmatively complete and return the settlement paperwork to Visa by January 29, 2010," said the statement from lawyers representing some of the impacted banks. "The offers--at least those reviewed by class counsel--appeared to be less than 10 cents on the dollar for most financial institutions and some at less than 1 cent on the dollar."Read more...

He's proposing the creation of a CIO Do Not Call List, where tech vendors can be placed on a "do not buy from" list if they violate even the slightest rule.Read more...

Barely a week after Intel and Microsoft announced their own futuristic digital signage plans—including PDA integration and analytics software linked to hidden digital cameras—NEC is talking up its own approach to digitally guessing consumers’ age and gender (plus counting them, but that’s so 1990s). Takeshi Yamamoto, vice president of NEC America’s IT software group, is quoted in the Wall Street Journal saying that the program is pretty good at getting within 10 years of a consumer’s age, that the program tracks a person’s age and gender but discards the digital footage, and that the data is aggregated.

“The program uses an algorithm that draws upon a database of thousands of faces as a reference. It looks at distinguishing points of the face, from the shape of the ears and eyes to hair color, to determine the age. The database expands as more people walk past the camera, allowing the program to make better judgment calls with time,” Yamamoto said. “The technology originated in Japan, where it was easier to implement because Japanese physical traits are more uniform. Mr. Yamamoto acknowledged that the U.S. market would be more difficult because of the diverse population.”…

The smart ones—and the only vendors you should be talking to, by the way—will tell you that there is no silver bullet to make PCI go away, which is a victory for reality over marketing hype. But there is one thing you should know about reducing your PCI scope: It is pretty important. If retailers are going to get the full value for their investment in either or both of these technologies, opines PCI Columnist Walter Conway, they better look carefully at their implementation or they may find they will not get all that they paid for.Read more...

This situation involves the U.S. government's General Services Administration (GSA) and some GSA interactions enjoyed by Benjamin Moore & Co. (the paint people). The conflict cropped up when the chain was dealing with some military accounts in Hawaii. The issue comes down to needing that payment card copy in the files (tax-exempt rules) but being unable to save the copy of a Visa payment card (PCI rules).Read more...

Some major retailers have been debating whether the buying and selling of used merchandise (please shoot me if I ever say “pre-owned”) is a business model worth pursuing. Wal-Mart and Best Buy, after pushing the idea for about six months, have surrendered plans to buy and sell used video games. But Amazon, always the more adventurous of E-tailers, thinks the idea has huge potential. A Financial Times of London story cited an Amazon ad for programmers: “As people upgrade to the latest and greatest there is a plethora of valuable, perfectly good products that need a new home. We help facilitate the pairing of new owner with device, while also creating an open marketplace.”

What makes the Amazon concept so intriguing from an IT perspective are the CRM implications. Instead of tracking purchases to merely profile the customer, the new requirement is to also profile the products purchased. What is each product’s life expectancy? What is the optimal point to make an offer to a customer who might be starting to get bored with that product? How much of an upgrade can that consumer afford? Should the company start pitching new prospects based on a software projection of what already-sold merchandise will likely come back into play? And you thought Amazon needed a huge data warehouse before?…

One of Bradley's first takeaways from the $2.8 billion HSN was that consumers' interactions with content are strongly influenced by their physical location. Why? It's expectation. Consumers see brick-and-mortars as places to look, touch and buy products. Video demos feel out of place in that context. At home watching TV, however, the expectations are much more tolerant. "Depending on where a person physically is can dictate how you can have their attention," Bradley said. "Out on the street? She'll have seconds. In-store? A minute or two. On the Web? Maybe 15 minutes. But on the TV? Hours. People go to the Web with certain goals in mind. There's a lot of bouncing back and forth as they're trying to solve a problem. There's more ADD, bouncing around."Read more...

"I typically say something like, 'It is our requirements that drive us to that price point. Adding centralized menu management, polling, integrated inventory management and labor management into the mix requires that we buy this type of system. You can’t do that stuff with a cash register or basic POS.' Typically, the response I get is something like: 'So? I don’t care about all of that complicated stuff. I just need to ring sales.' It’s no wonder franchisees think that retail CIOs are out of touch with reality. Here is the really crappy part. When you add in all of the other costs, such as high-speed broadband, hardware maintenance, software maintenance, help desk, installation, inventory management, labor management, training and various upgrades along the way, that $10,000 POS is probably going to cost franchisees $20,000 over five years--not to mention that they wrongfully expect the system to last 7 to 10 years.”Read more...

The almost daily reports of consumers and retail employees using either weak passwords or the same passwords in multiple places—or both—is being met with yawns by retail security executives. But the kneejerk response—forcing consumers and associates to be smarter about security—has had little effect, beyond being counterproductive.

For example, a company can automate rules for choosing passwords and require that they be changed periodically. But the stronger the password, the more it will fuel its own failure. Let’s say the rules require that passwords be at least 11 characters and include numerals, characters and non-traditional characters (&, %, |, @, #, ~, etc.). Add to that requirement that no character or number be repeated and that each password must pass a dictionary search. Sure, you’ll get a strong password, but you’ll also almost guarantee that that password will be written near the computer in plain sight as well as typed into a desktop file in clear text. As Newton’s IT director said, “To every password action, there is an equal and opposite stupid user reaction.” This is the topic of this week’s StorefrontBacktalk column on the McAfee security blog.…

Although retail sites are obviously very fond of cache, a new report from Forrester Research states that many developers are focusing only on one type of cache and leaving a lot of potential performance boosts in the ether. The report talks about server cache versus browser and edge cache. “Forrester has found that many companies do not take advantage of all three levels of caches in their architecture. Application development professionals often focus on optimizing the server-side cache while ignoring the browser cache or optimize their Web-page design to take advantage of browser caching only to be stung by geographic latency because they don’t know that they should use a content delivery network.”

Forrester stresses the importance of factoring in geography when making cache decisions but points out that IT shouldn’t confuse a dense population of customers with the company’s best (read: most profitable) customers. “Caching nearest to your users goes without saying, but most companies must allocate their caching dollars carefully, and your biggest investment should be close to your most profitable customers. Your most profitable customers may not be located in your highest concentrations of customers. Work with your marketing department to analyze customer profitability and location, and then review this data at least annually.”…

"You will need to reconfigure your call center application to stop recording the security codes. This point is where I start to have some problems. If your application can’t do this, you need to upgrade or replace it with one that automatically interrupts recording when, for example, the payment screen is displayed. And forget about using manual interrupts, at least if I’m your QSA. In practice, they can be too easily missed, forgotten or ignored. Large retailers will make a business decision and budget for the investment. But what about smaller merchants, charities and universities with call centers?"Read more...

Intel and Microsoft are working on what is truly the next generation of digital signs. These devices will be able to share content—both ways—with phones. But they could also use facial recognition to identify repeat customers without the benefit of loyalty cards or RFID. The cameras embedded within the displays would simply recognize faces the system has captured before, ultimately having the potential to identify those consumers.

The camera software will initially be designed to differentiate between genders and to detect products the customer has touched. That information could signal a coupon to be sent to that consumer’s smartphone. None of these options is rocket science. But they do show a concerted effort to leverage the kind of data that is accessible in-store and, ironically, much harder to capture online. Think of it as Big Brother with a sales commission.…

“Our captive center in Bangalore continues to be an important part of our long-term strategy and is highly integrated with our work and team in Minneapolis,” said a statement attributed to Jacob, who is a Target executive vice president in addition to being the chain's CIO. Added Tim Baer (another Target executive vice president and general counsel): “We do not know the source of this ridiculous speculation, but we can absolutely reaffirm that it is unequivocally not true.” If the speculation is so ridiculous, why issue a statement quoting two executive vice presidents? The only sentence in the execs’ statement that describes these rumors says: "The company emphatically refutes the irresponsible rumor that it is engaged in any discussions, or has any plans, to sell its Target India operations." This is where things get scary.Read more...

"3-D Secure has so far escaped academic scrutiny, yet it might be a textbook example of how not to design an authentication protocol," wrote Cambridge University's Steven J. Murdoch and Ross Anderson. "It ignores good design principles and has significant vulnerabilities, some of which are already being exploited. It's bad enough that EMV Verified by Visa and MasterCard SecureCode have trained cardholders to enter ATM PINs at terminals in shops. Training them to enter PINs at random E-Commerce sites is just grossly negligent." The pair, however, found that 3DS did get one part right: the money and where it comes from. Although "other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology, they got the economics wrong, and their schemes have not been adopted. 3-D Secure has lousy technology but got the economics right, at least for banks and merchants. It now boasts hundreds of millions of accounts."Read more...

For many retailers, flat or minuscule in-store revenue increases are becoming the norm, with online increases the only thing that looks bright. Mobile is going to quickly fall into that category (although a percentage increase for anything as new as mobile is meaningless, it still looks cool on an earnings report). But how can this work given the small revenue percentage E-Commerce still controls? Let’s take a look at Amazon’s latest numbers (which look pretty much like all of its numbers.)

The king of E-Commerce reported on Thursday (Jan. 28) a 42-percent increase in net sales for the fourth quarter just ended, along with a net sales increase of 28 percent for the whole year, to $24.5 billion. (To be precise, it’s actually 29 percent if you exclude a $182 million unfavorable impact from year-over-year changes in foreign exchange rates throughout the year, the company reports.) Sure, you say, but revenues are not the point. What about profits? Net income soared 71 percent (to $384 million) for the quarter and 40 percent (to $902 million) for the year. Amazon’s official guidance for the first quarter 2010 is equally rosy, suggesting a sales increase of as much as 43 percent. For those arguing that E-Commerce will always be a footnote to in-store, these numbers are hard to ignore.…

Former Woolworth’s CIO David Wills is in the middle of a criminal trial, accused of accepting more than $3.7 million in bribes related to IT decisions about a POS system and some server upgrades. The fraud accusations involved approximately $37 million in IT contracts that were awarded by the retail chain.

According to The Australian newspaper, the executive “allegedly received $1.78 million between February 1997 and January 1999 in exchange for awarding an IT contract to Israeli software firm Az-Ben. He is accused of accepting a further $1.92 million from Az-Ben for giving advice to NCR that was likely to influence NCR to enter into a contract with Advance Retail Technology.” The newspaper story added that the “contracts were for Woolworth’s APOS2000 project, an upgrade of its point of sale systems and servers for the Millennium rollover. In December 1997, the retailer began a $130 million overhaul of its systems.”…

The PCI community has been debating the audio rules for years, with our first story on it back in August 2007. (No, we won't say that this is the first sound decision from PCI in years. Plays on words and data security stories rarely mix well.) The issues go beyond the literal digital audio capture ruling that PCI just issued. Another key concern are overheard snatches of conversation. In theory, that is where a cyberthief calls a call center with a series of long questions. The thief records the call and later extracts the sound of other call center operators reading back credit card numbers, expiration dates and CAV2/CVV-2/CVC-2/CID details.Read more...