Evan Schuman's StorefrontBacktalk

There is no shortage of advice on ways to try and prevent a data breach. But if it happens to you, do you have a plan of precisely what to do after the fact? Very few retailers do. Lots of complicating factors exist, such as the probability that the breach will be discovered many months after it ended, plus the fact that the bad guys will almost certainly have radically altered the logs. But the essential issue is that you have an urgent need to do several things immediately.

First, you have two competing Number One priorities: Stop the current attack (if it’s still going on) and prevent a new one; and keep systems fully functional so that sales are in no way impacted. Those two priorities don’t play well with each other, and that’s what we’re exploring in our Guest Column this week on the new McAfee security blog. Conflicts aside, there is a logical sequence of events that retailers need to follow the instant a breach is discovered. …

Then there are negotiations. “You need to sharpen your pencil, I’m not paying this much.” Good IT leaders will work hard to deliver services at the lowest possible cost. But they need to be careful not to negotiate such a low price that the vendor will never be able to meet their expectations for service. Believe it or not, getting the lowest price is not always the right goal. By the way, if anyone is looking for someone to help negotiate a cheap, crappy IT service, Michaud knows plenty of people who would rock your world.Read more...

Somehow, this report just doesn’t add up. The premise comes down to the fact that a sharply increased bandwidth load will disrupt sites. That makes sense, but the argument that homebound workers and students will cause that sharp increase in bandwidth is where this argument falls apart. Read more...

A Boston geolocation vendor argues that different phone brands absolutely are linked to very different purchasing patterns and preferences. For example: "BlackBerry users are more likely to compare gas prices online than other smartphone owners. Users of iPhones, meanwhile, are eight times more likely to search for Starbucks locations than users of other smartphones."Read more...

For all the naysayers predicting an even weaker holiday shopping season this year compared with last year, Amazon.com has a snow-sprinkled Bronx Cheer for them. The giant E-tailer announced earnings Thursday (Oct. 22) showing a 69 percent increase in third-quarter profit on a 28 percent increase in quarterly net sales, which soared from $4.26 billion to $5.45 billion.

Even more interesting is its fourth-quarter holiday predictions. Rather than predicting revenue decreases, Amazon issued guidance that predicts sharp double-digit increases: “Net sales are expected to be between $8.125 billion and $9.125 billion, or to grow between 21 percent and 36 percent compared with fourth quarter 2008.” Either way, if you’re planning on scaling back your server farm because you’ve been led to expect a drop in holiday traffic, you might want to reconsider. …

But one retail data breach victim this month took the opposite approach. The Colorado liquor store had its payment records stolen via the Internet. The breach impacted dozens of banks and an untold number of consumers (police were quoted in one local newspaper as saying the breach impacted "thousands" of customers). Once its breach was discovered on October 5, the Cheers Liquor Mart (which bills itself as the largest liquor store in southern Colorado) went back in technological time. It completely cut off its card processing system from its POS and brought out from storage its old dial-up mechanism for connecting to the processor. The delay customers experienced was not noticeable, and the security—when compared with the breached modern system—was ironclad.Read more...

What often happens is a sort of gridlock, where a project stalls under its own weight. Typically, the debate divides over party lines. Conservatives (those who believe that IT is simply a cost-suck) and Progressives (those who believe that IT drives business value) generally are split over the “smallest/cheapest/simplest technology” and the “ring every possible ounce of value out of it” divide.Read more...

This approach isn't much of a technological innovation. All the vendor is doing is adding a script that leverages the data the brands have been offering for years. But it's a script that no one else has yet bothered to create. That said, given the number of retailers that never chose to use the original services, it's unclear how many will jump at this new feature.Read more...

Sure, social networking is a huge retail trend, but retail IT? "You don’t need IT to Tweet, but you sure will be buying an awful lot of software in 2011 that will analyze all this unstructured information," Roster said. "Now imagine a year down the road when I can go into a retailer and start tagging my likes and dislikes on any given product. It is just mind-boggling how rapidly software will be evolving within the next 5 years."Read more...

The well-publicized incident saw legions of T-Mobile Sidekick customers lose contacts, calendar entries, to-do lists and photos when a Microsoft subsidiary named Danger (nope, won't go there. Far too easy) suffered a glitch. Or as Roz Ho, the Microsoft corporate VP for premium mobile experiences, said in a statement: "We have determined that the outage was caused by a system failure that created data loss in the core database and the back-up." (You think?) Apple, Palm and others offer centralized backup for their mobile devices, too. But the data also stays on the device and, cleverly, backs up routinely to a customer-controlled device (typically a desktop machine). When thinking about the totality of data such devices collectively house, that very fragmented approach most likely preserves the overwhelming majority of the data. And if a customer's laptop fries, the mobile phone manufacturer or carrier is unlikely to be blamed.Read more...

"Our E-Commerce business processed through Digital River accounted for $650 million, or 36 percent of our consumer revenue in fiscal 2009. As compensation for their work, we paid Digital River approximately $95 million. These fees were classified as contra revenue. Thus, as a result of taking this E-Commerce business in-house, you’ll see our consumer revenue increase, driven by the elimination of this contra revenue," Symantec CFO James Beer said. "Conversely, the cost of running our own E-Commerce platform will be classified primarily in operating expenses with some amounts flowing through cost of goods sold. Therefore, operating expenses and cost of goods sold will both rise year-over-year." It gets even better.Read more...

Schwarzenegger's veto (which allegedly prompted the bill to look at the governor and bellow, "I'll be back") is not the first time he's tackled data breach legislation; he has already forced earlier versions to be diluted. The new bill, SB-20, would have required retailers to provide more details about a breach, including the type of personal information exposed, a description of the incident and exactly when it took place. It also required merchants to submit a copy of the notification letter to the California Attorney General’s office if more than 500 California residents are affected in a single incident.Read more...

Operations at Air New Zealand came to a halt for about four hours Sunday, October 11 when an IBM data center suffered a power failure and a back-up generator failed to kick-in because of a faulty oil-pressure sensor. But the intriguing part was the response by airline CEO Rob Fyfe, who in an E-mail to IBM seemed to show that he suffers from a pressure control glitch of his own. "In my 30-year working career, I am struggling to recall a time where I have seen a supplier so slow to react to a catastrophic system failure such as this and so unwilling to accept responsibility and apologize to its client and its client's customers," the E-mail said. Read more...

Although the new iPhone app will accurately point shoppers to the aisles and shelves housing their desired products, Lansley acknowledged that the wireless signal at some stores is too weak to work with iPhones turned on while customers are deep within the depths of Tesco's larger establishments.Read more...

One site monitoring company this week reported that the 1-800-Flowers.com E-Commerce site was down for a whopping 65 hours and 26 minutes. The flower company didn't respond to our inquiries, but a fairly perplexed representative of the monitoring firm did. "To be honest, this is one of those rare cases where I’m not entirely sure if this is legitimate downtime, that is, downtime that regular human Web site visitors would notice," he said.Read more...

These new details of Wal-Mart's data breach—which saw POS source code grabbed and zapped to parties unknown in Eastern Europe—are shedding more light on the early days of such retail assaults and how various chains learned of and then dealt with them. But here’s the rub: Wal-Mart maintains that no customer or employee data was taken. Does it truly stand to reason that those thieves would have had secret access to the systems from the world's largest retailer for 17 months and not taken any names or card data? Oddly enough, it seems likely that they, in fact, didn't. And therein lies the potentially most intriguing part of the story.Read more...

Gonzalez was whisked from his federal prison cell at the Central Falls Detection Center in Rhode Island to face U.S. District Court Judge Jerome Simandle in Camden, New Jersey. (Yes, I know. "He was forced to spend hours in Camden. Hasn't the man been punished enough?" Hey, I'll make the New Jersey jokes around here. At least he was spared a trip to the federal courthouse in Newark. When you're indicted in Jersey, you count your blessings.)Read more...

When it comes to security, IT’s job is to do whatever it takes to keep the chain’s data safe. But with budgets being universally tight—and nowhere more so than in IT, where the only things offered are potential cost reductions and risk avoidance, with no revenue boosts in sight—compromise is mandated.

But how far does a chain have to go? And what choices are reasonable, and which ones are a little too dangerous? Those are the first issues StorefrontBacktalk is exploring in a series of GuestView columns that will be appearing on a new blog launched by security vendor McAfee. The first of our columns launched Wednesday (Oct. 14).…

PCI Columnist David Taylor heard from one retail leader who was especially upset about Visa’s reference to ANS X9.24 as the key management best practice, mainly because it’s so focused on encrypting PINs and is not meant to be a general-purpose key management system. He suspects this concern will mushroom into a real battle unless technology vendors can make it clear how investments in enterprise key management systems will be preserved while still meeting ANS X9.24. These standards were, after all, designed for the financial services industry.Read more...

Franchisee Columnist Todd Michaud wishes 10 percent of his business cases looked this good. The problem is that even before he presents the business case, he knows that the project will never even get off the ground. Why? Because, Michaud opines, it crosses the IDM (It Doesn't Matter) Threshold. This magical perception number trumps value and speaks to psychological biases.Read more...

For years, retailers involved in major data breaches had little to worry about from U.S. courts, thanks to credit card zero-liability programs. Those programs made sure that consumers didn't lose money from the breaches, which in turn made it almost impossible to successfully prosecute those retailers in civil courts. Civil courts are fundamentally based on making plaintiffs financially whole. But there's now the possibility that those retail protections could go away because a Maine judge—who is overseeing the data breach litigation involving Hannaford—has asked the state Supreme Court for permission to do so. This is the same judge who had earlier dismissed the accusations against Hannaford. He has since changed his mind. Read more...

As the lawsuits involving Heartland’s massive data breach move through the court system, an unusual claim was inserted into a court filing. The September 23 filing in the U.S. District Court for the Southern District of Texas was trying to raise questions about Heartland’s post-breach conduct. It then shared the following anecdote without further explanation.

“On the day after the data breach, Heartland conducted a Webinar about the data breach for its high-level employees, sales representatives and/or relationship managers. Upon information and belief, Heartland relationship managers were told that PCI compliance was not a big deal. One of Heartland’s relationship managers resigned on or around April 23, 2009, in part because of Heartland’s statements regarding its PCI compliance. A Referee’s Decision in a Delaware Department of Labor proceeding reached the conclusion that this relationship manager had ‘good cause’ to leave her position at Heartland based, in part, on Heartland’s conduct.” That might prove quite significant, or it could be an irrelevant red herring. Either way, it’s not the kind of detail we see very often.…

StorefrontBacktalk surveyed our readers this month to get a sense of how widespread the practice is today. Read more...

But PCI Columnist David Taylor sees something else interesting here. "For the last four to five years, companies have been told that achieving PCI compliance is much easier if they segment their network. Otherwise, all their corporate systems are in PCI scope. But network segmentation is not a PCI standard, per se. If an organization wants to keep their entire network and the connected systems in scope, it’s up to the company’s management."Read more...

But other issues are emerging about tokens. For example, the risk of storing convenient metadata in the tokens, info such as SKUs and exact time/place of purchase and CRM info. Although tempting, such convenience could prove disastrous if a retailer starts holding the data internally and then outsources without remembering to do an intense data cleanse. Read more...