Evan Schuman's StorefrontBacktalk

That report also found that TJX "did not require network administrators and other users to use strong passwords or to use different passwords to access different programs, computers, and networks" and that it failed to "use readily available security measures to limit access" and cited one crucial example: not "using a firewall to isolate card authorization computers."Read more...

They like to buy liability insurance, buying into the line that shareholder assets will then be safe no matter what that boneheaded new Operations VP does in a year. They like Poison Pill plans, believing their lawyers that it will prevent them from ever being taken over. And, most recently, they are simply ga-ga for those who say that a PCI compliance letter means they are in a magical safe harbor, where they can do anything with their security that they want and be utterly immune from liability.Read more...

The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailers were given perfect encryption? Answering his own question (because I certainly wasn't able to do it), he painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential. Read more...

The retail move to embrace 2-D barcodes that began with a Sears trial in December and strong interest from BestBuy, the Gap and Target is inching forward, with a 500-store trial starting Thursday in San Francisco.

The trial, involving CitySearch, Antenna Audio and Scanbuy, is a fairly basic mobile integration effort. “More than 500 restaurants, shops and businesses reviewed by Citysearch are placing printed bar codes in their windows, and people who have Scanbuy software loaded on their phones can simply take a picture of the code and their phone’s Internet browser will immediately take them to the restaurant’s corresponding Citysearch page,” said a statement from the group.…

On its own, Russian POS shipments increased about 12 percent last year and they should see similar growth or higher in 2008, the report said. Read more...

The change to the Starbucks Card Rewards program shows not just an understanding of customer service, but a realization that the best way to make a CRM program successful is to focus on benefits—true benefits—for both the customer and the retailer. Instead of merely tracking purchases and offering small discounts (adjusting the price of a cup of flavored coffee down from ludicrously overpriced to merely absurdly overpriced. Buy one more croissant and tomorrow you can enjoy a cup of Joe that is only insultingly overpriced), Starbucks is getting creative about rewards. Read more...

The bill had been pushed by Assemblyman Jeff Morris. The final version of the bill—which Morris said he expects Washington Governor Chris Gregoire to sign into law on Tuesday—makes anyone guilty of a Class C felony if they "intentionally scan another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft or for any other illegal purpose." Read more...

In a delicious game of “Now You See It. Now You Don’t,” a security vendor called Rapid7 had proudly told the world that Hannaford was a key customer. But when Hannaford’s breach was announced this week, all references to Hannaford quickly disappeared. And then reappeared. Company officials then stumbled over each other, offering contradictory explanations for it all.

The changing official explanations was deliciously chronicled by NetworkWorld. But the gold medal award for illustrating the actual disappearing acts with wonderfully annotated screen captures goes to the Attrition.org site. If you want ideas on how to not handle a perception crisis, you’ve got to read them both.…

Pay By Touch (officially Solidus Networks Inc. doing business as Pay By Touch) issued a statement on Thursday that it "regretfully announced today that it will no longer process biometric transactions on behalf of its merchant customers and consumer membership base, as 11:59:59pm March 19, 2008."Read more...

For those who contend that PCI's only purpose is to transfer risk from the card brands to the retailers, Taylor writes, "I've worked with a number of retailers on PCI projects over the past few years and, believe me, retailers already own the risk of a breach. It's their brand on the line and they don't need the card brands or their acquiring banks to tell them that." Read more...

"The PCI Security Standards Council is made up of seemingly smart folks from the credit card brands and security industry. Unfortunately, this group of misfits is saddled with a myriad of competitive conflicts of interest and, worst of all, a complete misunderstanding of how to best protect card data and consumer identity," writes Adams. Read more...

Among the retailers that are referenced as most intelligently embracing merged channels–the true channel-agnostic merchant–is Borders, whether it’s with their new concept stores or their breakup with Amazon.com.

It’s therefore an especially troubling note that they are having financial difficulties, as detailed in this New York Times piece. It’s an age-old business belief that few chains truly buy into and adopt major strategic changes until it’s too late. I hope that Borders turns out to be the exception.…

Shortly after reports surfaced that the Hannaford grocery chain had been PCI compliant at the time of its data breach attack, the Web has been crawling with those questioning the value of PCI, even as the confusing preliminary details of the breach are being sorted out.

As one who has frequently used this column to point out the many flaws within PCI, please allow me to stand up and say to those PCI critics: What planet are you from that tolerates only perfect security systems? Do they conclude from one successful burglary of a house protected by a top-notch burglar alarm and high-security deadbolts that burglar alarms and deadbolts are worthless? Read more.…

During the breach, "no personal information, such as names or addressed, was accessed or obtained" but the breach did expose customer credit and debit card numbers along with their expiration dates, said Hannaford CEO Ronald Hodge.Read more...

You don't address security concerns by pretending they don't exist. You acknowledge that everything is relative and that weaknesses are there but there are advantages, too. Read more...

As of January, at least 60 percent of retailers have POS systems that are older than 5 years and a healthy chunk of those are more than 10 years old, according to an Aberdeen survey of 175 merchants.

The report tied those aging POS units with customer service problems “as order management, loyalty programs, and payment acceptance processes are fraught with delays,” according to this RetailWire column about the Aberdeen study…

Some retailers cite the relationship between Enron and Accenture as an example of why they do not use their PCI assessor for remediation services, or purchase security products from their assessor. Read more...

"We need to do a little more training," said Michael Verdesca, the chain's VP for systems development. Read more...

The laptop label that the company, Cybersource, uses is not actually based on the computer's unique identification, as such data can't be easily learned by the clues they drop when surfing. Instead, it's based on the intersection of several routine characteristics, which combined make it fairly likely it's the same machine. Some of the individual details would include the browser version, the exact operating system ID and the time differential on the system's clock ("clock drift"). Read more...

As Wal-Mart toys with various approaches to grow and continue to dominate retail, a Wal-Mart experiment in Michigan is fascinating in its difference. It has crafted a store focused on the local Middle Eastern community, complete with Muslim greeting cards, Lebanese pop CDs and kusa and batenjan among the produce offerings.

Technology is not a key factor in this store’s approach, according to this detailed Newsweek story, but the store truly catering to the local residents is impressive nonetheless. How’s this for not acting like Wal-Mart? “The insular company even agreed to be scrutinized by a community advisory board made up of local Arab-American leaders to ensure it isn’t harming the mom-and-pop shops. One example: Wal-Mart agreed to charge one dime more than local grocers for a six-pack of pita bread.”…

JCPenney and Krogers are the latest U.S. members of the National Retail Federation’s Association for Retail Technology Standards, joining the newest global members of Tesco, Carrefour and IKEA.

The Association for Retail Technology Standards is an international membership organization that, since 1993, has said that it was dedicated to reducing the costs of technology through standards.…

Hello, blog readers! We’ve been approached by a company that wants to create a 3-D environment for StorefrontBacktalk, complete with avatars for all readers. Before we explored this more seriously, we wanted to ask our readers whether we should proceed. Therefore…

…

Near Field Communication (NFC) is running into the exact same kind of tech hurdles that has slowed down RFID, according to a new report from the Venture Development Corp., which cited a lack of supporting infrastructure, standards problems and a “complex ecoysystem of stakeholders.”

VDC “believes that NFC may take root first in niche vertical applications rather than hypervolume consumer applications like contactless payment,” said this RFID Update story.…