Evan Schuman's StorefrontBacktalk

Loyalty cards are usually a way of tracking customer preferences and pitching new purchases—that is, they’re all about CRM. But Tesco, the world’s third-largest retailer,is stretching the concept in a new direction. The U.K. grocer is testing a ride-sharing program that lets Tesco loyalty cardholders sign up online to share car trips to three North London stores. What’s interesting is that Tesco’s ride-sharing Web site doesn’t just push rides to Tesco. It also encourages riders to use the service for commuting, getting kids to school and going to sporting events and shows.

Those activities aren’t likely to directly increase Tesco’s sales. But carpoolers who decide they like the service will have Tesco’s name in front of them every time they book a ride through the system, which is run by a non-profit organization called Liftshare. Still, as an online marketing effort, the Web site for setting up rides is oddly low-key: Customers can’t even click on the Tesco logo to go to Tesco’s own site.…

Back in 2007, after years of E-Commerce activity, the retailer shut down all of its Web activity to pour its efforts into in-store. In six weeks, though, Pier 1 is returning to the Web: as a brochure site only. You can see, but you can't buy, unless you drive to a store.Read more...

The beauty of social media done properly is its honesty. That’s why major companies love the idea of social media much more than actually doing it. Part of the social media challenge is letting your employees share their views, which will encourage your customers to share candid views right back. This exchange creates that much-discussed customer dialogue. The problem is your employees may say things that make you uncomfortable. That’s the whole point, as Best Buy discovered with its Brian Maupin video incident. Maupin is a very creative Best Buy employee who made a wonderfully funny series of videos, including this one about a customer trying to buy an iPhone.

Upon learning that the video pointed out key weaknesses in a product it’s trying to sell (even though Best Buy is never mentioned or referenced), ridiculed customers and used colorful language, Best Buy suspended the creator. But after a huge amount of media coverage, the retailer decided not to fire Maupin, who quickly issued a statement saying he may not take his job back anyway. The social media lesson, though, is key. It’s easy to put out promotional Tweets. But when your employees truly try to create a dialogue, you need to have the stomach for it.…

And because Amazon's new invention would make specific gift recommendations for anyone who asked, it raises the question of how easily crooks could go on private-data fishing expeditions, trying one gift after another to uncover personal details about their targets.Read more...

With a sample size of 1,729 and a survey done by Harris Interactive on July 1, the youngest segment clearly—and expectedly—showed strong acceptance of text alerts, with 42 percent support, with men about 10 percent more supportive (44 percent) than women (40 percent). But the surprise kicks in with the next group.Read more...

Among the changes are a centralized search box, new categories and comments that are much more easily accessible.Read more...

PCI DSS 1.2 CHANGES SUMMARY

FINAL

INTRODUCTION AND PURPOSE

The PCI Security Standards Council has announced that version 1.2 of the PCI Data Security Standards will be available for general use October 1, 2008. The purpose of this document is to provide high level guidance on the changes to be brought about with this key milestone standard revision. Version 1.2 is an update to the current version 1.1 and follows the established approved lifecycle process, which provides for revisions or new versions on a 24 month cycle. While version 1.2 will not introduce any major new requirements, it will include clarifying items designed to fulfill the following goals inherent to the PCI Data
Security Standard:

SUMMARY OF CHANGES

As noted above, the revisions to version 1.2 do not incorporate any new major requirements. Therefore the changes summarized below reflect the same six guiding principles and 12 requirements currently in force under version 1.1. Note that this summary of changes does not include all changes made in version 1.2. The PCI Security Standards Council reserves the right to make final revisions to version 1.2 prior to publication; this summary is for initial preview purposes only, and does not supersede PCI DSS v1.1. Once PCI DSS v1.2 is publicly released, PCI DSS v1.2 will be the official version and further guidance will be provided about effective and sunset dates.

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

GuestView Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

Based on the PCI Standards Committee’s official "hint" about what will be in the 1.2 release, it appears that clarifying when and how virtualized servers can be PCI compliant didn’t make the cut. But before the server and security geeks start lighting their torches and getting all "vigilante" on the card brands, let me tell you why I don’t think this will matter.

Virtualization saves money. As a technology, virtualization—particularly server virtualization—is saving retailers money on hardware and IT management. In a down economy, cost reduction trumps compliance. Where virtualized servers and PCI compliance come to blows is PCI DSS 2.2.1, which says only one primary function per server. Because some merchants, assessors and acquirers think "physical server" when they read this standard, some merchants have limited the deployment of server virtualization to the dev/test environment.

Other merchants are making sure not to deploy server virtualization in the cardholder environment. Still others are deploying virtualized servers for applications with credit card, SSN and other confidential data, but they are careful not to put applications with different "trust levels" for different levels of access controls on the same physical server. The point is that if you want to use virtualization to reduce your IT costs, you just need to be careful about what applications you put on what types of servers.

Proof that virtualization is secure. We recently did a Webinar on the topic of how to prove that virtualized servers are secure enough to pass PCI assessments. Based on interviews with more than a dozen PCI assessors for the PCI Knowledge Base, it’s clear that in more than 75 percent of …

Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.

At this week’s National Retail Federation CIO conclave, NRFtech, the CIO of J.C. Penney presented the keynote, which focused on the top five priorities for the business and the technical implications of these priorities. PCI compliance, perhaps not surprisingly, was one of these top five priorities.

During the discussion, the CIO, Thomas Nealon, commented that one of the biggest challenges when it comes to PCI is explaining to businesspeople why it’s a priority. This is a common refrain among merchants of all types and sizes. Because there are a lot of examples of this in the Knowledge Base, I thought we could discuss some of them, so that others may be able to use them in their own companies.

Veri?ed by Visa and MasterCard SecureCode: or, How Not to Design Authentication
Steven J. Murdoch and Ross Anderson
Computer Laboratory, University of Cambridge, UK
http://www.cl.cam.ac.uk/users/{sjm217,rja14}
Abstract. Banks worldwide are starting to authenticate online card transactions using the ‘3-D Secure’ protocol, which is branded as Veri¬?ed by Visa and MasterCard SecureCode. This has been partly driven by the sharp increase in online fraud that followed the deployment of EMV smart cards for cardholder-present payments in Europe and else¬where. 3-D Secure has so far escaped academic scrutiny; yet it might be a textbook example of how not to design an authentication protocol. It ignores good design principles and has signi?cant vulnerabilities, some of which are already being exploited. Also, it provides a fascinating les¬son in security economics. While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted. 3-D Se¬cure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts. We sug¬gest a path towards more robust authentication that is technologically sound and where the economics would work for banks, merchants and customers – given a gentle regulatory nudge.
Introduction
Card-not-present transactions take place over the Internet, phone, or post, where the merchant and point-of-sale are not in the same physical location as the card and its holder. Fraudulent transactions of this type now account for a large proportion of bank fraud losses. In the UK, for example, it increased 118% from 2003 to 2008, when it accounted for £328.4m of losses to banks and merchants – over half the £610m total for all bank card fraud [3].
This rapid increase has been driven by the deployment of smart cards based on the …

If you’re seeing this note on your copy of the newsletter, it means you were suggested by David Taylor—former Gartner analyst, current president of the PCI Security Alliance—as someone who might be interested in the latest trends and news from the payment security arena, especially as it relates to retail and to the banking worlds.

This is a new newsletter from StorefrontBacktalk.com, which is a blog that covers retail technology and E-Commerce trends. I’m the editor of the newsletter and I also serve as the Retail Technology Editor for eWEEK and am also the former News Editor for InformationWeek and TechWeb. I’ve also covered retail and technology issues for RISNews, Consumer Goods Technology, the New York Times, BusinessWeek, ABCNews.com, Reuters, National Public Radio and a host of other media.

When 60 Minutes did a segment on TJX’s security issues last month, the only media source it linked to for more information was StorefrontBacktalk. They’re hardly alone, insofar as StorefrontBacktalk.com has been repeatedly linked to from the Wall Street Journal, Yahoo News, ConsumerWorld, Fox News and PCMagazine plus BusinessWeek, The Washington Post, Wired Magazine, CNET, ComputerWeekly and TechTarget, plus quite a few links from the intranets at Procter & Gamble and Target. In the retail arena, we’re repeatedly linked to from NRF’s Smartbriefs, RetailWire, RetailForward and lots of other retail publications.

As a journalist, I can promise you an unbiased look at the various security trends. As a columnist, I can promise you a non-passive voice that will at least try and put these issues into broader context The newsletter is free and we will , with more than a dose of attitude. We’ll never sell your name, as that is, well, tacky. Dave Taylor will be writing a regular column for the newsletter, looking at a wide range of security …

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS COUNTY DEPARTMENT, CHANCERY DIVISION
CHRISTINE DESANTIS, individually and ) on behalf of a class of similarly situated individuals, ) )
Plaintiff ) No.
) JURY TRIAL DEMANDED
v. )
) SEARS, ROEBUCK AND CO., ) a New York Corporation )
) Defendant )

CLASS ACTION COMPLAINT
Plaintiff Christine Desantis, on behalf of herself and a class of similarly situated
individuals, brings this action against defendant Sears, Roebuck and Co. ("Sears"). Upon
personal knowledge as to herself and her own acts and upon information and belief as to all other
matters, Desantis complains as follows:
VENUE
1. Venue is proper in Cook County because Sears resides in Cook County and
because the wrongful acts arose here.

PARTIES

2. Desantis is a resident of New Jersey.

3. Sears is an Illinois corporation with its principle place of business in Hoffman

Estates, Illinois, located in Cook County.

SEARS’S UNSECURED "MANAGEMYHOME" WEBPAGE

4. In an effort to promote its website and increase sales, Sears has established a web-based system to allow customers to view their purchase history on-line at www.managemyhome.com ("Managemyhome website").

5. Sears’s system, however, is fatally flawed and was designed in such a way as to significantly compromise the private information of its customers.

6. Sears’s system works as follows: A user goes to Managemyhome website, creates an account and logs-in. The user then need only enter in publicly-available information (such as the name, phone number and street address) of a Sears customer in order to view the customer’s history of on-line and even in-store purchases. The Managemyhome website provides detailed histories of past purchases, including model numbers, purchase dates, warranty information, and protection plans.

7. Moreover, the Managemyhome website will provide purchase history of all residents of a particular address, regardless of whether …

November 30, 2007 10:32 AM Eastern Time
Visa and TJX Agree to Provide U.S. Issuers up to $40.9 Million for Data Breach Claims
U.S. Visa Issuers Eligible to Participate in Speedy, Alternative Recovery Program
SAN FRANCISCO–(BUSINESS WIRE)–Visa Inc. announced today it has negotiated an agreement with The TJX Companies, Inc. (TJX) and its U.S. acquirer to offer an alternative recovery program to U.S. issuers that may have been affected by the retailer’s previously announced unauthorized computer intrusion(s). The retailer will pay up to $40.9 million to fund the program, which requires a certain level of participation by issuers for the offer to be finalized. Visa is supporting the program and presenting the optional offering to eligible issuers.
"We believe issuers will benefit greatly by participating in this program because it offers immediate recovery on their data breach claims," said Ellen Richey, head of global risk management for Visa Inc. "This agreement demonstrates the importance of retailers and the payment card industry working together to protect cardholder data. Additionally, it’s clear the impact of a data compromise harms all payment system stakeholders — merchants, banks and consumers alike. We hope one outcome of this resolution is recognition that a greater investment in security is good business."
The agreement, which is contingent upon acceptance by financial institutions representing 80 percent of the eligible U.S. Visa accounts affected by the data compromise, also includes mutual releases by TJX, its U.S. acquirer and Visa related to the retailer’s data compromise. All U.S. Visa card issuers that experienced counterfeit fraud losses on accounts that were used at TJX’s U.S. stores during certain time periods identified by Visa or that had operational expenses related to the accounts involved in the TJX breach and flagged by Visa will be eligible to receive some financial recovery this calendar …

BILL NUMBER: AB 779 ENROLLED
BILL TEXT

PASSED THE SENATE SEPTEMBER 6, 2007
PASSED THE ASSEMBLY SEPTEMBER 10, 2007
AMENDED IN SENATE AUGUST 31, 2007
AMENDED IN SENATE AUGUST 20, 2007
AMENDED IN SENATE JULY 10, 2007
AMENDED IN SENATE JULY 3, 2007
AMENDED IN ASSEMBLY JUNE 1, 2007
AMENDED IN ASSEMBLY MAY 14, 2007
AMENDED IN ASSEMBLY MAY 1, 2007
AMENDED IN ASSEMBLY APRIL 10, 2007

INTRODUCED BY Assembly Member Jones
(Coauthors: Assembly Members DeSaulnier, Huffman, and Krekorian)
(Coauthor: Senator Migden)

FEBRUARY 22, 2007

An act to add Sections 1724.4 and 1724.5 to, and to repeal and
amend Sections 1798.29 and 1798.82 of, the Civil Code, relating to
personal information.

LEGISLATIVE COUNSEL’S DIGEST

AB 779, Jones. Personal information: state agencies and
businesses.
(1) Existing law imposes specified duties upon certain persons or
businesses that conduct business in California to, among other
things, take reasonable steps to destroy customer records, implement
and maintain reasonable security measures, disclose a breach of
computerized data, and, upon request, provide specified information
to a customer in relation to the disclosure of personal information
to 3rd parties. For a violation of any of the above-described
provisions, existing law allows an injured customer to institute a
civil action to recover damages or for injunctive relief.
This bill, on and after July 1, 2008, would prohibit a person,
business, or agency, as defined, that sells goods or services to any
resident of California and accepts as payment a credit card, debit
card, or other payment device, from storing, retaining, sending, or
failing to limit access to payment-related data, as defined,
retaining a primary account number, or storing sensitive
authentication data subsequent to an authorization, as specified,
unless a specified exception applies. Upon a violation, and as
applicable, the bill would apply specified reimbursement and notice
provisions, as …