Evan Schuman's StorefrontBacktalk

Home Depot CIO/EVP Bob DeRodes has resigned and will leave the $77 billion home improvement chain “at the end of the year,” according to a statement Home Depot issued Thursday. DeRodes will continue to run IT until he leaves, the statement said, as the chain starts a search for his replacement.

DeRodes joined Home Depot in February 2002 and the statement credited him with several major IT rollouts, including self-checkout, “continual point of sale upgrades,” BEAR, the Company’s back-end automated receiving system and an SAP Finance implementation that was considered at the time the largest ever. He was also credited with opening the Austin Technology Center in 2005, “which provided needed backup systems and security for the Company’s data management infrastructure.”…

covers a variety of uses (see the Patent's full text here as well as some illustrations that accompanied the federal filing), but its core functionality would require consumers to download a small applet to their phone, which would then be associated with a payment method plus a password and potentially some other authentication approach such as any form of biometrics. Password-only protection is the default scenario. Another piece of software would be installed in the retailer's POS system. Read more. Read more...

Whether it's leaving firewalls in learning mode or having database access controls that all but ignore the activity of authorized users--who may be capable of nastiness few cyber thieves could dream of--it's an amazingly risky approach. Read more...

Although the merchant behind the program—Chockstone—stresses a variety of security mechanisms, the nature of the program itself seems to fly in the face of PCI guidelines that discourage using credit card numbers for anything other than payment transactions, similar to the unsuccessful attempts to get American businesses to stop using Social Security numbers as defacto employee and customer identification numbers. Read more...

The service can also support Web searches—but that's hardly new—and is being positioned by Amazon as an easier way for consumers to make Amazon purchases. The transactions can be almost solely done via text, with an old-fashioned phonecall used to verify the purchase.Read more...

Nowhere is this myth more wrong—indeed, polar opposite wrong—than when dealing with security breach issues of U.S. retailers. I'm going to try and avoid using modern-day chains to illustrate good and evil. Regrettably, I think it's a safe bet that I am about two sentences away from failing that effort. Let's take TJX as an example. (Only one sentence. I was close, though.) Based on various SEC filings and court documents, it's clear that TJX engaged in a wide range of security procedures that were, to be charitable, less than diligent. But, as we've pointed out many times, the millions in expenses that TJX has had to spend had absolutely nothing to do with any alleged security sloppiness. Read more...

Was the Hannaford data breach isolated or was it part of a sweep of similar penetrations? A Vermont ski resort is reporting an almost identical breach of card information in transit in February and an official there was told by law enforcement “that they currently are looking into about 50 reported incidents of the same sort in the Northeast alone.”

Those new details–courtesy of a Computerworld story–suggest that this might soon become the norm. The Okemo Mountain Resort ski area in Vermont announced this week that data from more than 46,000 credit and debit card transactions may have been compromised during a system intrusion over a 16-day period in February. “We can tell you that this was a real-time theft,” said Okemo spokeswoman Bonnie MacPherson. “The information was being taken as the cards were being swiped.”…

TJX will pay as much as $24 million to cover databreach losses suffered by MasterCard banks, assuming 90 percent of the banks agree to the settlement offer, TJX and MasterCard announced on Wednesday. TJX last year announced the world’s worst payment data breach, which impacted some 100 million cards.

Participants “must agree not to seek or participate in any other recoveries that may be available to issuers and must also release MasterCard, TJX and TJX’s acquirers from all legal and financial liability associated with the TJX data breach, ” a joint statement said. Those banks have 30 days to whether to accept the offer. …

Although the coupon redemption rate has been steadily declining for at least 10 years, a new vendor survey suggests the recession may turn that around.

Of the 1,529 U.S. consumers who responded, 67 percent said they are much more likely, or somewhat more likely, to use coupons during a recession, according to the survey performed by ICOM Information & Communications. Technology is helping, though, with CRM doing better job targeting households and Web coupons finding new fans among the paper-repulsed young.…

Bankrupt Pay By Touch—officially using the name Solidus Networks—has sold off two key units for a total of $4.8 million.

Phoenix Check Cashing dropped $4.2 million to pick up Pay By Touch’s check-cash¬ing division, known as BioPay Paycheck Secure, according to The Nilson Report. Acculink paid $600,000 for ATM Direct, a unit trying to introduce PIN-based debit card payments for E-Commerce sites, the publication reported.…

This week brings the news that American Express is halting its ExpressPay keyfob, some six years after the payment giant started offering it. The program is expected to deactivate the last of its fobs by July. There are many reasons the fob may have died, but at least Amex—with six years of fob effort under its payment belt—can't be accused of not giving the fob enough time to work.Read more...

The Hannaford data breach included payment information that was partly encrypted and partly clear text—and it was all transmitted over a private fiber-optic cable, according to a Hannaford official quoted in the Wall Street Journal.

This information—on top of the reports that Trojan Horse software was installed on 300 servers in 300 Hannaford stores–is painting a picture of a retailer that seemed to be following accepted security procedures. The story reported that the cyber-thief created software “intercepted the information as it went back and forth over a cable to a transaction processor in Denver. It was then transmitted to an Internet service provider somewhere outside the U.S.,” according to Hannaford marketing VP Carol Eleazer, who added that “it took a team of about 30 forensics experts and information technologists more than 10 days of round-the-clock troubleshooting to discover the malware.”…

A new type of payment card forger is making the rounds, this time armed with a razor blade and very little money.

After the thief has been able to guess at random numbers and find a viable payment card, the culprit razors off the last few digits from a real payment card and KrazyGlues the guessed at numbers onto the card. He/she then scratches the magstripe to force the cashier to manually enter in the digits, according to this nicely-done story from the Oregonian newspaper.…

The data breach at Hannaford involved a Trojan Horse that was installed on servers at every one of its 300 grocery stores, according to Hannaford officials. The software intercepted card data at the POS and then periodically transmitted them “to an unnamed offshore Internet service provider.”

Those details come courtesy of a letter sent by Hannaford general counsel Emily Dickinson to Massachusetts Attorney General Martha Coakley and Governor Deval Patrick’s Office of Consumer Affairs and Business Regulation, according to Hannaford officials and a report in The Boston Globe, which quoted from the letter. The chain decided to replace all of the servers to make absolutely certain the malicious programs were removed from the network.…

That report also found that TJX "did not require network administrators and other users to use strong passwords or to use different passwords to access different programs, computers, and networks" and that it failed to "use readily available security measures to limit access" and cited one crucial example: not "using a firewall to isolate card authorization computers."Read more...

They like to buy liability insurance, buying into the line that shareholder assets will then be safe no matter what that boneheaded new Operations VP does in a year. They like Poison Pill plans, believing their lawyers that it will prevent them from ever being taken over. And, most recently, they are simply ga-ga for those who say that a PCI compliance letter means they are in a magical safe harbor, where they can do anything with their security that they want and be utterly immune from liability.Read more...

The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailers were given perfect encryption? Answering his own question (because I certainly wasn't able to do it), he painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential. Read more...

The retail move to embrace 2-D barcodes that began with a Sears trial in December and strong interest from BestBuy, the Gap and Target is inching forward, with a 500-store trial starting Thursday in San Francisco.

The trial, involving CitySearch, Antenna Audio and Scanbuy, is a fairly basic mobile integration effort. “More than 500 restaurants, shops and businesses reviewed by Citysearch are placing printed bar codes in their windows, and people who have Scanbuy software loaded on their phones can simply take a picture of the code and their phone’s Internet browser will immediately take them to the restaurant’s corresponding Citysearch page,” said a statement from the group.…

The primary benefits of virtualization are flexibility and scalability. It allows a company to "pool" computer hardware and create new applications, new servers, new networks, new data storage at the touch of a button and, in the process, reduce costs and administrative overhead.Read more...

On its own, Russian POS shipments increased about 12 percent last year and they should see similar growth or higher in 2008, the report said. Read more...

Social networking giant Facebook suffered a major privacy glitch this week, where strangers were able to download members’ supposedly private restricted photos.
The Associated Press broke the story this week. “The Associated Press verified the loophole Monday after receiving a tip from a Byron Ng, a Vancouver, Canada computer technician. Ng began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles,” the story reported. “But the added protections weren’t enough to prevent Ng from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few.”…

Saks is seeing how far it can take Web multimedia, by trying to morph its online catalogue with live video and creating a live model runway show.

The test focuses on Saks’ three best-selling departments: Contemporary ready-to-wear, handbags, and shoes, according to this MediaPost story. “Since Saks knows that about 99 percent of its shoppers have broadband access, ‘it’s been great for us,'” said Denise Incandela, president of Saks Direct. “You can have movement, voice-over, music and information, with narrators talking about what’s important in each look.”…

The change to the Starbucks Card Rewards program shows not just an understanding of customer service, but a realization that the best way to make a CRM program successful is to focus on benefits—true benefits—for both the customer and the retailer. Instead of merely tracking purchases and offering small discounts (adjusting the price of a cup of flavored coffee down from ludicrously overpriced to merely absurdly overpriced. Buy one more croissant and tomorrow you can enjoy a cup of Joe that is only insultingly overpriced), Starbucks is getting creative about rewards. Read more...

The bill had been pushed by Assemblyman Jeff Morris. The final version of the bill—which Morris said he expects Washington Governor Chris Gregoire to sign into law on Tuesday—makes anyone guilty of a Class C felony if they "intentionally scan another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft or for any other illegal purpose." Read more...

In a delicious game of “Now You See It. Now You Don’t,” a security vendor called Rapid7 had proudly told the world that Hannaford was a key customer. But when Hannaford’s breach was announced this week, all references to Hannaford quickly disappeared. And then reappeared. Company officials then stumbled over each other, offering contradictory explanations for it all.

The changing official explanations was deliciously chronicled by NetworkWorld. But the gold medal award for illustrating the actual disappearing acts with wonderfully annotated screen captures goes to the Attrition.org site. If you want ideas on how to not handle a perception crisis, you’ve got to read them both.…