When it comes to competing against Amazon, eBay or even Japan's Rakuten, one of the more challenging aspects is their third-party marketplaces, which give each a seemingly endless inventory at minimal risk. But the odds may be getting more even, as shoppers are starting to notice that some manufacturers are strictly enforcing their authorized reseller rules.
The immediate impact on shoppers is they may find that the expensive flat-screen TV, surround-sound speakers or refrigerator that looked like such a bargain on Amazon voids the warranty. The arguably-unrealistic expectation from consumer goods manufacturers—which sharply strengthens the hands of traditional e-tailers trying to fight against these third-party marketplaces—is that shoppers would not only notice the actual name of the merchant shipping the item, but would take the time to run that name on the manufacturer's site to see if they are truly an authorized reseller. Or they could just make the purchase from Target.com or Bestbuy.com and know for certain.
Has Amazon decided what it wants to be when it grows up? More to the point, are there indications that it has now decided that one thing it does not want to be is yet another thin-margined retailer?
One tech blogger is arguing that Amazon wants to get as far away from retailing as possible by examining its hiring choices surrounding Kindle and Amazon’s Web Services. Interesting reading.…
Mike Osier, head of IT Operations at Netflix, wrote in a blog posting on Aug. 22 that it was "a key faulty hardware component" that caused the hiccup. "On Monday, 8/11, our monitors flagged a database corruption event in our shipping system," Osier said. But why does the site hide its blog? Read more...
TrustCo, which operates more than 100 banks nationwide, filed the lawsuit in the New York Supreme Court against TJX in July, saying that it had never been invited to participate in the initial group of banks suing TJX. This bank's accusations mirror the other banks' charges, namely that TJX "breached its duties" by allowing the intrusion. TJX replied that it was the bank's own fault.Read more...
With four months still remaining until the end of the year, the 449 breaches reported in the Identity Theft Resource Center's list for 2008 exceeds 2007's total of 446. The Macy's incident was sparked by "a massive security breach at a Visa processing center in England," said the Identity Theft Resource Center report.Read more...
Like any list, it's hard to be precise about what the content means. Are these truly the best paid CIOs in the country or just the best paid of those working at publicly held retailers? And even some publicly held chains aren't required to report their CIO's compensation, making the analysis even more inconclusive. For the full list of the top-paid retail CIOs, Read more...
With the frequent product changes executed by any large e-tailer’s site, the tech hurdles of launching a mirror site in another language can be daunting. But this challenge has created a small industry of companies that are trying to facilitate rapid globalization for e-tailers.
One such company is an 8-year-old outfit called MotionPoint, which has an interesting method for mirroring retail sites, described in this Wednesday (Sept. 2) story in The Financial Times of London: “When a customer wants to access a foreign language version of a particular site, page or item, a MotionPoint server passes on the request to the original site. The response, in English, prompts MotionPoint to retrieve a previously translated version of the page or item held in its own stored data and send it on to the customer. The foreign language versions of each page or product are kept updated by human translators, who use software that ensures the translation fits the space available on the page. They are also automatically alerted to changes made on the original site, enabling material to be updated within a few hours rather than the days required by a traditional operation with translators not working directly on a Web-based system.”…
JCPenney is testing the Australian waters a bit with an online push. The retailers has a local URL and an Australian company handling all operations, but it’s still shipping merchandise from the States and asking Australian shoppers to wait “12 to 14 working days. This “request” prompted one Australian publication to ask “whether Australians would be prepared to wait two weeks to receive something purchased online, especially when goods shipped from Amazon in the U.S. generally arrive within a week if in stock.”
But any online attention is a good thing, that story said, given “the ambivalence shown to online shopping by Myer, Target (Australia) and David Jones.” Sharon Hooker, operations manager of JCPIC Australia, said global currency fluctuations may prove helpful: “All prices on the JCPenney Australia site are shown in Australian dollars. With many items priced comparatively lower in the United States, buyers are in for some very pleasant surprises.”…
In an overall down market where the 150-store Nordstrom chain is seeing a 4.3 percent sales drop, online operations are jumping 15 percent–accounting for almost 8 percent of all sales. Company execs now project online to soon top 10 percent. Even more intriguing: Nordstrom is reporting a sharp increase in the number of multi-channel shoppers, who now represent almost a third of all sales.
But Nordstrom is doing online differently, according to this wonderful profile in The Puget Sound Business Journal (Seattle). First, Nordstrom is delivering the identical merchandise online and offline, a tactic quite different than many other cross-channel retailers. Secondly, its call center staffing has not been outsourced, a move that the customer service-intensive chain said gives it a competitive advantage.…
But the changes confirmed by the PCI Security Standards Council this week—which have been circulated among members for the last few weeks—provide few other substantive changes, delivering the mild tweaks and updates the council has publicly promised.
The document lists some 30 changes to the current PCI Version 1.1 and PCI officials promise that the official and final version—now slated for release on Oct. 1, a few weeks earlier than originally expected—will include yet more changes.
Still, the document provides a fairly detailed peek into the council's thinking. The most significant change is language that addresses the much-maligned WEP and tried to balance conflicting member interests, from those who argued that such a weak security approach should be banned as soon as possible and their opposite numbers, who spoke to the cost and effort that retailers would need to deploy to make the change.Read more...
When the PCI Security Council this week detailed a bunch of changes it will include in PCI 1.2, what might be more worthy of note is what they didn’t address.
There were technical issues—such as segmentation and tokenization—that didn’t get referenced, but also policy issues. Why isn’t there a more clear-cut appeal process, for retailers who believe their assessor is improperly interpreting the rules? Today, the council will try and address technical questions, but that rarely involves overruling an assessor. Visa has been known to get involved with a retailer who has an assessor complaint, but that’s a very rare occurrence. Read more.…
PCI DSS 1.2 CHANGES SUMMARY
FINAL
INTRODUCTION AND PURPOSE
The PCI Security Standards Council has announced that version 1.2 of the PCI Data Security Standards will be available for general use October 1, 2008. The purpose of this document is to provide high level guidance on the changes to be brought about with this key milestone standard revision. Version 1.2 is an update to the current version 1.1 and follows the established approved lifecycle process, which provides for revisions or new versions on a 24 month cycle. While version 1.2 will not introduce any major new requirements, it will include clarifying items designed to fulfill the following goals inherent to the PCI Data
Security Standard:
SUMMARY OF CHANGES
As noted above, the revisions to version 1.2 do not incorporate any new major requirements. Therefore the changes summarized below reflect the same six guiding principles and 12 requirements currently in force under version 1.1. Note that this summary of changes does not include all changes made in version 1.2. The PCI Security Standards Council reserves the right to make final revisions to version 1.2 prior to publication; this summary is for initial preview purposes only, and does not supersede PCI DSS v1.1. Once PCI DSS v1.2 is publicly released, PCI DSS v1.2 will be the official version and further guidance will be provided about effective and sunset dates.
Build and Maintain a Secure Network
Requirement 1: Install and maintain a firewall configuration to protect cardholder data
This concept is being trialed right now by Germany's $81 billion Metro Group, in a project with Procter & Gamble.Read more...
In various discussion groups, sellers have criticized eBay, saying its new fee policy liberally uses what some sellers not-so-fondly dub "eBay math."Read more...
Here's the IHL theory: Not all IT spending is created equal, and some retail segments spend a heck of a lot more on IT than others.Read more...
"Numerous apparel companies have reported increased sales of as much as 20 percent using RFID to monitor shelf stock levels," the report said. "In 2008, IDTechEx research finds that 38 percent of the money spent on RFID in retail is specifically for apparel tagging." Read more...
In North America, "the mean estimate for share of IT budget devoted to innovation in 2007 was 35 percent," the Forrester report said. "But a lower median at 30 percent and mode at 20 percent suggest that a few retailers planned heavy funding of innovation, while most planned much less investment." Read more...
"The criminals have been going into shops claiming to be engineers working on the terminals," said Una Dillon, head of card services at the Irish Payment Services Organization Staff. "Staff are used to their bank officials coming to update terminals so unfortunately they have been able to do that." Read more...
These days, when U.S. government officials want to ask questions about privacy and data security, it’s never clear if they want to protect consumers’ privacy or learn the best way to violate it themselves. But retail execs who want hints can drop by a Sept. 22 hearing at the U.S. Federal Trade Commission’s Washington, D.C., headquarters. Those who can’t personally attend can do so virtually.
“Workshop participants will discuss the increasing prevalence of contactless payment devices in everyday consumer transactions, including credit card purchases and public transit, as well as the growing use of item-level tagging in the retail sector,” said an FTC statement. “The workshop will examine consumer awareness and education initiatives regarding these developments; security and privacy threats and proposed solutions; and emerging technologies and practices that may shape the marketplace in the coming years.” True enough, but there’s a reason these D.C. sessions are called “hearings” and not “listenings.” …
Retailers who are worried about RFID security problems will have more details available to them now that a federal judge has killed a gag order on MIT students who had identified flaws in Boston’s contactless RFID subway cards.
Ten days ago, a judge ordered three MIT students to not discuss research they had done about RFID security problems with the Boston subway system. On Tuesday (Aug. 19), U.S. District Judge George O’Toole Jr. killed that order, ruling that discussing the papers would not violate computer fraud laws. “The MBTA ultimately is trying to silence some uncomfortable truths that these students uncovered,” Cindy Cohn–one of the attorneys for the students–told The Boston Herald. “They brought an action against three college kids rather than address the problems in their own house.” Countered an attorney for the Boston subway: His organization merely ” wanted the students to refrain from revealing details about the security problems publicly until the MBTA has time to correct the flaws.” How long did he think that would take? Five months.…
A lot of retailers have been tinkering with the idea of using virtual online worlds as a marketing tool, but there haven’t been many major retailers committing to the strategy, with the possible exception of Circuit City. As major chains are doubling up their focus on computer-savvy young consumers, though, other major chains are finding their aversion to avatars giving in to their adoration of avarice.
Sears, Kohl’s and J.C. Penny are the latest chains to try selling clothes in popular teen virtual worlds, allowing users to purchase apparel for online avatars. The retailers are teaming up with avatar sites and animating actual apparel lines that teens and tweens can place on their avatar characters, according to this Wall Street Journal piece. …
GuestView Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.
Based on the PCI Standards Committee’s official "hint" about what will be in the 1.2 release, it appears that clarifying when and how virtualized servers can be PCI compliant didn’t make the cut. But before the server and security geeks start lighting their torches and getting all "vigilante" on the card brands, let me tell you why I don’t think this will matter.
Virtualization saves money. As a technology, virtualization—particularly server virtualization—is saving retailers money on hardware and IT management. In a down economy, cost reduction trumps compliance. Where virtualized servers and PCI compliance come to blows is PCI DSS 2.2.1, which says only one primary function per server. Because some merchants, assessors and acquirers think "physical server" when they read this standard, some merchants have limited the deployment of server virtualization to the dev/test environment.
Other merchants are making sure not to deploy server virtualization in the cardholder environment. Still others are deploying virtualized servers for applications with credit card, SSN and other confidential data, but they are careful not to put applications with different "trust levels" for different levels of access controls on the same physical server. The point is that if you want to use virtualization to reduce your IT costs, you just need to be careful about what applications you put on what types of servers.
Proof that virtualization is secure. We recently did a Webinar on the topic of how to prove that virtualized servers are secure enough to pass PCI assessments. Based on interviews with more than a dozen PCI assessors for the PCI Knowledge Base, it’s clear that in more than 75 percent of …
A “persistent and mysterious technical glitch” has severely disrupted business operations at the massive online film rental site Netflix, “potentially affecting millions of its customers,” according to this story in The San Jose Mercury News.(UPDATE: ValleyWag is reporting that the outage happened “because of massive database corruption in their Oracle cluster caused by a botched upgrade”)
The company was unable to ship any DVDs to its customers on Tuesday (Aug. 12), managed only some deliveries Wednesday and said it again was forced to halt shipments for much of the day Thursday, said Netflix spokesman Steve Swasey. A company-issued blog post warned that “the issues we’ve faced over the last several days have been significant and there’s no guarantee at this point that our shipping operations will be fully restored by tomorrow.” The story said that the note did not identify the cause of the problem and Swasey previously said Netflix executives were having trouble isolating it.…
But the $20 billion retail chain, with roots dating back to 1902, decided to use its customers' payment card numbers as customer identification numbers. To avoid PCI conflict, J.C. Penney is using a form of tokenization to convert those payment card numbers into "a different ID number," said company spokeswoman Kate Parkhouse.Read more...
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
