Do We Have To Sneak Audit Site Hosts Now?

Written by Frank Hayes
August 5th, 2010

For retail IT directors, the end of American Eagle Outfitters’ 8-day E-Commerce collapse just marks the start of a new fear: that they’ll have to begin dispatching staffers to do sneak inspections of outsourcers. Will they need to burn precious staff time in unannounced audits, looking over the shoulders of service providers to make sure those techs are doing their jobs?

Will they eventually have to turn to a whole new class of outsourcers who do nothing but check up on the big outsourced teams? And who will watch those watchers?

Or is this an overreaction to a disastrous but highly unusual event? A wholesale failure like the American Eagle debacle is big news because it’s so rare. Datacenter disasters happen. There’s no way to bring the risk to zero. And beyond making sure good practices are being followed, returns diminish quickly–you can suddenly find you’re spending a lot of money to prevent something that almost never happens.

Or will the American Eagle fiasco wake up vendors to make retail IT directors’ worries unnecessary? OK, that one we can answer: No. Like most IT disasters, this event is not so much an alarm for the industry. It’s more like a snooze alarm: a little noise, then back to sleep.

But as readers commented on Friday’s story about Oracle’s and IBM’s role in the blowup, something radical has to at least be considered. It has to happen for no other reason than to be able to say alternatives were debated, when the COO asks how the company can be guaranteed it won’t go dark for eight days.

(Our PCI Columnist, Walt Conway, penned a related column about the PCI implications of data backups.)

One executive with a vendor in the backup space agreed that something like unannounced on-site inspections need to happen. But that exec, who quickly decided to seek anonymity, stepped back from his suggestion when asked how his company would logistically handle such unannounced sneak inspections.

It’s an attractive idea—almost as attractive as outsourcing is.

The problem, of course, is a very practical one: You outsource to save time and money. You want to offload work that someone else can do with more expertise or less expense. And you’d really like not to have to worry about that work getting done–and done correctly. In the best of all worlds, you want to outsource it and forget it.

But that’s not possible. That’s a little too much trust to place in someone who doesn’t exactly have your best interests at heart. True, an outsourcer wants to keep your business. That means keeping you happy as a customer. But when you send operations outside your IT shop, they’ll be performed by employees you didn’t hire on equipment you don’t maintain, and they’ll be supervised by managers whose bonuses depend on keeping costs down.

Controlling costs is a priority for you, too. But it’s the priority for them. Their jobs don’t depend on your business’ success. Yours does.

That’s why you can’t afford to trust too much in an outsourcer’s plans and promises. You have to verify, too.


2 Comments | Read Do We Have To Sneak Audit Site Hosts Now?

  1. Fabien Tiburce, President, Compliantia Says:

    Outsourcing is a lot like franchising. You franchise your business so you can scale it. Doing so however, you end up depending on hundreds or thousands of independent franchisees to represent your brand before the public. If you don’t verify the execution at store level in a franchise business, you are walking dead. Corporate programs need to be executed consistently, health and safety standards adhered to, training taken, etc…Do retail chains solely rely on each franchisee’s goodwill and the training program? No they don’t. Good will and training are necessary but not sufficient. Large retail chains, particularly those in the food service, send district managers to their stores to do “store walks”, “store visits” or “store audits” as they are sometime called. Likewise I don’t think you can or should blindly outsource. Surprise visits? Absolutely. Furthermore, visits should be scripted and recorded digitally. Any non-compliant issues should be noted and remedied. Trust your partners yes, but verify…

  2. Gavin Chen Says:

    Monitor and response to the failure backup of logs on the disaster recovery site is easy and basic. The alarm message must be somewhere. The problem is who will response and how to upgrade if fail to response. Those questions should be answered in the SLA.

    Do we need a special audit on site? No necessary! However, we should review our SLA and make it clear on how to response and upgrade these kind of failures.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.