The growing magnitude of the TJX Companies, Inc. data breach brought out a whole new wave of headlines last week. I was contacted by a number of editors for my thoughts, having spent much of my professional career aiding companies in gaining enterprise configuration visibility to ensure their IT infrastructures are secure, compliant, and effective.
On Friday, Jaikumar Vijayan included my comments in two of his articles on Computerworld.com. In one, I addressed why data breaches could occur over such a long time, as in the case of TJX. "When it comes right down to it, very few companies have put in place effective controls that enable them to monitor internal systems closely and ... follow the movement of data" on their networks. That makes it possible for such breaches to go unnoticed for a long time indeed.
"The underlying problem is that companies are treating security as a 'nice to have' as opposed to a 'must have.' TJX is just the tip of the iceberg. I think we are going to see many more. It's going to get a lot uglier before it get's any better "
Here's what I had to say in the other article on legislation introduced in Massachusetts to make retailers more accountable for breaches.
"It's impressive that Massachusetts has taken the first step forward in dealing with retail security issues. Unfortunately, in the retail community, they are all trying to keep a lid on any kind of expenditures and have paid scant attention to information security. I am very much for this legislation. I think it was inevitable."
Mark Reinertson posted comments last week that make some good points about the ignorance of some retailers to data security and what's it's costing us. Check it out. It gives good reason for why retailers need to be held more accountable.