http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9079652 By Jaikumar Vijayan April 22, 2008 Computerworld Executives at Hannaford Bros. Co. said today that the grocer expects to spend "millions" of dollars on IT security upgrades in the wake of the recent network intrusion that resulted in the theft of up to 4.2 million credit and debit card numbers from its systems. The planned upgrades include the installation of new intrusion-prevention systems that will monitor activities on Hannaford's network and the individual systems at its stores, plus the deployment of PIN pad devices featuring Triple DES encryption support in store checkout aisles. Hannaford also has signed on IBM to do around-the-clock network monitoring under a managed security services deal, according to Ron Hodge, the grocer's president and CEO, and Bill Homa, its CIO. In addition, the Scarborough, Maine-based company had said previously that it had replaced all of the servers in its stores as part of an effort to rid its network of malware that was placed on them during the intrusion. Hodge said during a press conference this morning that Hannaford is working with IBM, General Dynamics Corp., Cisco Systems Inc. and Microsoft Corp. on the upgrade program, which is aimed at putting "military- and industrial-strength" security controls in place. The total price tag for the security upgrades will be "a big number," he added, although the exact cost has yet to be determined. "It's going to be millions, but not tens of millions," Hodge said. The only specific cost that he broke out was about $5,000 per store for the host-based intrusion-prevention tools that will be installed on local systems. Hannaford said previously that the data breach involved payment card transactions processed at nearly 300 stores . all of its 165 supermarkets in New England and New York, plus 106 stores operated under the Sweetbay name in Florida and 23 independently owned markets that sell Hannaford products. If the intrusion-prevention technology is deployed at each of those locations, the tab for that part of the upgrade program alone would amount to $1.5 million. Hannaford disclosed on March 17 that unknown intruders had broken into its computer network and stolen the credit and debit card numbers as well as their expiration dates. In a letter sent to Massachusetts officials eight days later, the company said that the perpetrators had planted malware on the servers at each of the 294 affected stores. The malware intercepted the card data as it was being transmitted from point-of-sale systems to authorize transactions, then forwarded the information in batches to a server located overseas, according to Hannaford. The incident at the grocery chain and a similar one reported two weeks later by the Okemo Mountain Resort ski area in Vermont indicate that cybercrooks are now targeting data that's in transit between systems, when it may not be encrypted or as well protected as stored data is. During this morning's teleconference, which Hannaford held to provide an update on the measures it has been taking since the breach was discovered, Homa said that the security upgrades are focused on improving the company's "deterrence, prevention and detection" capabilities. Over the next 18 months or so, Hannaford plans to bring its security management processes into compliance with the ISO 27001 security standard, he added. The managed security service being provided by IBM will deliver real-time intrusion alerts to Hannaford and help the company identify threats and direct resources to counter them more quickly than it could before, Homa said. He noted that the new PIN pad devices with Triple DES support will be installed at all stores over the next few months, as part of a plan to ensure that cardholder data is encrypted within Hannaford's internal network. Hodge described the network intrusion as one of the biggest challenges that Hannaford has faced in its 100-plus-year history, and "the biggest challenge in my tenure as CEO." He acknowledged that the breach may have caused concerns among Hannaford customers about the possibility of fraud and identity theft, and said that the company's goal is to assure shoppers of its commitment to securing their data going forward. However, Hodge didn't release any new information about the breach itself or how it might have happened, citing an ongoing investigation of the incident. Hannaford's efforts to shore up data security in the aftermath of the breach may help it prevent similar intrusions in future, but the company still may find itself having to explain why it hadn't implemented such measures in the first place. At least two class-action lawsuits have been filed against Hannaford, charging it with negligence and breach of promise for allowing the intrusions to happen. If the fallout from the massive data compromise disclosed early last year by The TJX Companies Inc. is any indication, Hannaford could find itself facing claims similar to those filed against TJX by banks and credit unions seeking reimbursement for the cost of issuing new payment cards to their customers. Altogether, TJX has spent or set aside about $250 million thus far to cover costs related to its breach. Hannaford has said that it was compliant with the Payment Card Industry Data Security Standard, or PCI, when the network intrusion took place between Dec. 7 of last year and March 10. The PCI standard is mandated by the major credit card companies to try to protect card data while it's on the systems of retailers and other merchants. But it remains to seen whether the compliance certification issued to Hannaford by an outside assessor will help the company defend itself against the class-action lawsuits and the reimbursement claims. _______________________________________________ Subscribe to the InfoSec News RSS Feed http://www.infosecnews.org/isn.rss
This archive was generated by hypermail 2.1.3 : Tue Apr 22 2008 - 22:16:39 PDT