There are many lessons to be learned from the TJX breach but perhaps most important is that encryption is no guarantee that files are safe from hackers.
TJX, the parent company of Marshalls and T.J. Maxx, had encryption codes in place to ward off attacks on its systems but the failure has authorities looking seriously at the possibility that thieves who made off with more than 45 million credit and debit card numbers were, at the very least, aided by someone inside of TJX.
While the company has been understandably mum on the possibility that either an employee, contractor or someone in contact with such a person may have been involved in the break in, the scenario appears more likely as information emerges.
"It's hard to know from the filing if it was an external or internal weakness," Steven Sprague, chief executive of Wave Systems Corp., told The Boston Globe.
Gwenn Bezard, research director for security consulting firm Aite Group, said the ability to get past the safeguards in place "supports the involvement of an insider." According to Ms. Bezard, such scenarios become more likely as thieves find low-paid employees at companies with access to encryption codes that can be corrupted with the prospects of a big payday.
Bill Bartow, vice president of Tizor Systems Inc., said the TJX case shows, "encryption alone isn't enough to protect your data, and there's a possibility that TJX didn't do a good job of protecting its keys. If that's the case, it's that the encryption is only as good as your process for protecting the keys."
There is also a possibility, according to the Globe report, that the thieves may have pulled off the heist without the need for encryption information. The thieves, it has been suggested, may have had access to steal information during the card approval process. During this stage of the process, data is transmitted without the protection of encryption.
Discussion Questions: What security lessons should be learned from the TJX case? How likely is it that consumers will come to associate Marshalls and T.J. Maxx with the largest theft of consumer credit and debit card information in history? Considering the enormity of the crime, how do you think TJX will weather the storm?