Slashdot Mirror
TJX Fires Employee For Disclosing Vulnerability
I Don't Believe in Imaginary Property writes "A TJX employee was fired for an online post mentioning that TJX hasn't beefed up security after the recent, massive data breach that saw 94 million credit card numbers copied by criminals and money from their accounts stolen. The employee mentioned that, at first, their usernames were the same as their passwords. After they required stronger passwords, some managers complained, so they 'compromised' by allowing blank passwords. The whistleblower said he discussed his concerns with management, but that it was like talking to a brick wall. In spite of the weak internal security, TJX now has a firm that scours the internet to find bad things posted about them, which is how they found the message and fired him for it. Too bad they don't appear to have hired anyone to beef up operational security or to convince people to use strong passwords."
Sounds like they were a shitty company anyways. I'm sure he'll be better off w/another company.
This guy should be promoted to CIO for the company and given carte blanc to clean house on the asshole who did not deal with the original issue. Until I hear that this guy is justly treated, we will not ever spend another penny in TJX stores. Enough of us and the CEO will be looking for a new job.
If the cost of implementing security is greater than the estimated cost of lawsuits due to bad security, a company will not spend the money for better security. This is the same logic the blood banks used for AIDS testing of their blood (until the rhs eventually was greater than the lhs) and this is the same logic that automakers use for defects.
Hey, yeah, what was this guy thinking, doing the right thing in spite of the risks? He deserved to get screwed over, right? Everyone just play along, don't rock the boat, do what you're told, and shut the hell up. Thanks so much for sharing your sage wisdom and mature outlook.
Maybe he expected exactly what happened and blew the whistle anyway. So, wise elder, what would you have done?
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
However they found out who he was it can't have been legal.
He should fixate on this and sue them.
Since when is "allowing blank passwords" a compromise, and not stupid?
Web 2.0 == Giant Blogspam Circle Jerk
..given past record "further" is exactly NOT where they ought to be heading :-).
Insert
Are there any blanket consumer protection laws with regards to what information a provider can release to a third party? I always thought that it was completely at the discretion of the provider as to what information they can disclose, and for what reason. I hope I'm wrong.
Very expensive? Compared to what? Going out of business?
What if your bank decided that those pesky safe deposit boxes would be a whole lot cheaper if only they could use unlocked filing cabinets instead. Would you still want to do business with them?
The sad state of affairs here is that the problem doesn't become apparent until someone gets hacked.
I think a firm that has a security breech ought to be forced to make restitution to the customers. Managers may not understand security, but they will understand lawsuits and damages.
Only once you've rubbed a manager's nose in the problem can you expect a solution. We don't HAVE to address everything, but managers should at least be aware of the risks they're taking.
It's a telling point that they've chosen to persecute instead of promote the person who exposed the flaws. These idiots would rather hide in the corner than address the risks up front.
Nearly fifty percent of all graduates come from the bottom half of the class!
Yes, but IF I remember correctly the original breach occurred because of both physical and logical security control deficiencies at individual stores. This directly lead to the compromise of systems at the headquarters, and, ultimately, customer information.
As a full-time security professional and penetration tester that deals with companies in this situation everyday I can almost guarantee you that given their history and apparent mind-set towards security, almost anyone at a "script kiddie" level would be able to get to systems at the headquarters (depending on network architecture).
Now the question is, knowing all this, what is your comfort level around TJX's ability to secure servers at their primary facility... mine is zero.
Seriously, what did he expect, that a lazy corporation was going to reform its security policies because a 23-year-old hourly employee complained anonymously on a blog?
...At their own foot.
If they had any integrity - Yes, that sounds like the best possible outcome of this.
Think about it - The CIO didn't say "okay, after a major data breach, go ahead and keep using pathetic passwords". The order came down from On High to use secure passwords. This proved inconvenient to hundreds of piddling middle-managers, who ordered "their" IT guys to find a way around all that nasty security. The local IT guys complied, by allowing blank passwords (Corporate probably never expected anything that stupid, and so didn't have a policy stating otherwise).
So, sometime later, Corporate discovers what has happened, and it enrages them. They meet, discuss, take aim, and fire...
And what did he think they were going to do when they caught him, give him a raise and a promise to change their cheap lazy ways?
They could have addressed the problem and rewarded the child who dared to laugh at the naked emperor. By chosing not to, they have very effectively told me they care more about appearances than the security of my credit card data. As a result, I will no longer shop there.
P.S. I am not an attorney. Do not take this as valid legal advice.
That is all.
Anyone remember Nixon...
How can we forget? We're still living under his legacy.
What this guy should have done was to mail a letter to wikileaks. The post office still has some very strong privacy protections built in. Certainly better than any of your ISPs.
What?
I concede that IANAL, so of course, I could be wrong, however the courts have already ruled that blogs and other web based news sites qualify under protections provided to the media.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
This is the typical corporate bull, I remember when I worked for Safeway and they first installed self checkouts and every night you had to print credit card signatures which included every single person's full credit card number along with their signature. Even worse is managers would set the things to print and just walk off. These were not printed in a back room but on the actual check stands making it possible for anybody to just walk up and grab a set pile of peoples credit card information. Luckily Safeway fixed this problem but it took them a good 6 months to get around to it.
TJX just doesn't get it. They hired a team to look for insider negative postings, and considered that an increase in security. They consider the negative poster a rouge insider... but they can't seem to track down who was at fault for the massive breach that they suffered from. That's the person we really want fired.
What we, the people who used to shop at TJ Maxx, Marshalls, AJ Wright, HomeGoods, and Bob's Stores, are looking to see is that they can finally claim that they increased their security (using the same standards we expect on the web) so that nobody can intercept what we show the cashier, our credit card stripe data and signature, on its way to the credit card processing company they're using. Good encryption is freely available, great would be hearing that they hired a company that cares about it.
They're thinking about what directly impacts the bottom line (profits) while forgetting that what upsets the customers will directly impact the top line (sales) that will impact that bottom line too.
TJX is a range of store brands listed here.
>>And what did he think they were going to do when they caught him, give him a raise and a promise to change their cheap lazy ways?
>They could have addressed the problem and rewarded the child who dared to laugh at the naked emperor.
Punishing employees who let you know about problems is like disconnecting your smoke detector. Some of the big security policy frameworks call for a policy statement that *requires* reporting of security problems. If TJX had been my client, they would have been advised to go one step beyond that to encourage bug reports.
http://www.tjx.com/employment/life_brands.html I don't know who paid for it but I have had new credit cards issued not because I asked for them...kinda messed up my cookies for on line purchases. These guys suck.
SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
Forexample:
BIG_b00bs_a how hard is that to remember?
another
P4ssw0rd5_suck_m3_0ff
Another:
ROY_G_B1V_aa
Jeez, there really isn't any excuse. I think they called this PAL in the Military.
How about the first few letters from the first words in a song or poem?
from Mary had a little lamb:
Mhallwfwwas&wmw12
or another
IXdKKaspdd_10
This can't remember password BS really annoys me.
Add to the fact that any computer system to day should lock down the computer after3 attempts..ah hell lets make it 5 attempts should prevent a brute force or dictionary attack from happens so changing your password isn't really that necessary any more, it's a hold out from 25 years ago when you could only have 8 characters, and there wasn't any lockout.
Since most people who implement security do not understand security and could do risk analysis if their life depended on it, I'm not surprised at the state of affairs in computer security.
And before someone who thinks they know what they are doing corrects me, yes, I do know there are some systems that need tighter security, like missile Codes. Having handled them I know a thing or 4 about them. I am talking about security for 99.99% of everyone else.
The Kruger Dunning explains most post on
true, but when you show up to court, there going to be looked at real carefully.
Has anyone else been 3 minutes late and not fired? what does your policy say?
The courts are suspicious of those kind of amazing coincidence.
Even if you are 'perfect' they can find one, no doubt. That doesn't mean you don't have recourse.
The Kruger Dunning explains most post on
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"