TJX may be catalyst for WPA conversion

The system security breach suffered by retailer TJX Companies Inc. is a wake up call for many organizations to bolster their security infrastructure, but Canadian businesses are slower on the uptake than their American counterparts, said one expert.

Although data protection is on the radar, Canada typically has a “wait and see attitude” around adopting new technologies, said Fiaaz Walji, Canadian country director with San Diego-based Web filtering software vendor Websense Inc. Organizations generally don’t tend to budget for things outside the basic IT infrastructure costs, like hardware and software.

TJX, the U.S. parent company of Canadian retailers Winners and HomeSense, earlier this year reported a system breach that exposed customer financial and personal data from at least 45.7 million credit and debit cards.

A report issued by the Office of the Privacy Commissioner of Canada in September highlighted the fact that TJX did not employ adequate security in its use of the Wired Equivalent Privacy (WEP) encryption protocol, and despite a conversion to the more robust Wi-Fi Protected Access (WPA), the switch was already too late.

Customer information relating to store transactions was likely accessed from the Retail Transaction Switch (RTS) servers protected by a WEP system that, according to the report, is easily bypassed by hackers and therefore unreliable. As far back as 2003, the Institute of Electrical and Electronic Engineers (IEEE), the developers of the WEP encryption protocol, recommended the standard be switched to WPA.

TJX, however, did not begin its conversion to WPA until October 2005, some months after the first breach occurred.

The TJX incident demonstrated the vulnerability of WEP and what happens to companies that aren’t fast enough in deploying the more robust WPA, said Amit Kaminer, a Toronto-based analyst with research firm Seaboard Group. Despite the benefits of wireless to an organization, the technology presents a slew of novel challenges to network security, especially when adding new applications, he said.

If an enterprise network is not properly protected, it isn’t difficult for hackers to penetrate security, said Kaminer. WEP, said Kaminer, is breakable in under one minute, and unless the company is monitoring for network vulnerabilities, the presence of a hacker may not be evident.

“If you’re not yet using WPA, and you’re not taking other security precautions, you are not being prudent,” Kaminer said. Kaminer said the WEP system is enhanced when deployed in tandem with other technologies, like VPN, SSL and data segmentation. But even then, the performance is still only “okay” but not as effective as WPA. WPA, however, is “hardly breakable; even if someone got in, the key is changing. Once you have the key, it’s not very useful because it’s a dynamic feature,” he said.

Although WEP to WPA conversion costs are not massive, the damage a business could suffer is quite significant, said Kaminer. In fact, the TJX incident is acting as a catalyst for businesses to get proactive around enterprise security, as evidenced by a trend whereby companies are making the migration.

So far, a third of North American retailers have deployed WPA. The remainder, however, “have a long way to go”, said Avivah Litan, lead analyst with Stamford, Conn.-based research firm Gartner Inc.

She said retailers don’t perceive security spending as high priority, preferring to invest more on revenue-generating activities. Besides, she added, retail payment systems are often outmoded with modern components simply patched on top.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now