Gartner ITL Systems Security and Risk team research director, Rob McMillan
Protecting a well-established brand in the face of compromised systems is something Brad Clarence, the systems and support administrator at iconic fashion retailer, Jeanswest, knows a fair bit about. Despite his somewhat misleading title, Clarence is responsible for Jeanswest’s entire network and systems infrastructure in Australia and New Zealand.
This includes every switch and router, all EFTPOS and point of sale systems, as well as the rest of the technology that supports Jeanswest’s 2500 employees, who are spread across the company’s 240 stores, four distribution centres and five state offices in the region.
Read about Security breach.
In January of 2010 Jeanswest was in the middle of an infrastructure refresh — and moving from an old security provider to a new enterprise-wide system supplied by Sophos — when Clarence noticed strange things happening on the company’s network.
“We started to see odd fluctuations in bandwidth usage, local network congestion and a few users reported abnormal behaviour on their machines,” Clarence says.
It turns out a worm had invaded Jeanwest’s network. Before the problem had even been properly identified, the company’s e-mail addresses started appearing on DNS blacklists.
“The existing security provider hadn’t been accurately picking up what was going on, so we couldn’t tell what the problem was at first,” Clarence says.
“Before we knew it, we were blacklisted. For a company like Jeanswest to be identified as a spammer was an absolute nightmare for us.”
Clarence stresses that at no point were the details of Jeanswest’s customers put in jeopardy, but the event did cripple the company’s backend infrastructure for three days.
Jeanswest deals with a vast network of suppliers and manufacturers, and its marketing department also works closely with several advertising agencies, so the problems caused by the worm simultaneously inconvenienced many areas of the business. All Jeanswest’s business partners and other clients had to be informed about the issues the company was facing — no small task when you can’t send nor receive e-mails.
Nevertheless, Clarence and other key staff at Jeanswest were committed to ensuring partners were made aware of what was happening — and why — which greatly reduced the negative impact of the ‘blacklisted’ notifications clients were receiving.
“There were a lot of phone calls made over those few days,” Clarence says.
“Staff had to get inventive — our fax machine got its biggest workout in years.”
Instead of a slow, gradual implementation of the new security system, Clarence was forced to compress the planned rollout from two weeks to three days.
With the Sophos system in place the worm was rolled back quickly, much to everybody’s relief, but Clarence maintains it was also the company’s commitment to keeping business partners informed that kept the damage from spiralling out of control.
“The attack affected productivity and made everyone’s days a lot longer, but even though the back-of-house systems were affected seriously, from a customer perspective everything remained business as usual,” he says.
Planning for breach
According to Rob McMillan, research director in Gartner’s ITL Systems Security and Risk team, the most important thing a CIO can do to mitigate the impact of a data breach is to have a plan in place to deal with the event before it happens.
“The very first step is to acknowledge that you may well have a breach someday,” says McMillan, who was co-founder and general manager of AusCERT and also served as executive manager in charge of security at the Commonwealth Bank before joining Gartner.
This might seem obvious, but McMillan cites figures from Gartner’s 2011 Global Privacy Survey (which includes responses from Australian organisations) which show many companies have not even considered the issue.
“In our survey, only 12 per cent of organisations said they feel their security is ‘bullet-proof’,” McMillan says, “which means 88 per cent of organisations know that a breach is possible.”
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.