Jeanswest: Protecting the brand

Smart CIOs are making plans today to protect their customers, and their brands, from long-term damage tomorrow

Gartner ITL Systems Security and Risk team research director, Rob McMillan

Gartner ITL Systems Security and Risk team research director, Rob McMillan

Protecting a well-established brand in the face of compromised systems is something Brad Clarence, the systems and support administrator at iconic fashion retailer, Jeanswest, knows a fair bit about. Despite his somewhat misleading title, Clarence is responsible for Jeanswest’s entire network and systems infrastructure in Australia and New Zealand.

This includes every switch and router, all EFTPOS and point of sale systems, as well as the rest of the technology that supports Jeanswest’s 2500 employees, who are spread across the company’s 240 stores, four distribution centres and five state offices in the region.

Read about Security breach.

In January of 2010 Jeanswest was in the middle of an infrastructure refresh — and moving from an old security provider to a new enterprise-wide system supplied by Sophos — when Clarence noticed strange things happening on the company’s network.

“We started to see odd fluctuations in bandwidth usage, local network congestion and a few users reported abnormal behaviour on their machines,” Clarence says.

It turns out a worm had invaded Jeanwest’s network. Before the problem had even been properly identified, the company’s e-mail addresses started appearing on DNS blacklists.

“The existing security provider hadn’t been accurately picking up what was going on, so we couldn’t tell what the problem was at first,” Clarence says.

“Before we knew it, we were blacklisted. For a company like Jeanswest to be identified as a spammer was an absolute nightmare for us.”

Clarence stresses that at no point were the details of Jeanswest’s customers put in jeopardy, but the event did cripple the company’s backend infrastructure for three days.

Jeanswest deals with a vast network of suppliers and manufacturers, and its marketing department also works closely with several advertising agencies, so the problems caused by the worm simultaneously inconvenienced many areas of the business. All Jeanswest’s business partners and other clients had to be informed about the issues the company was facing — no small task when you can’t send nor receive e-mails.

Nevertheless, Clarence and other key staff at Jeanswest were committed to ensuring partners were made aware of what was happening — and why — which greatly reduced the negative impact of the ‘blacklisted’ notifications clients were receiving.

“There were a lot of phone calls made over those few days,” Clarence says.

“Staff had to get inventive — our fax machine got its biggest workout in years.”

Instead of a slow, gradual implementation of the new security system, Clarence was forced to compress the planned rollout from two weeks to three days.

With the Sophos system in place the worm was rolled back quickly, much to everybody’s relief, but Clarence maintains it was also the company’s commitment to keeping business partners informed that kept the damage from spiralling out of control.

“The attack affected productivity and made everyone’s days a lot longer, but even though the back-of-house systems were affected seriously, from a customer perspective everything remained business as usual,” he says.

Planning for breach

According to Rob McMillan, research director in Gartner’s ITL Systems Security and Risk team, the most important thing a CIO can do to mitigate the impact of a data breach is to have a plan in place to deal with the event before it happens.

“The very first step is to acknowledge that you may well have a breach someday,” says McMillan, who was co-founder and general manager of AusCERT and also served as executive manager in charge of security at the Commonwealth Bank before joining Gartner.

This might seem obvious, but McMillan cites figures from Gartner’s 2011 Global Privacy Survey (which includes responses from Australian organisations) which show many companies have not even considered the issue.

“In our survey, only 12 per cent of organisations said they feel their security is ‘bullet-proof’,” McMillan says, “which means 88 per cent of organisations know that a breach is possible.”

Join the CSO newsletter!

Error: Please check your email address.

Tags Jeanswestsecuritydata breachsecurity breachBrad Clarence

More about CERT AustraliaCommonwealth Bank of AustraliaetworkGartnerSmartSonySophosUNSW

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Matt Rodgers

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts