solution

SMART is an on-line company that sells cosmetic products. Customers of SMART is required to create an account with their name, address and credit card details. The customers are also required to create a password that they must use when they want to change details or place an order.

The system allows for a very simplified process where registered customers log in and place their orders because all their delivery and payment details are already on the file. Customers appreciate this easy system and is considered to be one of factors making SMART so successful.

Through the software SMART is also able to track each customer’s purchases and uses that information to email beauty tips and introduce new products to customer’s based on past orders. Many customers place additional orders based on the beauty tips.

Unfortunately SMART recently suffered a security breach involving 80% of its highest spending customers. The breach occurred as a result of one of the analysts of SMART being required to prepare a report on customer’s buying habits. He was unable to finish the report at work, and copied the customer files onto a memory stick and took it home for the week-end to finish his report. He lost the memory stick on the train journey into work.

Luckily, a copy of the final report he completed over the week-end was on his home computer and his flat mate emailed him a copy of the report, so he was able to submit it on the Monday morning. He did not report the loss of the memory stick because he did not want to get into trouble for losing the data.

Over the next two weeks SMART started to receive complaints from customers that orders were being placed without the account holders’ permission. Volume of complaints continue to increase and the analysts was asked to investigate and determine if there was a security problem. The analysts quickly realised most complaints were from the customers whose files were on his memory stick that got lost. He then reported the lost memory stick and was suspended.

To rectify the situation SMART’s customer services department wrote to all the customers whose accounts have been compromised and offered to cancel any disputed charges on their accounts. The customers were also advised to contact their credit card providers and to study their card statements carefully in case of fraud. Several of the customers complained to a national newspaper and SMART received many further complaints about disputed charges mainly from customers whose details were not copied by the analyst.