Harry & Mae’s Case Study Discussion
Video TranscriptWelcome!
I’m Tom Pierce, the president of Harry and Mae’s Inc. Recently, my company suffered asecurity breach where hackers obtained credit card data on over 25,000 of our customers. I need yourexpertise to ensure this doesn’t happen again. Come on, let’s get started. First, I’ll give you a littlebackground about my company and then I will go into detail about the security we currently have in place.
Harry and Mae’s Inc. is a diner franchise that supports over 100 diners located in New York, New Jersey,Delaware, and Pennsylvania. Harry and Mae Pierce started the original Harry and Mae’s diner with tworailroad passenger cars back in 1954. Since then, his children and grandchildren have transformed thecompany from a single restaurant into a chain of restaurants, and, most recently, to a publicly tradedfranchise business. The franchise business provides restaurant owners with everything they need to openand run their own operation, including buildings, fixtures, restaurant products, support services, and food.As another service to franchise owners, we resell credit card payment processing services to them atcompetitive rates. Harry and Mae’s reimburses, up front, for credit card transactions that are funneledthrough their payment processing system as an incentive for franchise owners to use our services.
As for location of the corporate headquarters, Harry and Mae Inc. call Windsor, Pennsylvania home. Bothof the corporate headquarters and warehouses are located there. We built the campus from the groundup at that location because it was central to our operation and both the business climate and tax structurewere favorable. The campus currently employs slightly over 400 people that see to the day to daybusiness operations.
What about our physical security, you may be asking. Well, the campus’ physical security system wasdesigned by a retired Army general. Its main features include a perimeter fence, cameras, smart cardaccess points, alarms, and a full-time security staff.
The campus also features a three-layer wired network infrastructure. Plus, it has full wireless accessprovided by an Aruba Networks grid. Comcast Business Solutions provides Harry and Mae’s withInternet. We have a number of security appliances and devices already in place, but I’m not sure howeffective they are. As for the active directory domain, there is a single one for the entire campus. It wasconfigured using default settings, and uses the default domain group policy with oneexception. Password history and complexity requirements have been disabled to make it easier foremployees to use passwords they can remember and reuse them if they want. The rationale for makingthis change was that I had difficulty remembering my password, so I began to write it down. A member ofthe cleaning crew saw it and used my machine to view pornographic material. When I discovered thebreach, I fired the person responsible and directed the password policy change.
Our headquarters also features servers, and web hosting; however, the specifics for each are a bitdetailed. Next, let’s focus on the on and off campus workstations. The company has over 400 DellOptiplex 3020 workstations on campus. Each computer is installed with Windows 7. Plus, all computersare joined to the company’s Active Directory domain. Off campus, the default configuration for newrestaurants consists of a high speed Internet connection supplied by a local provider, a Network AddressTranslation firewall device that includes a wireless access point, an office computer, and two point-of-salecomputer systems that include credit card processing software. Even though we try to stay up-to-datewith the latest software and hardware, our system is not immune to failure. While all employees have usernames and passwords for the system, there have been problems with computers becoming infected withmalware because the point-of-sale software can be minimized.
Now that I’ve explained the history and background of my company as well as the infrastructure of oursystem, it’s time to get to work. Visit your course site to check out your assignment. Be sure to ask yourinstructor any questions that arise. Good luck!
IT & Security Infrastructure
Below are details on the Information Technology and Security infrastructure, policies, and equipmentcurrently in place at the client.
Physical security:
The campus physical security system was designed by a retired Army general. Its main featuresinclude a perimeter fence, cameras, smart card access points, alarms, and a full-time securitystaff. Access to all buildings on campus is restricted through smart cards. The server room is a1600 square foot building within the main headquarters building. It has climate control,redundant uninterruptable power supplies (UPS), and a generator with enough capacity for 36hours of uninterrupted operation. The walls, floor and ceiling ar
