Sam Supakkul -- RE10.. - The University of Texas at Dallas

Having Having Having Having insufficient insufficient insufficient insufficient insufficient knowledge knowledge knowledge knowledge of of
of
of NFRs NFRs
NFRs
NFRs can can can can lead lead lead lead to
to
to
to
dire dire dire dire dire consequences
consequences
consequences
consequences
TJX unable to prevent the hacker
1. Break-in wireless network
2. Masquerade user login
3. Steal credit card info
(2 nd ) Biggest credit card
theft
45.7M credit cards stolen
$20M in fraudulent transactions
TJX used security measures
ID/password authentication
Data encryption
But TJX did not know enough
Potential security problems
Applicable mitigations
Proper tradeoff among NFRs