Retail Services at Fairplay

Fairplay Turns to a Managed Security Service Provider

Fairplay Finer Foods is an independent grocery retailer that operates in the greater Chicago area. From its beginning, Fairplay’s mission has been to provide quality foods at an affordable price along with exceptional customer service. Starting with a single store in 1975, Fairplay has since grown to seven locations. The opening of each new store led to increased sales and attracted new customers; however, expansion also raised new information system needs as well as information security risks.

Due to its size, it was not practical for Fairplay to create and run its own information technology organization, so it contracted with KCS Computer Technology, Inc., to provide these services along with the necessary computer hardware and systems. One of KCS’s key accomplishments for Fairplay was to implement and manage a corporate network that the grocery chain uses to run applications and communicate across all of its stores.

Another important area of focus for KCS involved helping Fairplay manage issues related to the Payment Card Industry Data Security Standard (PCI DSS). Retailers accepting credit cards and other forms of electronic payment are required to comply with the PCI DSS. The PCI DSS standard ensures that businesses follow best practices for protecting their customers’ payment card information. The necessity to comply with the PCI DSS standard along with concern over potential network security issues led Fairplay and KCS to seek out a managed security service provider (MSSP).

After a thorough investigation, Fairplay and KCS selected ControlScan, an MSSP headquartered in Atlanta. This choice was based on ControlScan’s simple pricing model, stable of certified security experts, advanced technology, and solid reputation. As part of its contract with Fairplay, ControlScan agreed to serve as an extension of KCS, delivering cloud-based security technologies and related security support services, including:

Installing, configuring, and monitoring a system of next-generation firewalls
Investigating, responding to, and reporting on security-related events
Providing network usage reports for insights into company resource utilization
Upgrading the network on an ongoing basis by implementing the latest security
Enhancements
Providing expertise to reduce network complexity and contain network-related costs
ControlScan’s initial project was installing next-generation firewall appliances to protect each of Fairplay’s locations. This work was completed overnight in a single night to minimize business disruption. ControlScan then conducted a thorough PCI gap analysis to compare current Fairplay security controls with those required by the PCI DSS. ControlScan developed a detailed set of recommendations and options for eliminating the gaps, giving Fairplay management a roadmap to achieve full PCI DSS compliance. Finally, ControlScan did a full review of all of Fairplay’s existing information systems and security policies, working with the chain’s IT staff to tweak and customize policies where necessary.

Critical Thinking Questions

1. What advantages does the use of an MSSP offer a small retailer such as Fairplay? Can you think of any potential drawbacks of this approach? Is there a danger in placing too much trust in an MSSP? Explain.
2. Data breaches at major retailers, such as Neiman Marcus, Target, and others, in recent years have shown that compliance with the PCI DSS is no guarantee against an intrusion (see Jaikumar Vijayan, “After Target, Neiman Marcus Breaches, Does PCI Compliance Mean Anything?,” Computerworld, January 24, 2014). If you were a member of Fairplay’s management team, what additional actions would you take to protect your customer’s credit card data?
3. Do research online to gain insight into the evolution of the PCI DSS standard. What major changes were made in moving from PCI 2.0 to PCI 3.0? What changes are being suggested for future versions of the PCI standard?

Sources: “About Fairplay,” Fairplay, www.fairplayfoods.com/about (accessed April 12, 2016); “KCS Computer Technology,” KCS Computer Technology, Inc., www.kcstech.com (accessed March 12, 2016); “Fairplay Finer Foods Secures Chain Stores with ControlScan Managed Security Services,” ControlScan, www.controlscan.com/fairplay-finer-foods-secureschain-stores-with-controlscan-managed-security-services (accessed April 12, 2016); “PCI FAQs,” PCI Compliance Guide, www.pcicomplianceguide.org/pci-faqs-2/#1 (accessed April 12, 2016)