Lowe’s Certification and Accreditation

1. Presented By: Ryan Menge, Anthony Lawson, Jacob Domann, P.J Maguire, Allen Stevens, Sarah Massucci, Mason Frazee Lowe’s Certification and Accreditation

2. Overview Systems Boundaries and Functions Vulnerabilities, Threats, and Threat Sources Annual Loss Expectancy Identification of Mediating Controls Appropriate Effectiveness for each Vulnerability Plan of Action and Milestones

3. Boundaries of the System • Purchase and Return Records • Sales system • “Pick up Later” System • Documentation of product • Inventory System • Responsible for updating inventory • Management and Security Review • End of the day reports

4. System Structure

5. Natural Disaster • Tornado Action Plan • Lock all doors • Move all associates and customers to back of store • Flood Action Plan • Built in drainage in parking lot • Store built on a hill • Products and computers/servers lifted off ground • Appropriate Effectiveness Measurements • ALE = ($660,000 = $16,500,000 AV x 1.0 EF x .04 ARO)

6. Social Engineering • Employee are Required to Wear Uniforms • Vest stay in store • Store Number Associated with Computer Logins • Appropriate Effectiveness Measurements • ALE = ($26.88 = $960 AV x 1.0 EF x .028 ARO)

7. Power Outage • Back Up Generator • Required fuel level • Plan in place if needed longer than 8 hours • Appropriate Effectiveness Measurements • ALE = ($1500 = $50,000 AV x 1.0 EF x .03 ARO)

8. UPC Swap • Pen and Paper Inventory System • Departments manually count inventory • Employees • Employees are trained to watch for any UPC occurring in the store • Appropriate Effectiveness Measurements • ALE = ($12,500 = $500 AV x 1.0 EF x 25 ARO)

9. PhysicalAccess • Exterior Doors are Locked • Cameras on Inside and Outside of Building • Footage stored for a length of time • Lumber Yard is Secured • Entrance patrolled by employees • Each transiting through is checked • Server Room is Locked with Key Code • Appropriate Effectiveness Measurements • ALE = ($800 = $4,000,000 AV x .001 EF x .20 ARO)

10. Customer Data • Data Securely Transferred Between Stores • Different encryption methods used for transfer • Logins Required to Access Customer Data • Appropriate Effectiveness Measurements • ALE = ($25,000 = $250,000 AV x 1.0 EF x .1 ARO)

11. Rogue Employee • Video Cameras • Placed above registers, exits • Register Tills Counted • Checked by hand and computer • Inventory • Monthly inventory is checked against current sales • Appropriate Effective Measurements • ALE = ($225 = $25 AV x .75 EF x 20 ARO)

12. System Crash on a Card Reader • Industry Standards in Place • System is in accordance with PCI DSS standards • Vulnerability Software • Nessus checks for any vulnerabilities on the card reader system • Appropriate Effective Measurements • ALE = ($14,000 = $2,000 AV x .70 EF x 10 ARO)

13. Arson • Fire Detectors and Water Sprinkler Systems Installed • Security Cameras • Inside and outside placement • Watched by asset protection employee • Appropriate Effective Measurements • ALE = ($412,500 = $16,500,000 AV x 1.0 EF x .025 ARO)

14. Bad Checks Sufficient Documentation Required be Provided to Customer on Policies 14 Day waiting on Checks to Clear Appropriate Effective Measurements ALE = ($50 AV x 1.0 EF x 70 ARO)

15. Plans of Action and Milestones • Write a “what to do” for an Earthquake • Earthquakes are minor in Oklahoma, however this is something that should have an emergency plan for. • Make Employees More Aware of Policies • Electronic training be associated with the employees during their hire dates.

16. Summary Systems Boundaries and Functions Vulnerabilities, Threats, and Threat Sources Annual Loss Expectancy Identification of Mediating Controls Appropriate Effectiveness for each Vulnerability Plan of Action and Milestones

17. Questions?