Lessons learned from Zappos' 2012 security breach and response

Lessons Learned From Zappos' Security Breach in January, 2012

On January 16, 2012 Zappos' experienced its first major security breach through a compromised server at its recently opened Kentucky Distribution Center, with an experienced hacker gaining access to potentially 24 million customer records. The Zappos' internal ordering systems had encrypted passwords for safety as part of its basic architecture, yet the last four digits of credit cards, complete customer histories and contact information were all compromised (Letzing, 2012). Zappos is the world's leading online store selling women's men's, and children's shoes and accessories, and was recently sold by founder and CEO Tony Hsieh to Amazon.com for $800 million (Hsieh, 2010). As part of the sales of this massive website and online business, Tony Hsieh successfully negotiated to retain control over the logistics, supply chain and innovative approaches to warehouse management that drastically reduces the time to complete an order (McDonald, 2011).

Evaluation of the Zappos Website

In evaluating the product information, corporate contact information, customization of products and the use of customer information at purchase, the Zappos' website shows a very high level of coordination and synchronization of each of these strategies. Each of these four areas of the site are entirely coordinate around the customers' navigation, their online identity once logged in, also taking into account their previous preferences as well. The product introduction area of the website features easily navigated views of shows, clothing and accessories. The Zappos' online catalog has actually won design awards for its use of innovative display and navigational applications that have revolutionized e-commerce (McDonald, 2011). Zappos' also has created one of the most advanced online configurators that integrates perfectly into the guided selling application, which gives the customer an opportunity tor averse up and down the level of product complexity as they choose. The Zappos' online configurator is specifically designed to give customers the maximum amount of customization control over their selection of any item in the catalog and supplier base of the company (McDonald, 2011). Zappos does not directly customize any product on their own; they rather rely on a network of several thousand suppliers to enable this aspect of their unique value proposition. In navigating through their website as a registered customer, it is clear that the product information, contact information and customization through catalog choices are all designed form the customer's approach to shopping. It is also noticeable how the website "learns" about what your preferences are and goes beyond personalization to support specific interests and tastes. The Zappos shopping experience is innovative and unobtrusive in how it accomplishes this, which is one of the key success factors in their continued growth.

Zappos' Privacy and Security Policy

The Zappos security strategy is based on standard website encryption and prior to the hacker getting access to up to 24 million customer records, had been a non-secured HTTP site (Letzing, 2012). Despite having many certifications of transaction security meant to encourage customers to purchase form them, the site had not put into place one of the more fundamental aspects of a secured website. Today of course that change has been made.

Strategies for Ensuring Greater Security For Customers

Two strategies for gaining greater control over the security of the site include multi-role based authentication and the use of more effective login procedures. The overall website complex of systems also needs to have greater levels of authentication at the administrator level to ensure the hackers who gained access with the systems in Kentucky cannot ever use their methods again. Finally the site needs to continually have audits that an unannounced to further ensure security is always in place to protect the site.