Attacks/Breaches
3/6/2014
03:00 PM
Connect Directly
RSS
E-Mail
50%
50%

Target CIO's Resignation: 7 Questions

After the data breach, why didn't the buck stop with PCI assessors or CEO? Search for accountability reveals flawed system, much finger-pointing.

9 Notorious Hackers Of 2013
9 Notorious Hackers Of 2013
(click image for larger view and for slideshow)

Pop quiz for discount retailers who suffer a high-profile data breach that impacts millions of customers, weakens sales, shaves a few points off of your stock price, and may cost your company hundreds of millions of dollars to clean up: What happens next?

For Target, that would be the departure of CIO Beth Jacob, who announced Wednesday -- in a letter to Gregg Steinhafel, Target's chairman, president, and CEO -- that she was resigning "effective immediately." The same day, Steinhafel said in a statement that Target planned to make a number of technology, information security, and compliance changes, and to hire an "interim CIO" to oversee that transition.

To be clear, Jacob was in charge of IT for a retailer that fell victim to a hack attack that resulted in 40 million credit and credit cards and personal information on 70 million customers being compromised. But was she unfairly forced out? And does an episode like this mean the end of a CIO's career?

Here are seven related points to consider:

1. Did Target make CIO a scapegoat?
Some people think Target's management team jettisoned Jacob, finding her a convenient scapegoat. "Target has been obviously impacted. People are questioning Target's security. And she was the fall guy," Walter Loeb, a New York-based independent retail consultant, told The Christian Science Monitor.

[For more on Target's shifting management team, read Target Seeks New CIO.]

But for information security industry veteran Ted Julian, who serves as chief marketing officer at incident response firm Co3 Systems, the end of Jacob's Target tenure wasn't a surprise. "Under these circumstances, it's pretty standard, if for no other reason than optically it just shows the company taking action. It allows them to get someone new with some new ideas and enthusiasm and excitement that can be shown to make aggressive changes," he said, speaking by phone.

Still, her post-breach departure was relatively rapid. "It is pretty typical for the CIO to take the fall, though typically not this quickly," Gartner analyst Avivah Litan said, speaking by phone. "The buck typically stops with the CIO, even though it should stop with the CEO."

On the other hand, according to recent studies, a CIO's job tenure lately lasts, on average, about six years. By that measure, Jacob's five years in the job rates as just about the norm.

2. Before the breach: Were warning signs ignored?
One frequent topic of conversation at last week's RSA conference in San Francisco involved a February 2014 Wall Street Journal report that Target staff had warned management that the retailer was at risk of having its POS systems compromised, at least two months prior to the breach.

But more than one RSA panel participant cautioned that it would be the rare information security team that wasn't sounding some types of alerts. The Journal's report also offered no signal-to-noise assessment of what other types of warnings that Target's CIO and senior management team may have received or acted upon.

"For every single breach I've been aware of, the alarms went off, but if you're getting one serious alarm buried in 10,000 or 100,000 alarms, it's hard to pick it out," Litan said. "There's so much noise, it's a lot like the patches on Windows or Internet Explorer -- here's another bug that was discovered, or certificate that was expired. You just get immunity."

Of course, some businesses seem complicit in their data breaches. Sony, for example, laid off most of its security staff in 2011 and was subsequently hacked more than a dozen times. But Target doesn't appear to have skimped on information security. "Here's what we do know: this was not an anemic security department that lacked staff or resources," Co3's Julian said. "That's not to say that maybe they shouldn't have more, but... this looks to be a well-funded, highly competent group, with extensive rapport across Target and the industry."

3. Will IT reboot better secure Target?
Target is now shopping for a new interim CIO and has hired consulting firm Promontory Financial Group to offer technology, staffing, and business process advice for the retailer's IT, information security, compliance, and risk-management reboot.

Instead of splitting information security responsibilities being between several people, Target will also look externally to hire its first-ever CISO as well as its first-ever chief compliance officer. The latter role was previously overseen by Ann Scovil, Target's VP of risk assurance and compliance, who has long planned to retire at the end of this month, the Wall Street Journal reported.

Asked about how the company planned to now handle risk management -- and whether it would designate a chief risk officer -- Target spokeswoman Molly Snyder said via email, "We haven't provided any additional details on that to date."

Former Target CIO Beth Jacob
Former Target CIO Beth Jacob

4. Target's vacant technology jobs: caveat emptor?
In 2008, with the Great Recession gaining force, Jon Stewart famously asked then-presidential candidate Barack Obama: "With the kind of issues that face the country now... is there a sense that you don't want this?"

Might the same cautionary note be sounded for anyone

Next Page

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
3/10/2014 | 2:40:52 PM
Re: Where is the CEO's responsibility?
Who would you put in charge of security if not the CIO?
ThomasW784
50%
50%
ThomasW784,
User Rank: Apprentice
3/10/2014 | 2:07:13 PM
Re: Where is the CEO's responsibility?
Yes, JREY146's post is the article that Information Week should have written.

Target decided as a matter of business strategy to run the risk of customers' data loss rather than incur the cost of duely diligent security. 

OK, part of being in the C-suite (CIO in this case) means falling on your sword, or agreeing to be pushed on it. But this is classic scapegoating. Candidates to fill the CIO position will want to ask whether Target is going to give data security higher priority than before, and whether they'll spend the money to make it so.

It's also time for the rest of the e-commerce world (banks, credit card companies, regulators...) to admit that core data losses are a different kind of problem, not the same as the slow trickle of individual identity compromises, and stop treating all data losses as just the cost of being in this business.
marylori
50%
50%
marylori,
User Rank: Apprentice
3/10/2014 | 3:08:20 AM
Garcinia Cambogia Pro
 

Thank you for broadening my knowledge on this aspect to groom up my skills here.

 

Garcinia Cambogia Gold  / Garcinia Cambogia Pro
JFREY146
50%
50%
JFREY146,
User Rank: Apprentice
3/9/2014 | 4:10:48 PM
Where is the CEO's responsibility?
Isn't it the CEO's responsibility to run the company?  For years Cybersecurity has been on the forefront, when are CEOs and their C-suite pals going to wake up and realize that putting the CIO in charge of information security is like bringing an Accountant to a murder trial?  Information Security is not a tehcnical problem, it is a business problem and should have a strategy that aligns with the business along with representation at the C level.  Additionally, boards of directors are ultimately responsible for the business (with delegation to the CEO).  They should be demanding these organziational alignments, regular updates, etc.  Doing all this will not stop the breaches 100%, but it will make them much more secure than they are now...
NielH146
50%
50%
NielH146,
User Rank: Apprentice
3/7/2014 | 5:18:50 PM
Re: Retail IT security woes
If you think she resigned of her own choice, you are kidding yourself.  This was not about taking accountability, this is about Target firing her under the guise of her resignation. 

 
MyW0r1d
100%
0%
MyW0r1d,
User Rank: Apprentice
3/7/2014 | 10:30:46 AM
Re: Retail IT security woes
As long as they "are" smart CIOs.  She had a long history with Target, back to 1984 if I recall her bio correctly, a degree in retail sales and MBA which means she knew the retail industry from Target's point of view and it is important to provide a path for your best employees.  That does not always translate however to being able to manage and fully understand technology's risks/security.  30 years in the same company also promotes tunnel vision.  In smaller companies, you might be able to get away with running on autopilot (as one of my bosses once said, promoted beyond his level of competence) but as one of the largest, leading retailers they should have had a CIO with CIO credentials.  Hiring CISO and audit/compliance professionals is a step in right direction, after leaving the barn door open.
WKash
50%
50%
WKash,
User Rank: Apprentice
3/6/2014 | 5:07:04 PM
Assessors
You raise a good point about the PCI assessors. Not holding assessors accountable in some way is the moral equivalent of letting an auditing firm off the hook in the face of corporate fraud. Hopefully enterprises haven't forgotten the lesson of Enron and Arhur Andersen.  Now that government sector is embracing third party assessors with FedRAMP, the role of IT / security assessors is likely to become more important (and probably more competitive.)  In the meantime, it's hard to believe Target is only now looking to hire a CISO.  Just goes to show,  risk management still doesn't prepare you for Black Swan events.

 
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
3/6/2014 | 4:45:18 PM
Re: Retail IT security woes
Is may be worth asking why other CIOs have remained in their jobs after major breaches. After all, this is hardly the first massive data breach or organization that has been compromised.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
3/6/2014 | 3:56:59 PM
Re: Retail IT security woes
Personally I find it refreshing to see a leader take ownership of what happened on her watch. Is it fair? Well, as we all know, life isn't fair. But the US could do with more accountability by top leaders.
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
3/6/2014 | 3:19:18 PM
Retail IT security woes
Don't go into retail? If the smart CIOs walk away from retail, we're in trouble. Turnaround experts have an opportunity here, right?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

CVE-2014-3372
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90589.

CVE-2014-3373
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.

CVE-2014-3374
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90582.

CVE-2014-3375
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90597.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.