Attacks/Breaches
3/6/2014
03:00 PM
Connect Directly
RSS
E-Mail
50%
50%

Target CIO's Resignation: 7 Questions

After the data breach, why didn't the buck stop with PCI assessors or CEO? Search for accountability reveals flawed system, much finger-pointing.

9 Notorious Hackers Of 2013
9 Notorious Hackers Of 2013
(click image for larger view and for slideshow)

Pop quiz for discount retailers who suffer a high-profile data breach that impacts millions of customers, weakens sales, shaves a few points off of your stock price, and may cost your company hundreds of millions of dollars to clean up: What happens next?

For Target, that would be the departure of CIO Beth Jacob, who announced Wednesday -- in a letter to Gregg Steinhafel, Target's chairman, president, and CEO -- that she was resigning "effective immediately." The same day, Steinhafel said in a statement that Target planned to make a number of technology, information security, and compliance changes, and to hire an "interim CIO" to oversee that transition.

To be clear, Jacob was in charge of IT for a retailer that fell victim to a hack attack that resulted in 40 million credit and credit cards and personal information on 70 million customers being compromised. But was she unfairly forced out? And does an episode like this mean the end of a CIO's career?

Here are seven related points to consider:

1. Did Target make CIO a scapegoat?
Some people think Target's management team jettisoned Jacob, finding her a convenient scapegoat. "Target has been obviously impacted. People are questioning Target's security. And she was the fall guy," Walter Loeb, a New York-based independent retail consultant, told The Christian Science Monitor.

[For more on Target's shifting management team, read Target Seeks New CIO.]

But for information security industry veteran Ted Julian, who serves as chief marketing officer at incident response firm Co3 Systems, the end of Jacob's Target tenure wasn't a surprise. "Under these circumstances, it's pretty standard, if for no other reason than optically it just shows the company taking action. It allows them to get someone new with some new ideas and enthusiasm and excitement that can be shown to make aggressive changes," he said, speaking by phone.

Still, her post-breach departure was relatively rapid. "It is pretty typical for the CIO to take the fall, though typically not this quickly," Gartner analyst Avivah Litan said, speaking by phone. "The buck typically stops with the CIO, even though it should stop with the CEO."

On the other hand, according to recent studies, a CIO's job tenure lately lasts, on average, about six years. By that measure, Jacob's five years in the job rates as just about the norm.

2. Before the breach: Were warning signs ignored?
One frequent topic of conversation at last week's RSA conference in San Francisco involved a February 2014 Wall Street Journal report that Target staff had warned management that the retailer was at risk of having its POS systems compromised, at least two months prior to the breach.

But more than one RSA panel participant cautioned that it would be the rare information security team that wasn't sounding some types of alerts. The Journal's report also offered no signal-to-noise assessment of what other types of warnings that Target's CIO and senior management team may have received or acted upon.

"For every single breach I've been aware of, the alarms went off, but if you're getting one serious alarm buried in 10,000 or 100,000 alarms, it's hard to pick it out," Litan said. "There's so much noise, it's a lot like the patches on Windows or Internet Explorer -- here's another bug that was discovered, or certificate that was expired. You just get immunity."

Of course, some businesses seem complicit in their data breaches. Sony, for example, laid off most of its security staff in 2011 and was subsequently hacked more than a dozen times. But Target doesn't appear to have skimped on information security. "Here's what we do know: this was not an anemic security department that lacked staff or resources," Co3's Julian said. "That's not to say that maybe they shouldn't have more, but... this looks to be a well-funded, highly competent group, with extensive rapport across Target and the industry."

3. Will IT reboot better secure Target?
Target is now shopping for a new interim CIO and has hired consulting firm Promontory Financial Group to offer technology, staffing, and business process advice for the retailer's IT, information security, compliance, and risk-management reboot.

Instead of splitting information security responsibilities being between several people, Target will also look externally to hire its first-ever CISO as well as its first-ever chief compliance officer. The latter role was previously overseen by Ann Scovil, Target's VP of risk assurance and compliance, who has long planned to retire at the end of this month, the Wall Street Journal reported.

Asked about how the company planned to now handle risk management -- and whether it would designate a chief risk officer -- Target spokeswoman Molly Snyder said via email, "We haven't provided any additional details on that to date."

Former Target CIO Beth Jacob
Former Target CIO Beth Jacob

4. Target's vacant technology jobs: caveat emptor?
In 2008, with the Great Recession gaining force, Jon Stewart famously asked then-presidential candidate Barack Obama: "With the kind of issues that face the country now... is there a sense that you don't want this?"

Might the same cautionary note be sounded for anyone

Next Page

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
3/6/2014 | 3:19:18 PM
Retail IT security woes
Don't go into retail? If the smart CIOs walk away from retail, we're in trouble. Turnaround experts have an opportunity here, right?
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
3/6/2014 | 3:56:59 PM
Re: Retail IT security woes
Personally I find it refreshing to see a leader take ownership of what happened on her watch. Is it fair? Well, as we all know, life isn't fair. But the US could do with more accountability by top leaders.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
3/6/2014 | 4:45:18 PM
Re: Retail IT security woes
Is may be worth asking why other CIOs have remained in their jobs after major breaches. After all, this is hardly the first massive data breach or organization that has been compromised.
WKash
50%
50%
WKash,
User Rank: Apprentice
3/6/2014 | 5:07:04 PM
Assessors
You raise a good point about the PCI assessors. Not holding assessors accountable in some way is the moral equivalent of letting an auditing firm off the hook in the face of corporate fraud. Hopefully enterprises haven't forgotten the lesson of Enron and Arhur Andersen.  Now that government sector is embracing third party assessors with FedRAMP, the role of IT / security assessors is likely to become more important (and probably more competitive.)  In the meantime, it's hard to believe Target is only now looking to hire a CISO.  Just goes to show,  risk management still doesn't prepare you for Black Swan events.

 
MyW0r1d
100%
0%
MyW0r1d,
User Rank: Apprentice
3/7/2014 | 10:30:46 AM
Re: Retail IT security woes
As long as they "are" smart CIOs.  She had a long history with Target, back to 1984 if I recall her bio correctly, a degree in retail sales and MBA which means she knew the retail industry from Target's point of view and it is important to provide a path for your best employees.  That does not always translate however to being able to manage and fully understand technology's risks/security.  30 years in the same company also promotes tunnel vision.  In smaller companies, you might be able to get away with running on autopilot (as one of my bosses once said, promoted beyond his level of competence) but as one of the largest, leading retailers they should have had a CIO with CIO credentials.  Hiring CISO and audit/compliance professionals is a step in right direction, after leaving the barn door open.
NielH146
50%
50%
NielH146,
User Rank: Apprentice
3/7/2014 | 5:18:50 PM
Re: Retail IT security woes
If you think she resigned of her own choice, you are kidding yourself.  This was not about taking accountability, this is about Target firing her under the guise of her resignation. 

 
JFREY146
50%
50%
JFREY146,
User Rank: Apprentice
3/9/2014 | 4:10:48 PM
Where is the CEO's responsibility?
Isn't it the CEO's responsibility to run the company?  For years Cybersecurity has been on the forefront, when are CEOs and their C-suite pals going to wake up and realize that putting the CIO in charge of information security is like bringing an Accountant to a murder trial?  Information Security is not a tehcnical problem, it is a business problem and should have a strategy that aligns with the business along with representation at the C level.  Additionally, boards of directors are ultimately responsible for the business (with delegation to the CEO).  They should be demanding these organziational alignments, regular updates, etc.  Doing all this will not stop the breaches 100%, but it will make them much more secure than they are now...
marylori
50%
50%
marylori,
User Rank: Apprentice
3/10/2014 | 3:08:20 AM
Garcinia Cambogia Pro
 

Thank you for broadening my knowledge on this aspect to groom up my skills here.

 

Garcinia Cambogia Gold  / Garcinia Cambogia Pro
ThomasW784
50%
50%
ThomasW784,
User Rank: Apprentice
3/10/2014 | 2:07:13 PM
Re: Where is the CEO's responsibility?
Yes, JREY146's post is the article that Information Week should have written.

Target decided as a matter of business strategy to run the risk of customers' data loss rather than incur the cost of duely diligent security. 

OK, part of being in the C-suite (CIO in this case) means falling on your sword, or agreeing to be pushed on it. But this is classic scapegoating. Candidates to fill the CIO position will want to ask whether Target is going to give data security higher priority than before, and whether they'll spend the money to make it so.

It's also time for the rest of the e-commerce world (banks, credit card companies, regulators...) to admit that core data losses are a different kind of problem, not the same as the slow trickle of individual identity compromises, and stop treating all data losses as just the cost of being in this business.
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
3/10/2014 | 2:40:52 PM
Re: Where is the CEO's responsibility?
Who would you put in charge of security if not the CIO?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio