Analytics // Security Monitoring
4/1/2014
09:00 AM
Craig Carpenter
Craig Carpenter
Commentary
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Be Careful Beating Up Target

Target was actually better prepared than most retailers. The real problem lies with the current state of industry threat intelligence and IR practices.

A flurry of stories surfaced recently, including those in Bloomberg BusinessWeek and InformationWeek, highlighting signals of compromise that Target apparently "missed" or even "ignored," resulting in the theft of 40 million credit card accounts. Clearly the Target breach was serious and wide-ranging, as it affected a large number of customers and even hit Target’s fourth-quarter revenue and earnings

Before we get carried away with all that Target could or should have done to prevent its breach, we should examine all that was done and take a closer look at just how different Target’s preparation and response were from those of almost any other Global 1000 firm. What we’ll find is that Target was actually better prepared than the vast majority of its peers across all industries, leading to the clear conclusion that the problem lies not with Target, but with the current state of threat intelligence and IR (incident response).

First, Target did a lot of things right. It had dedicated security and IR teams using multiple advanced tools; according to Congressional testimony by Target’s CFO, the retailer "…spent hundreds of millions of dollars protecting… data and employed more than 300 people on the issue." This was an investment relatively few entities can match.

As with any breach, Target had some missteps and vulnerabilities. First, management was apparently unwilling to move to new, more secure smart-chip-based card systems common in Europe, due to cost concerns. Second, the retailer is alleged to have ignored pleas by its security team to do a more thorough review of its payment system -- likely in part due to the timing of the request, coming a short time before the critical post-Thanksgiving shopping season. Third, many have criticized Target’s failure to wall-off its payment systems from the rest of its corporate network, through which hackers were able to gain access to payment details. 

But was Target’s security posture and IR process really that much different from those of other large corporate and government entities? As The Wall Street Journal points out, "The sheer volume of warnings retailers receive makes it hard to know which to take seriously." But this dynamic is not unique to retailers: Every corporate and government entity today receives more alerts than they can handle -- even with sophisticated anti-malware systems and hundreds of employees dedicated solely to security. It’s the downside to big data: Too much information in a cybersecurity context can be, and often is, harmful.

Exacerbating this situation is the incredibly manual, ad hoc nature of today’s IR. An entity like Target likely gets hundreds if not thousands of alerts every day, from myriad systems, including anti-malware tools (e.g., FireEye), next-gen firewalls (e.g., Palo Alto Networks), and SIEMs (e.g., ArcSight, Splunk, etc.) to name just a few.  Alerts aren’t correlated across each other or typically checked against known good lists, bad lists, or indicators of compromise (IoCs), similar to criminal “watch lists” of mug shots with fingerprints and rap sheets. Each alert typically has minimal detail, is not confirmed against the system(s) in question, and is not prioritized. Thus alerts tell a security analyst very little and all look alike… yet they must be investigated to at least a minimal degree.

Worse yet, gathering even minimal investigative details requires an entirely manual process: Security analysts must manually compare the alert against IoCs, access the system(s) in question, manually confirm that the alert is real (i.e., the system in question are in fact compromised) by grabbing data from the system in question, and then manually comparing this evidence to other bits of data from completely different systems before forming a judgment as to the veracity and severity of the alert. 

For an entity like Target, this manual, error-prone process is replicated hundreds if not thousands of times each day, each a largely separate investigation. While hackers need only slip through once to wreak their havoc, Target must be right 100 percent of the time.  

The issue isn’t Target’s security team or investment in tools, but rather the current state of the threat intelligence and IR practices as employed by Target and virtually all enterprises and government entities globally. These IR practices can be summed up in two words: un-integrated and manual. Until both are fixed with more integrated and automated approaches, we will find ourselves continuing to wonder why firms like Target "missed" or "ignored" alarm bells.

Prior to joining AccessData, Craig was VP of Marketing and Business Development at Recommind,, where he pioneered and popularized predictive coding and predictive information governance into the hottest trends in the e-discovery and GRC markets, respectively. Before joining ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/9/2014 | 8:33:08 AM
Re: It's Windows, Stupid!
@JamesR010: I am well aware of the compliance vs secure scenario, as well as the Heartland situation. I also have seen firsthand how kiosks, ATMs, etc. run imbedded XP in admin mode. I have seen horrible security practices; stuff that just makes me cringe and wonder what they were thinking. It's all crazy, I agree - too many systems running wrong configurations makes for a target rich environment, to coin a phrase. At the same time, it is a bit premature to simply disregard the certification by Trustwave simply because of their previous record. As you mentioned, compliance does not equate to security, and since we know that IS the case, can we really disparage Trustwave? We just don't know all the details right now. In the end, it boils down to secure practices rigidly enforced, driven by a well informed upper management team. Really, it is up to us to educate our organization regarding the risks and how to best mitigate them because is isn't whether or not a system will be breached, but rather when it will be breached. We just like to postome that unfortunate incident indefinitely if at all possible.
JamesR010
50%
50%
JamesR010,
User Rank: Strategist
4/8/2014 | 3:41:20 PM
Re: It's Windows, Stupid!
@GonzSTL : They were "certified" by Trustwave, and being "in compliance" does NOT equal being secure. Trustwave doesn't have a good track record of certifying compliance (see Heartland Payment Systems fiasco of a few years ago, IIRC). The stuff I posted I picked up from several sources, including Krebs, and a personal experience I had at Sears in January of this year. An employee rebooted (powercycled really) a kiosk right in front of me that was running WinXP as administrator and it displayed the name of the script it was going to run for the kiosk. Crazy stuff.
LucasZa
50%
50%
LucasZa,
User Rank: Apprentice
4/8/2014 | 12:49:26 PM
Target was a victim
Blame the victim? When banks get robbed, do we blame their security? This would only happen if there was gross negligence such as leaving cash out unsupervised.

I know firsthand that the hacking groups breaching larger organizations including the one that hit Target are highly capable, funded, determined, and well-practiced. Once they gained initial access into Target, they no doubt had to proceed with privilege escalation, lateral movement, and even find places to pivot between network segments in order to access the card data environment (CDE). They're also adept at compromising other environments such as Linux and AIX and will even plant backdoors on those systems.

In a day and age when alerts come in at a great magnitude, who can blame them for overlooking one with the generic name "malware.binary" as they're having to pick and choose which ones to spend valuable time investigating. What this really highlights is the need for automation, including the incorporation of robust intelligence and contextual detail. The industry as a whole is actively pursuing these capabilities. Defenses will improve as security teams are better equipped with such capabilities.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/8/2014 | 11:44:32 AM
Re: It's Windows, Stupid!
We don't actually know if Target's POS systems were not updated or had malware protection. We do know that they were PCI sertified immediately prior to the breach, so I'd like to think that their ASV or whomever certified them checked those particular items and deemed them current. What bothers me greatly is the misalignment of their security reporting infrastructure. They had security reporting to IT, which presents a conflict of interest that potentially negates the separation of duties. It wouldn't surprise me if this was behind the security team's decision to act upon the initial malware notification in the way they did. Unfortunately, we will probably never know if it did or not.

 
JamesR010
50%
50%
JamesR010,
User Rank: Strategist
4/7/2014 | 10:39:21 AM
Re: It's Windows, Stupid!
Agreed. Most of these PoS systems (PoS - lol) run WinXP in admin mode, are not patched properly, and may not even have AV locally. However, most of the fault is still on Target's C executives for dropping the ball on security.
speshul
100%
0%
speshul,
User Rank: Strategist
4/2/2014 | 4:50:13 PM
Re: It's Windows, Stupid!
I think the problem would be prevelant in any mainstream operating system used globally for companies and most households. If MAC OSX was the number 1 used operating system at companies and in homes, then we would be saying the same things about them.
Jaludi
100%
0%
Jaludi,
User Rank: Apprentice
4/2/2014 | 3:02:32 PM
Being wrong with other company doesn't exonerate anyone
While Target and many others performed only 95% of their due diligence, that still doesn't exonerate them or anyone else that's still vulnerable.

Automated event detection, correlation and the elimination of irrelevant alerts should be part of the process. Without that, the other 95% is of minimal consequence. Ignoring those steps because almost everyone else does is what gets them in trouble.

Shared responsibility should go to all the vendors who don't insist these extra steps be taken.

 

 

 
eaglei52
50%
50%
eaglei52,
User Rank: Apprentice
4/2/2014 | 1:05:19 PM
Defense in Depth...
With failure to wall-off its payment systems from the rest of its corporate network, through which hackers were able to gain access to payment details, Target effectively lost access control to it's systems. They may not have even deleted dormant passwords. Alot of other faults can be forgiven somewhat, such as the payment system software faults claimed. But not knowing who has access to your systems and verifying their currency is tough to forgive. Too, the inability to determine that an internal server had connected to upload the data to the hackers is another serious fault. So, no with these two glaring problems, don't give Target too much slack.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
4/2/2014 | 9:06:07 AM
"low hanging fruit".
"Whenever you bring budgets into the security mix, you get into this discussion about not being the "low hanging fruit." 

That is such a short-sighted point view! Perhaps if Target had a dedicated CISO in it's corporate hierarchy, the outcome would have been very different. (See: Target Begins Security & Compliance Makeover)
AccessServices
100%
0%
AccessServices,
User Rank: Apprentice
4/2/2014 | 7:51:03 AM
Why Target and What to Do

i donot know anyone that works for target corporate; however,i've talked with people that know alot about how target manages security andthey have all said that target was much better than most.  whenever you bring budgets into the securitymix, you get intot his discussion about not being the "low hanging fruit".  

someone broughtup a great point in a private discussion about why target and not say...walmart. target has higherend customers so their credit limits will be higher and thus the cards will be worth more onthe blackmarket. this infection was a oneshot opportunity andthe badguys knew it.  they did a good job with their roi and target did a bad job with their risk assessmenttarget thought that there were not the low fruit; however, because their cards were worth more they were in a different category than they thought.

concerning thelogging/monitoring/eventcorrelation aka siem. there is a siem that would have correlated these events and prioritized for the security team. it also would have noticedthat 11 gofdata were being ftped from as erver that normally does not send data to the internet(baselining).  on top of that,i t could have a smart response to automatically block or with approval anything suspicious. it is also in gartner's magic quadrant. 



jeffjones
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.