Attacks/Breaches
1/9/2015
10:35 AM
Kevin Watson
Kevin Watson
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Chick-fil-A Breach: Avoiding 5 Common Security Mistakes

On the surface these suggestions may seem simplistic. But almost every major retail breach in the last 12 months failed to incorporate at least one of them.

The latest in a record year of retail industry attacks, Georgia-based fast food company Chick-fil-A confirmed recently that it is investigating a potential credit card breach. The investigation is focused on the company’s point-of-sale (POS) network at some of its restaurants, and the breach is thought to have occurred between December 2013 and September 2014. Brian Krebs, an Internet blogger who specializes in banking security, reported that one financial institution claims that the common thread among approximately 9,000 of its affected customers are purchases at Chick-fil-A restaurants.

As you all know, security breaches of this nature can be caused by a variety of issues: newly discovered software flaws, lax security from a service provider, insider fraud, weak network security, and countless other avenues. There is also the possibility that the data that has been compromised did not originate from Chick-fil-A at all. Theft can occur at numerous places along the payment chain. For example, it may be necessary to examine the bank where the electronic transactions were processed.

In one sense, it does not matter how the breach occurred. The fact that credit cards at a major corporation have once again been stolen highlights the threat that all quick-serve restaurants and retailers of every size are facing from data thieves. Businesses interested in keeping their networks and data secure should start with simple security measures that can effectively mitigate the growing problem that hackers represent. While nothing is fool proof, the following suggestions could have prevented most (if not all) of the breaches that have garnered so much attention in the past 12 months:

Suggestion 1: Protect a location’s incoming Internet traffic. The first step in stealing data is finding an avenue into the targeted business. All of a business’s data circuits and its Internet connections must be protected by a robust and adaptable firewall, protecting the business from unwanted incoming traffic.

Suggestion 2: Implement secure remote access. When permitting remote access to a network for the management of POS and other systems, it is essential that this access is restricted and secure. At a minimum, access should only be granted to individual (not shared) user accounts using 2-factor authentication and strong passwords. Remote access activities should also be logged so that an audit trail is available.

Suggestion 3: Keep anti-malware software up-to-date. It is critical to keep all anti-virus/anti-malware software up to date with the latest versions and definitions. The companies that make anti-malware software monitor threats constantly and regularly update their packages to include preventive measures and improvements to thwart malware seen in other attacks.

Suggestion 4: Update your point of sale as security patches are released. Much like anti-virus/anti-malware updates, POS manufacturers are constantly improving their software to prevent hackers from stealing data, especially if a criminal manages to bypass the built-in security. It is essential that the latest security releases and patches be installed on all POS systems.

Suggestion 5: Limit outbound Internet traffic. In addition to blocking unwanted traffic from getting into a location, it is always a good practice to selectively block outgoing traffic as well. Many modern breaches involve software that becomes resident on your network and then tries to send sensitive data to the hacker’s system via the Internet. No system can completely prevent unwanted malware or viruses, so a good last line of defense is making sure secure data doesn’t leave your network without your knowledge. The same firewall used in Step One should be configured to monitor outgoing traffic as well as incoming.

These suggestions might, on the surface, seem simplistic, but almost every major breach in the last 12 months failed to incorporate at least one of them. Of course, this list is not an all-inclusive way to prevent every type of credit card theft, but it is interesting to ponder how much theft could have been prevented if just these five elements had been implemented correctly. Remember that it costs nothing for data thieves to attempt to hack a business, so for them, every business is a worthwhile target.

Kevin Watson joined VendorSafe as CEO in November 2014, bringing considerable experience in data security, managed technology services and high-growth technology companies. VendorSafe specializes in providing state-of-the-art-data cloud-based firewall solutions tailored for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jamieinmontreal
50%
50%
jamieinmontreal,
User Rank: Strategist
3/18/2015 | 11:11:59 AM
Suggestion 2 - additional possibiility
Individual strong passwords for each POS system would certainly do something but if the organization is large enough (Chick-fil-A, McDs, Harvey's, Marshall's etc etc etc) the chances are those passwords won't be changed regularly and will also be shared among admins opening up a security threat.   Hackers have way more time and resources and people generally speaking will default to convenience even when it's in breach of security policies.

Proper privileged access management is the right solution for this piece.

Very much in agreement on the other items though - 2FA in particular should be a standard approach along with better access management on all systems!

 
vnewman2
50%
50%
vnewman2,
User Rank: Strategist
1/13/2015 | 3:03:21 AM
Re: Security Basics: Don't Take for Granted
Banks have been allowed to proceed with their class action lawsuit against Target Corporation over losses they incurred from the massive data breach at the retailer last year. As large-scale breaches become more prevalent, banks likely will push back against the expectation that they will cover both the costs of fraudulent charges as well as consumer remediation efforts.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/12/2015 | 10:11:56 AM
Re: Security Basics: Don't Take for Granted
It's always good to be reminded about the low-hanging fruit. If the security teams aren't paying attention, you  can e sure that the attackers are...
Technocrati
50%
50%
Technocrati,
User Rank: Ninja
1/11/2015 | 6:59:39 PM
Security Basics: Don't Take for Granted
These steps do seem rather rudimentary but as is mentioned at least one of these fundamentals were either not carried out or maintained. Security is difficult enough, so I don't understand why admins in the retail sector are not taking advantage of the easy tasks.

I guess everyone could be quilty of this - but security can no longer be viewed as a passive, boring chore.
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.