Attacks/Breaches
3/6/2014
08:11 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Target Begins Security And Compliance Makeover

Security gets a higher exec profile at the beleaguered retailer in the wake of its massive data breach as Target starts the road to reorganizing its security and compliance operations

The departure of Target's CIO yesterday, along with the creation of a dedicated chief information security officer position (CISO) and a new compliance officer (CCO), began a new chapter in the retailer's post-breach security posture.

Security experts say that aside from the executive changes and reorganization, the megaretailer will have other holes to plug to prevent another massive breach like the one that resulted in the theft of 40 million customer credit and debit card numbers, plus the names and contact information of up to 70 million people.

CISO duties at Target previously had been split among multiple people. The new CISO at Target will have centralized oversight and responsibilities for the retailer's information security; Beth Jacob, Target's executive vice president of Target Technology Services and chief information officer, has now left the post she had held since 2008.

Raj Ramanand, founder and CEO of Signifyd, said it's surprising that the CIO was managing security duties at Target. "In most large enterprises, the CISO has a direct reporting line to the board of directors and to the CIO of the company," he says. "I'm surprised by the fact that this was all being managed by the CIO, and they didn't have separate officers in charge."

Target chairman, president, and CEO Gregg Steinhafel explained in a statement that the executive moves are a first step in overhauling the retailer's security and compliance operations. "While we are still in the process of an ongoing investigation, we recognize that the information security environment is evolving rapidly. To ensure that Target is well positioned following the data breach we suffered last year, we are undertaking an overhaul of our information security and compliance structure and practices at Target. As a first step in this effort, Target will be conducting an external search for an interim CIO who can help guide Target through this transformation," he said.

Steinhafel said Target's current vice president of assurance risk and compliance had already planned to retire at the end of the month, so the retailer also will be hiring a chief compliance officer to fill that role. Both the CISO and CCO positions will be filled with candidates outside of Target, he said.

[Attackers are believed to have stolen network credentials belonging to Fazio Mechanical Services, a provider of refrigeration and HVAC systems, and used them to ultimately compromise Target's point-of-sale systems with malware. See Target Compromised Via Its HVAC Contractor's Network Credentials .]

The good news is that Target took the time to handle the reorganization, says Signifyd's Ramanand. "They took the time to understand what was causing [their gaps] before they went out and cut people ... They are doing the right thing," he says.

Despite having what several insiders have characterized as a relatively strong in-house security team, Target had its gaps the way many other organizations and retailers do. Ramanand expects Target to tighten its physical security, as well, because gaps there with its HVAC contractor were a weak link in the chain. "Those go hand in hand," he says of physical and logical security.

"They were focused on the core of the company, as opposed to looking at the weakest link. Security is not just about the most important systems, but also the weakest link," Ramanand says. "I think there were lax security measures around noncore systems."

There also appear to have been visibility problems that prevented Target from spotting the attackers moving the stolen data out of its network, other experts say.

"In my opinion, how was someone able to send gigabytes of data out without [Target] knowing? How can you send out so much data without someone noticing?" says Aviv Raff, CTO at Seculert. The signs were in the logs if someone had been monitoring them, he says.

The question is whether there were just too many security silos in Target not sharing or cooperating with one another, experts say.

While Target's point-of-sale servers may have been in tight lockdown, the attackers were able to find other more gaping holes in its environment. The attackers "had to move laterally" once they got in, so the key for Target would have been to make it harder for them to exit with the stolen payment card information, says Mike Lloyd, CTO at Red Seal Networks. "You can control the path back out," he says. "You need to make the outbound mazes harder."

Former Target CIO Jacob, who holds an MBA, began her career with Target in 1984 as an assistant buyer in Target’s department store division, Dayton’s, for two years. She was hired by Target in 2002 as director of guest contact centers, and named vice president, guest operations in 2006.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EbonyC129
50%
50%
EbonyC129,
User Rank: Apprentice
3/18/2014 | 4:42:54 PM
re: Target Begins Security And Compliance Makeover
NC is the birthing room for cyber-terror in Pitt County NC there is abundant education in IT Skill sets but ZERO availability of computer forensic experts or even IT personnel interested to any real extent in the implications of an emerging regional economy such as is the case in Greenville NC
The sudden access to global bank accounts to open new businesses and investments creates a feeding frenzy for citizens of a formerly severely depressed rural economy....and little desire exists in local politicians most blinded by partisan political ambitions anyway.....the result is predictable....instances of identity theft at local banks is so common place it is considered a tongue-in-cheek event.....
Sophisticated hacking tactics are seen daily even by youth using file cracking as the new "tag" technique.......all the while partisan political concerns trumps commonsense concerns over the real implications of a climate where cyber-intrusions are a laughing matter ...we will see more of the TARGET sort of attacks and unfortunately little will be drawn from the events by those entrusted with the authority to watch such events.......
Go to any public library or even the local campus libraries, computers are pre-set with devices that will collect all sorts of personal information.........keylogger programs are not uncommon, nor is active intrusions often with the assistance of those entrusted with administrative pass access to public networks......in fact in a few cases I know of political activist who have staffers basically on call to allow intrusions of mostly "political" information they don't desire..but who is say where the line is drawn, after that undesirable political comment is blocked , redirected , or deleted ..who is to say that same employee who has such little regard for professionalism is not connected to others who want bank information, social security numbers etc,etc,...?
jeremyarcher
50%
50%
jeremyarcher,
User Rank: Apprentice
3/7/2014 | 8:07:22 PM
re: Target Begins Security And Compliance Makeover
Here is what makes you qualified to be a CIO at Target:

"Former Target CIO Jacob, who holds an MBA, began her career with Target in 1984 as an assistant buyer in TargetGÇÖs department store division, DaytonGÇÖs, for two years. She was hired by Target in 2002 as director of guest contact centers, and named vice president, guest operations in 2006."

I'm sure she still doesn't understand what happened. Technical expertise does matter for CIOs the same way accounting knowledge matter for CFOs.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.