Attacks/Breaches
3/6/2014
08:11 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Target Begins Security And Compliance Makeover

Security gets a higher exec profile at the beleaguered retailer in the wake of its massive data breach as Target starts the road to reorganizing its security and compliance operations

The departure of Target's CIO yesterday, along with the creation of a dedicated chief information security officer position (CISO) and a new compliance officer (CCO), began a new chapter in the retailer's post-breach security posture.

Security experts say that aside from the executive changes and reorganization, the megaretailer will have other holes to plug to prevent another massive breach like the one that resulted in the theft of 40 million customer credit and debit card numbers, plus the names and contact information of up to 70 million people.

CISO duties at Target previously had been split among multiple people. The new CISO at Target will have centralized oversight and responsibilities for the retailer's information security; Beth Jacob, Target's executive vice president of Target Technology Services and chief information officer, has now left the post she had held since 2008.

Raj Ramanand, founder and CEO of Signifyd, said it's surprising that the CIO was managing security duties at Target. "In most large enterprises, the CISO has a direct reporting line to the board of directors and to the CIO of the company," he says. "I'm surprised by the fact that this was all being managed by the CIO, and they didn't have separate officers in charge."

Target chairman, president, and CEO Gregg Steinhafel explained in a statement that the executive moves are a first step in overhauling the retailer's security and compliance operations. "While we are still in the process of an ongoing investigation, we recognize that the information security environment is evolving rapidly. To ensure that Target is well positioned following the data breach we suffered last year, we are undertaking an overhaul of our information security and compliance structure and practices at Target. As a first step in this effort, Target will be conducting an external search for an interim CIO who can help guide Target through this transformation," he said.

Steinhafel said Target's current vice president of assurance risk and compliance had already planned to retire at the end of the month, so the retailer also will be hiring a chief compliance officer to fill that role. Both the CISO and CCO positions will be filled with candidates outside of Target, he said.

[Attackers are believed to have stolen network credentials belonging to Fazio Mechanical Services, a provider of refrigeration and HVAC systems, and used them to ultimately compromise Target's point-of-sale systems with malware. See Target Compromised Via Its HVAC Contractor's Network Credentials .]

The good news is that Target took the time to handle the reorganization, says Signifyd's Ramanand. "They took the time to understand what was causing [their gaps] before they went out and cut people ... They are doing the right thing," he says.

Despite having what several insiders have characterized as a relatively strong in-house security team, Target had its gaps the way many other organizations and retailers do. Ramanand expects Target to tighten its physical security, as well, because gaps there with its HVAC contractor were a weak link in the chain. "Those go hand in hand," he says of physical and logical security.

"They were focused on the core of the company, as opposed to looking at the weakest link. Security is not just about the most important systems, but also the weakest link," Ramanand says. "I think there were lax security measures around noncore systems."

There also appear to have been visibility problems that prevented Target from spotting the attackers moving the stolen data out of its network, other experts say.

"In my opinion, how was someone able to send gigabytes of data out without [Target] knowing? How can you send out so much data without someone noticing?" says Aviv Raff, CTO at Seculert. The signs were in the logs if someone had been monitoring them, he says.

The question is whether there were just too many security silos in Target not sharing or cooperating with one another, experts say.

While Target's point-of-sale servers may have been in tight lockdown, the attackers were able to find other more gaping holes in its environment. The attackers "had to move laterally" once they got in, so the key for Target would have been to make it harder for them to exit with the stolen payment card information, says Mike Lloyd, CTO at Red Seal Networks. "You can control the path back out," he says. "You need to make the outbound mazes harder."

Former Target CIO Jacob, who holds an MBA, began her career with Target in 1984 as an assistant buyer in Target’s department store division, Dayton’s, for two years. She was hired by Target in 2002 as director of guest contact centers, and named vice president, guest operations in 2006.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
EbonyC129
50%
50%
EbonyC129,
User Rank: Apprentice
3/18/2014 | 4:42:54 PM
re: Target Begins Security And Compliance Makeover
NC is the birthing room for cyber-terror in Pitt County NC there is abundant education in IT Skill sets but ZERO availability of computer forensic experts or even IT personnel interested to any real extent in the implications of an emerging regional economy such as is the case in Greenville NC
The sudden access to global bank accounts to open new businesses and investments creates a feeding frenzy for citizens of a formerly severely depressed rural economy....and little desire exists in local politicians most blinded by partisan political ambitions anyway.....the result is predictable....instances of identity theft at local banks is so common place it is considered a tongue-in-cheek event.....
Sophisticated hacking tactics are seen daily even by youth using file cracking as the new "tag" technique.......all the while partisan political concerns trumps commonsense concerns over the real implications of a climate where cyber-intrusions are a laughing matter ...we will see more of the TARGET sort of attacks and unfortunately little will be drawn from the events by those entrusted with the authority to watch such events.......
Go to any public library or even the local campus libraries, computers are pre-set with devices that will collect all sorts of personal information.........keylogger programs are not uncommon, nor is active intrusions often with the assistance of those entrusted with administrative pass access to public networks......in fact in a few cases I know of political activist who have staffers basically on call to allow intrusions of mostly "political" information they don't desire..but who is say where the line is drawn, after that undesirable political comment is blocked , redirected , or deleted ..who is to say that same employee who has such little regard for professionalism is not connected to others who want bank information, social security numbers etc,etc,...?
jeremyarcher
50%
50%
jeremyarcher,
User Rank: Apprentice
3/7/2014 | 8:07:22 PM
re: Target Begins Security And Compliance Makeover
Here is what makes you qualified to be a CIO at Target:

"Former Target CIO Jacob, who holds an MBA, began her career with Target in 1984 as an assistant buyer in TargetGÇÖs department store division, DaytonGÇÖs, for two years. She was hired by Target in 2002 as director of guest contact centers, and named vice president, guest operations in 2006."

I'm sure she still doesn't understand what happened. Technical expertise does matter for CIOs the same way accounting knowledge matter for CFOs.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.