Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: 10 Facts
Oldest First  |  Newest First  |  Threaded View
Page 1 / 3   >   >>
PaulS681
PaulS681,
User Rank: Apprentice
12/21/2013 | 5:18:56 PM
When?
 

I think one of the big questions here is when target found out about this. These breaches should be made public asap in my opinion. You can go back and find out about who is responsible after but letting your customers know asap is critical.
CC_Insider
CC_Insider,
User Rank: Apprentice
12/21/2013 | 6:47:15 PM
Re: When?
Another article out there says Target discovered this only on the 15th.  Considering that this would be a truly "oh shit" moment, the disclosure was timely.  There's no undue delay here.  The first concern for when something happens like this is shutting off and stopping the bleeding, to keep it from continuing.  So for a couple of days to go by is not a problem.
PaulS681
PaulS681,
User Rank: Apprentice
12/21/2013 | 10:04:21 PM
Re: When?
I disagree... You find out about it and stop the attack and notify the public. A few days doesnt sound like much but I dont see a reason why they can't notify when they find out.
Brian.Dean
Brian.Dean,
User Rank: Apprentice
12/22/2013 | 5:41:35 AM
Re: When?
I hear you and understand that the need to quickly disclose any kind of data breach is a matter of extreme importance for the protection of customers likewise, it is also important to confirm and be 100% sure that a data breach has taken place before releasing an alert, because false positives would not only cause unnecessary panic for the customer but it will also undermine the legitimacy of future alerts.
Brian.Dean
Brian.Dean,
User Rank: Apprentice
12/22/2013 | 6:28:54 AM
Transitions are Important
Banking has come a long way since pre internet times but as people continue to use electronic forms to make payments the need to increase the security standard increases while at the same time complexity needs to be kept to a minimum.

Almost all developing countries have a banking sector but not all of its population are banked, the reason for this are many, and one reason is that the population view banks as being too complex, another is a view that banks are not as secure as they should be. 40 million is a large number, before never forms of payment become discredited, I think it is vital to add security and limit complexity before it starts to affect the number of transitions carried out. 
PaulS681
PaulS681,
User Rank: Apprentice
12/22/2013 | 12:04:05 PM
Re: When?
I aree you have to be 100% positive but if they were on the 15th then why didn't we hear about it? I think if target came out and said why they waited it might help a little. Although this is the least of Targets problems as class action lawsuits are popping up all over the place due to the fact they were breached.
Banker666
Banker666,
User Rank: Apprentice
12/22/2013 | 9:37:02 PM
Millions of dollars
I work at a bank that does card processing and I for one can say PCI is a joke in my opinion.   After being audited they made us move all of the card processing off onto it's own seperate mainframe systems.  They were totally clueless about how a mainframe works and how it processes.  As a result our company spent millions of dollars to meet their compliance.   In my opinion the vast majority of breeches occur on the retail side.   For example I walk into a store and use my card and the clerk doesn't ask for any ID from me.   How about making these retailers make their employees go thru a fingerprint and background check like we had to where I work at.  I wonder if Target was using offshore IT services.  Duh let me guess.   The discussion where I work has been how many cards are we going to have to re-issue because of this and not to mention all of the account forwarding processing we'll likely have to do.  The bigger issue is that who ever pulled this off won't be jailed, much less captured and brought to justice and they likely know it too.    If I pulled off something like this in the U.S. I'd be put into prison.   I know one thing for sure we'll be re-evaluating offshore access and their use.  Maybe even put them all out the door.   Gawd I could not imagine our reputation ruined because of a major breech like this.          
Chris1001
Chris1001,
User Rank: Apprentice
12/23/2013 | 1:47:47 AM
Kudos? Target was outed by a journalist
The breach was reported to the public by Journalist Brian Krebs.  Target was outed.  They did not "come clean" of their own accord.
samicksha
samicksha,
User Rank: Apprentice
12/23/2013 | 2:41:36 AM
Re: Kudos? Target was outed by a journalist
I am not shocked and neither surprised but yes, was it so easy for hackers to attack, i mean 40 million accounts is not a small number. We have been discussing and claiming about more rigid and bulletproof security but still hacker manages to find good loop holes. I am not sure but i read CVV number was also stolen which ideally should be available only with user physically on the card.
SaneIT
SaneIT,
User Rank: Apprentice
12/23/2013 | 7:50:30 AM
Re: Kudos? Target was outed by a journalist
This is one of the things that bothers me most.  Target didn't come out and notify customers to protect them, they kept quiet as long as they could and it sounds like the "fix" for this is a knee-jerk reaction by the banks who issued the cards.  If the tren of punishing customers after a data breech continues we're going to see a lot more people protecting themselves by avoiding companies who have had data losses in the past.
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-4194
PUBLISHED: 2022-11-30
Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2022-4195
PUBLISHED: 2022-11-30
Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity: Medium)
CVE-2022-4175
PUBLISHED: 2022-11-30
Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-4176
PUBLISHED: 2022-11-30
Out of bounds write in Lacros Graphics in Google Chrome on Chrome OS and Lacros prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: High)
CVE-2022-4177
PUBLISHED: 2022-11-30
Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit heap corruption via a crafted Chrome Extension and UI interaction. (Chromium security severity: High)