Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Data Security Dos & Donts From The Target Breach
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/14/2014 | 10:13:13 AM
Re: What happened to Target could have happened to any company
I've seen estimates including:
  • a $30 million liability to credit unions  
  • $550 million if Target has to replace 110 million cards (not including  penalties, credit watch expenses, law suit settlements and beefed up cybersecurity systems)
  • between $400 million to $1 billion in fines (esimate from Jefferies investment banking firm).Bu

But nothing about the aggregate cost to individuals. 
Brian.Dean
Brian.Dean,
User Rank: Apprentice
2/14/2014 | 2:54:12 AM
Re: What happened to Target could have happened to any company
Agreed, threats are evolving at a fast pace, I believe that firms are also evolving at a fast pace to combat these threats, but it would be nice if the security industry could collaborate in an attempt to strengthen overall security standards and its cost.

POS has been coming under a lot of fire, what's the situation of online transactions?
Brian.Dean
Brian.Dean,
User Rank: Apprentice
2/14/2014 | 2:41:54 AM
Re: What happened to Target could have happened to any company
Great point: all the links of the chain have an active responsibility in ensuring that the chain cannot be broken -- businesses that wake up every morning in order to be productive and satisfy their customers need to forward any information or best practices to their partners/supply chain in order to make the entire ecosystem safe.

It has been quite some time now since the Target breach occurred, I wonder whether they have been any estimates on the dollar figure loses that customers are paying for directly through their pockets.
Bala Venkat
Bala Venkat,
User Rank: Apprentice
2/14/2014 | 2:32:13 AM
Re: What happened to Target could have happened to any company
Yes, Marilyn. That report was very insightful confirming how the threat mechanics are evolving to new levels today!
Bala Venkat
Bala Venkat,
User Rank: Apprentice
2/14/2014 | 2:29:35 AM
Re: What happened to Target could have happened to any company
Yes, Alison. Unfortunately, the problem is only getting worse . . .  with corporations opening easy entry into their vaults through third party connections. These days, when I present - I increasingly see the topic of "Vendor Risk Management" resonate strikingly with the audience. 
Alison_Diana
Alison_Diana,
User Rank: Moderator
2/13/2014 | 5:03:15 PM
Re: What happened to Target could have happened to any company
Study after study shows how unprepared SMBs are against cyberattacks -- and study after study shows just how attractive these smaller businesses are for exactly this reason: as a conduit into a big corporation like Target, Nieman Marcus, Citibank, or the DoD. It's imperative that all links in the chain are equally strong. We've just seen what happens when they're not.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
2/13/2014 | 2:15:09 PM
What happened to Target could have happened to any company
You make a great point, Bala, especialy in the wake of today's news that the Target breach begin with a phishing attack.  Mat Schwartz has the details, citing a report by security journalist Brian Krebs: (Paste this link into your browser: http://www.informationweek.com/security/attacks-and-breaches/target-breach-phishing-attack-implicated/d/d-id/1113829?)
This could have happened to anyone, not just retailers during a busy holiday season.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-2287
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-34911
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the usern...
CVE-2022-34912
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
CVE-2022-34913
PUBLISHED: 2022-07-02
** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input.
CVE-2022-2286
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.