Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Data Security Dos & Don’ts From The Target Breach
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
2/14/2014 | 10:13:13 AM
Re: What happened to Target could have happened to any company
I've seen estimates including:
  • a $30 million liability to credit unions  
  • $550 million if Target has to replace 110 million cards (not including  penalties, credit watch expenses, law suit settlements and beefed up cybersecurity systems)
  • between $400 million to $1 billion in fines (esimate from Jefferies investment banking firm).Bu

But nothing about the aggregate cost to individuals. 
Brian.Dean
Brian.Dean,
 User Rank: Apprentice
2/14/2014 | 2:54:12 AM
Re: What happened to Target could have happened to any company
Agreed, threats are evolving at a fast pace, I believe that firms are also evolving at a fast pace to combat these threats, but it would be nice if the security industry could collaborate in an attempt to strengthen overall security standards and its cost.

POS has been coming under a lot of fire, what's the situation of online transactions?
Brian.Dean
Brian.Dean,
 User Rank: Apprentice
2/14/2014 | 2:41:54 AM
Re: What happened to Target could have happened to any company
Great point: all the links of the chain have an active responsibility in ensuring that the chain cannot be broken -- businesses that wake up every morning in order to be productive and satisfy their customers need to forward any information or best practices to their partners/supply chain in order to make the entire ecosystem safe.

It has been quite some time now since the Target breach occurred, I wonder whether they have been any estimates on the dollar figure loses that customers are paying for directly through their pockets.
Bala Venkat
Bala Venkat,
 User Rank: Apprentice
2/14/2014 | 2:32:13 AM
Re: What happened to Target could have happened to any company
Yes, Marilyn. That report was very insightful confirming how the threat mechanics are evolving to new levels today!
Bala Venkat
Bala Venkat,
 User Rank: Apprentice
2/14/2014 | 2:29:35 AM
Re: What happened to Target could have happened to any company
Yes, Alison. Unfortunately, the problem is only getting worse . . .  with corporations opening easy entry into their vaults through third party connections. These days, when I present - I increasingly see the topic of "Vendor Risk Management" resonate strikingly with the audience. 
Alison_Diana
Alison_Diana,
 User Rank: Moderator
2/13/2014 | 5:03:15 PM
Re: What happened to Target could have happened to any company
Study after study shows how unprepared SMBs are against cyberattacks -- and study after study shows just how attractive these smaller businesses are for exactly this reason: as a conduit into a big corporation like Target, Nieman Marcus, Citibank, or the DoD. It's imperative that all links in the chain are equally strong. We've just seen what happens when they're not.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
2/13/2014 | 2:15:09 PM
What happened to Target could have happened to any company
You make a great point, Bala, especialy in the wake of today's news that the Target breach begin with a phishing attack.  Mat Schwartz has the details, citing a report by security journalist Brian Krebs: (Paste this link into your browser: http://www.informationweek.com/security/attacks-and-breaches/target-breach-phishing-attack-implicated/d/d-id/1113829?)
This could have happened to anyone, not just retailers during a busy holiday season.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.