Case Study - Target

Hacking through an hvac vendor Article summary: Fazio Mechanical (HVAC vendor) had data connections with Target’s network Attackers accessed Target’s network with stolen vendor credentials (user name and password) With network access, malware was uploaded on point of sale systems Article available at http://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-because-of`-a-basic-network-segmentation-error.html

Case study – target breach

Case study – target breach Breach Costs Numerous firings (Some Board of Directors, CEO, & CIO) Trustwave (PCI Compliance Auditor) – Sued by Target Bank Vendors more than $200 million in costs DoJ Investigations on Target Over 140 lawsuits Profits dropped 46% during 4th quarter of 2013 Customer visits down entire year of 2014 Stock down 15% after incident

Case study – target breach Important Information Target had a static defense and checklists for baseline security Target passed PCI compliance audit before breach discovery Claimed a level of compliance on Critical Security Controls Network access to third party vendors Network integration with vendors

Missed opportunities

Case study – tEams Team 1 is the senior IT acquisition advisors for another major retailer. The team is the responsible for advising the Board of Directors and senior corporate leadership for IT operations. Focus on being proactive. Team 2 is the software development team for the Target Corporation. The team is the responsible for legacy and new development systems. Focus on understanding the vulnerabilities of your system. Team 3 is the senior IT Operations that owns Target’s Security Operation Center (SOC). Focus on Incident Response and Operations. Team 4 is the testing group for Target. The team is the responsible for auditing and testing. Focus on testing and auditing. Team 5 is the senior Corporate Operations group. The team is led by the Target Director of Operations and controls others on your network. Focus on operations of others on your network.

Questions

Team 1 – Being proactive Team 1: Senior Acquisition Team to the Board of Directors and Senior Company Leadership for another major commercial retailer (not Target) How would you describe Target’s situation to your Board of Directors? How could you assure senior leadership that our company is in a better situation? What would do with Target’s information to be proactive? How would you prove that you are secure enough?

Team 2 – understand vulnerabilities Team 2: Target IT Programs – Legacy and New Development How would you assess current vulnerabilities of your current development projects and legacy programs? How would you do manage risk going forward? The Board of Directors and Senior Leadership want to provide assurances that the breach cannot occur again. What assurances can you provide? What would you want different in your testing and audits?

Team 3 – incident response Team 3: Cybersecurity Risk Management of Incident Response How would you describe your current processes for incident response? What do you want change in your incident response plans and processes? What exercises do you want to conduct going forward? How do you plan to work with others to ensure that you can better respond and recover?

Team 4 – testing and auditing Team 4: Senior Testing and Internal Audit How would you describe your current testing and auditing to your Senior Leadership? What would you like to change for testing going forward? How would you test your interactions with vendors and suppliers? What assurances can your testing provide to your leadership?

Team 5 – interfaces and trust Team 5: Senior Corporate Operations Group What is the best way to manage the risk of others interfacing with our network and systems? How should you control others on your network for access and authorization? What should be required of vendors and sub-contractors to work with your systems? How do you ensure proper training and certification of sub-contractors and vendors?