Team 2 – understand vulnerabilities Team 2: Target IT Programs – Legacy and New Development How would you assess current vulnerabilities of your current development projects and legacy programs? How would you do manage risk going forward? The Board of Directors and Senior Leadership want to provide assurances that the breach cannot occur again. What assurances can you provide? What would you want different in your testing and audits?

Fazio lacked user training to protect from phishing emails How would you assess current vulnerabilities of your current development projects and legacy programs? Fazio vendor malware was not robust enough; used free version of Malwarebyte--no real-time protection Fazio lacked user training to protect from phishing emails Target did not ensure trusted vendor’s systems were adequately protected Target Security Operations Center (SOC) was evidently not trained well enough to react properly to intrusion detection software (IDS) notifications IDS was set to detect, not take any other action Sensitive customer info was not adequately protected Target did not use/require 2-factor authentication

HOW WOULD YOU DO MANAGE RISK GOING FORWARD? Target ensure/validate all trusted vendors systems are adequately protected before allow access (e.g. use commercial grade IDS) Ensure up-to-date training on phishing emails Ensure SOC is trained on responding to IDS detection notifications Incorporate 2-factor authentication Ensure SOC is aware of industry on-going security trends/threats Use “white listing”

Increase security and awareness through the risk management actions The Board of Directors and Senior Leadership want to provide assurances that the breach cannot occur again. What assurances can you provide Increase security and awareness through the risk management actions

What would you want different in your testing and audits? Ensure that adequate security processes for in-house and 3rd party vendors are baked in Ensure audits are performed in a timely manner Ensure all testing and audit processes are properly followed Ensure vulnerabilities are adequately patched

Team 5: Senior Corporate Operations Group What is the best way to manage the risk of others interfacing with our network and systems? Enclave systems that vendors need access to How should you control others on your network for access and authorization? Enclaving systems White Listing 2-factor authentication What should be required of vendors and sub-contractors to work with your systems Require cyber security training B-2-B agreement How do you ensure proper training and certification of sub-contractors and vendors? Require review of all training documents/process and do not grant access till all requirements are met