What happened?
In late 2013, the US retail chain Target had payment data stolen at its stores. Target said unauthorized access to card data took place from 27/11 to 15/12/2013. About 40 million payment card accounts were affected, along with contact information for up to 70 million people.
According to information released by Target, the attackers entered the system with a username and password stolen from a vendor. The press, citing security journalist Brian Krebs, reported it was Fazio Mechanical Services, a refrigeration and HVAC company in Pennsylvania. A US Senate staff report concluded that once inside the network, the attackers moved from a less sensitive area to the systems holding customer data because the network was not adequately segmented.
Target said it learned of the incident only when the US Department of Justice contacted it on 12/12/2013. In 2017, Target reached an USD 18.5 million settlement with the states. Target's securities filings recorded total costs of USD 292 million related to the incident, of which USD 90 million was reimbursed by insurance.
Lessons for enterprises
- A partner can be a narrow door that leads into many places. A contractor's access should be limited to the scope of their work.
- Network segmentation and data permissions are two independent layers. When one fails, the other still needs to hold the data.
- Alerts are only useful if someone acts on them. Target's monitoring system raised alerts while the malware was being installed, but according to the Senate's analysis the response was ineffective.
A data-centric approach
The Target case began with network access. If key data is protected on the file itself, getting into the system does not necessarily mean being able to read the content, since the right to open a file also depends on a policy tied to each user. For files that must be shared with partners, enterprises can set an access expiry, limit devices and revoke rights when the contract ends. This complements network security and does not replace it. See also the product.
Three questions for a self-check
- Which vendors currently have accounts or remote access to your systems?
- Do documents shared with partners have an expiry and can they be revoked?
- When an abnormal alert arrives, who is responsible for handling it and within what time?
Reference sources
- MPR News: Report: Target hackers breached account security via Penn. heating contractor
- Red River: Warnings (& Lessons) of the 2013 Target Data Breach
