Slashdot Mirror

← Back to Stories (view on slashdot.org)

Target's Internal Security Team Warned Management

Posted by Soulskill on from the they-were-definitely-a-target dept.

david.emery writes "According to this story, Target's own internal computer security team raised concerns months before the retailer lost millions of credit card numbers in an attack. (Quoting a paywalled story in the Wall Street Journal.) Target's management allegedly 'brushed them off.' 'At least one analyst at the Minneapolis-based retailer wanted to do a more thorough security review of its payment system.' This raises a more general question for the Slashdot community: how many of you have identified vulnerabilities in your company's/client's systems, only to be 'brushed off?' If the company took no action, did they ultimately suffer a breach?"

9 of 236 comments (clear)

  1. Posting anonymously for obvious reasons... by Anonymous Coward · · Score: 5, Interesting

    Yes, there are horrible security flaws where I work. Things as basic as changing passwords on a regular basis have been brought up repeatedly, and the answer is always, "we can't make people do that", or "that's something to keep in mind for the future, but we have more important things to worry about"

    1. Re:Posting anonymously for obvious reasons... by ackthpt · · Score: 5, Informative

      Yes, there are horrible security flaws where I work. Things as basic as changing passwords on a regular basis have been brought up repeatedly, and the answer is always, "we can't make people do that", or "that's something to keep in mind for the future, but we have more important things to worry about"

      I've worked at two kinds of places - one, where it was pretty much as you described. The second sort was, upon orientation you are given your accounts and access and told they are your responsibility to use discretely and to notify the appropriate support should you even suspect they have been compromised. Failure, in the second case, was ground for discipline or termination of employment.

      Guess where things went more smoothly and security issues seldom elevated to crisis.

      --

      A feeling of having made the same mistake before: Deja Foobar
    2. Re:Posting anonymously for obvious reasons... by Desler · · Score: 5, Insightful

      You do realize that making people change their passwords all the time simply leads to people using weaker passwords or writing them down, right? This type of policy though up by some self-proclaimed security expert amongst the IT monkeys almost always leads to worse security than not. And you don't even need to take my word for it:

      The downside of changing passwords is that it makes them harder to remember. And if you force people to change their passwords regularly, they're more likely to choose easy-to-remember -- and easy-to-guess -- passwords than they are if they can use the same passwords for many years. So any password-changing policy needs to be chosen with that consideration in mind.

      https://www.schneier.com/blog/...

    3. Re:Posting anonymously for obvious reasons... by l0n3s0m3phr34k · · Score: 5, Insightful

      At my job, I have three different VPN tokens, and at one time had at least 30 different passwords all over the globe I had to use...ours forces changes at various times, some are 30 days, some 90, some never...depending on the system. RSA admin software had a PIN too. We usually just keep it all in a spreadsheet. If you can't remember a single password...but you also need the Active ID token too. We potentially have deep access into the air line reservation system, although that system is so insanely complicated and cross-platform good luck finding anything of worth haha.

      It's kinda backwards in a way. Retail is always a huge target, the bigger the company the bigger the score. From a security design viewpoint, the "backend" and the "financial" systems should have been physically separated at all times, using some encrypted EDI to exchange whatever (inventory, overstock, per piece price, etc). The credit card terminals should have been "payment only" and not loaded down with all their SHIT like "cash back?" "cure cancer?" "are you sure?" "join our rewards / store card" and wtf other messages I have to tap on your stupid touchscreen a million times just to pay you. Some of them even have ads on them.

      Soon, Walgreens, CVS, Dollar whoever...the more sophisticated we make these terminals where our card touches their system, the more exploitable they will become. It's the slow feature creep, the "we need to upload new ad images at 2:50AM" by developers in a far-off land...pushed forward by managers who just want "shiney bright things" that make us give up even more information, waste our time more, and provide little real actual benefit.

    4. Re:Posting anonymously for obvious reasons... by cusco · · Score: 5, Interesting

      I've worked in the physical security field (cameras, key cards, alarm systems, etc.) for the past eight years, and can tell you that Target's HVAC vendor is in no way unusual. I know of a large security vendor that uses the same username/password combination on every every customer that they ever touch, nationwide, and at most of them they are administrators on the security server. At a lot of them they have remote access.

      --
      "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
  2. customer service portal by ironicsky · · Score: 5, Interesting

    Years ago I worked for one of the two big American cable companies currently merging. I identified a security flaw in the public facing side of their customer service portal, essentially giving access to all the config files, which contained admin credentials in plain text. I proposed simple solutions, like not allowing directory listings of folders, among others.

    They shrugged it off, and to the best of my knowledge, last year the vulnerability was still accesaible

  3. Every single company by Tony+Isaac · · Score: 5, Insightful

    There are security concerns in every company, without exception. Obviously, even the NSA itself had inadequate security!

    Yes, many times security concerns are brought up, and brushed off. But this is not necessarily an indication of a problem. Every security risk must be weighed based on the likelihood of occurrence, and the severity of the impact, should it occur. Many of these calculations are inexact, and must be based on incomplete information.

    Should Target have protected themselves better? Probably. But hindsight is 20/20. The difficult part is to anticipate the problems that might occur, without crippling your organization through impossibly tight security.

  4. You'd Be Amazed by The+Other+White+Meat · · Score: 5, Interesting

    Years ago I worked for a government IT department. A vendor wanted us to try out a product. The device plugs directly into the Internet connection, and monitors every packet, in real time, looking for strings matching an array of string that you provide. We ran queries against our internal databases, and compiled a list of SSNs and CCNs. The vendor programmed that data into their device, which from what I can tell used an FPGA to perform deep packet inspections.

    We expected that we might see maybe an email every week or two where someone accidentally sent that kind of information.

    First hit occurred 12 seconds after turning the device on.

    Second occurred .47 seconds later.

    Etc. Etc. Etc.

    Within an hour, we had overrun the quota on the network directory where we were logging this data.

    We found hundreds of separate systems that were transmitting this kind of data without authorization. We were planning a massive internal sweep to find and fix them all, when the following came down from management:

    Shut it down. Remove the device. Destroy all logs, emails, EVERYTHING. Offer the vendor a payment in return for signing an NDA. All employees required to sign secrecy docs (unenforceable at that level of govt, but still.)

    I believe this is how the acronym SNAFU came into existence.

    --

    --- Generation X: The first generation to have SIG lines inferior to their parents... ---
  5. Re:Basically, yeah by nobuddy · · Score: 5, Informative

    So... where do I know you from?

    You could have described my one and only firing ever, to the word.

    Me: "Boss, Beancounter- this backup system is broken and needs to be fixed. here is a cost breakdown for the fix and a loss analysis for failure to fix. It is genius and incorporates existing links and hardware to minimize cost and implement offsite backups for all sites!"
    Boss: "Shut up and go fix a printer somewhere."

    Fast forward a year- major crash of a POS server. Loss of customer records, $300,000 and 6 months predicted to be spend reconstructing the database from paper records.

    Boss: "You are fired for letting this happen."
    Me: "...."