Slashdot Mirror
Target Ignored Signs of Data Breach
puddingebola writes "Target ignored indications from its threat-detection tools that malware had infected its network. From the article, 'Unusually for a retailer, Target was even running its own security operations center in Minneapolis, according to a report published Thursday by Bloomberg Businessweek. Among its security defenses, following a months-long testing period and May 2013 implementation, was software from attack-detection firm FireEye, which caught the initial November 30 infection of Target's payment system by malware. All told, up to five "malware.binary" alarms reportedly sounded, each graded at the top of FireEye's criticality scale, and which were seen by Target's information security teams first in Bangalore, and then Minneapolis.' Unfortunately, it appears Target's security team failed to act on the threat indicators."
Sometimes you just can't fix stupid.
Honestly, how hard can be be to look after the source of executive pay?
A feeling of having made the same mistake before: Deja Foobar
In Target's defense, FireEye said it would have to restart the computer to remove the threats.
How can I believe you when you tell me what I don't want to hear?
...maybe they just had shitty email prioritization and crappy (read: default) alerting configs on their gear? Given that the typical admin in a large corp gets bombarded with a jillion emails daily (ranging from fluff to drop-dead serious, because vendors rarely know the difference), I can see warnings get buried in the pile pretty easily. Mind you this is not to excuse not acting on the warnings, but instead is posited as a way to explain why the warnings got missed in the first place.
All that said, any security admin who doesn't make alerting and prioritization thereof his first priority really shouldn't be employed as a security admin.
Quo usque tandem abutere, Nimbus, patientia nostra?
I'd wager there's about an 80% chance someone said the following:
"There's no way someone could have infected the POS systems; must be something wrong with this stupid FireEye thing..."
The victims of this breach wasn't Target. It was their customers. Why should they care?
How do you undo moderation when you are the first post? Who exactly were you moderating?
From TFA:
"With today's amount of detection data, just signaling an alarm isn't enough. The operator/analyst should be able to understand the risk as well as the recommendation of each incident, in order to be able to prioritize."
My experience is that companies skimp on the 7x24 NetworkOperationCenter personnel. Get cheap "eyes" on the logs and then hope that they are trained to recognize what is going on.....In most cases they just forward to someone else, and when you get the 15 false positive everybody relaxes and assumes the 16th is false as well...this is where the professionalism comes in.
Most likely FireEye farts out false alarms by the hundreds.
It isn't clear (at least to me) how many false alarms they got before they got the real one. The key to a good security monitoring system is not just to catch all the real threats, but to not flag imaginary or minor ones.
They had a target on their back.
In C++, your friends can see your privates.
This is breaking news!
Haha. Made you look! Just like the networks.
there security team was in Bangalore? As in India? They outsourced their security to the cheapest bidder and then they wondered why this happened? Outsourcing coming back to bite you in the ass yet? Will this entire post be questions?
Well it was a real knee slapper. /sarc
No, it was a real bowel slapper.
As we put more online we need to adjust laws to properly punish companies otherwise they'll continue not to care. Fine them something like 50% of their revenue (not profit) for the year of the incident and then they'll start to care.
If you read the article, they outsourced their IT to India. You get what you pay for.
In Canada, we have chip and pin and the customer doesn't pay. The banks may want to do that, but good luck.
Their alerts are the closest thing to security magic I have ever seen. Their false positive rate is astronomically low and they really do detect brand new malware.
On the FireEye system I use at work if it alerts we take action. Always. For URLs they sometimes get it wrong but we see 1 false positive a year with binaries. That's way beyond impressive when protecting tens of thousands of particularly gullible users, it's downright witchcraft. We often find another systems like URL filtering, IPS or endpoint protection prevented a true infection but we always do the homework when FireEye triggers. When you have real confidence the security threat is real doing legwork to confirm infection is easy.
For Target to have ignored FireEye's data borders on criminally negligent. It's really common to dig back through IPS logs once you know something was wrong and find a trove of data about the attack. FireEye is something else altogether; it's the most actionable security intelligence I have ever seen. It's truly astonishing technology since it's so effective. It captures binaries and URLs from the wire (IPS-style), email (SMTP MTA) and file shares and runs them in VMs. If enough malicious activity is detecting like deleting itself, changing registry keys, or contacting suspicious or blacklisted IPs (along with lots of other things) the binary is flagged in an alert. It's prefect for filling in the gaps left by traditional antivirus and the noise of intrusion prevention.
Why haven't they all been laid off, if their work will be ignored?
It is utterly amazing how many people find solace in the aspect of satisfying PCI guidelines particularly when that which makes the security industry being human makes security a moving target (on daily, not annual basis). Not to mention that with what the NSA did was render all the security upgrades everyone was forced to pay for worthless as the encryption was broken well before it was released to the market and packaged and put to work in new compiled libraries to run in payment card apps. I think its pretty safe to say that AES-256 is dead, RSA is dead, pc security is dead. Faced with a police state under which the value of our money is dictated on a whim and reinforced (at gunpoint) that it is actually worth something. Maybe we should trade marbles?
hmmm, so rather than direct the outrage at what incompetence could have ignored such warnings, how about someone ask the the question that really matters. How many times do those alarms actually go off, both for real live incidents and for false positives. That might tell you more about why the alarm was ignored.
its the first time my lazy ass bank changed my debit card number in a decade
The first time this story was posted a month ago, it was reported that Target's internal security team warned management months in advance that there was a huge problem.
Target's Internal Security Team Warned Management
So which is it?
Brought to you by Carl's Junior.
Then the few serious hacks are handled by the capable PHB, Management will barely hear about it, and wonder why 2 expensive PHB and a expensive intrusion system are used. After all, what information could really be hacked.
It is not like that target have to pay the victims. The risk is not at the correct party.