Slashdot Mirror
Target Ignored Signs of Data Breach
puddingebola writes "Target ignored indications from its threat-detection tools that malware had infected its network. From the article, 'Unusually for a retailer, Target was even running its own security operations center in Minneapolis, according to a report published Thursday by Bloomberg Businessweek. Among its security defenses, following a months-long testing period and May 2013 implementation, was software from attack-detection firm FireEye, which caught the initial November 30 infection of Target's payment system by malware. All told, up to five "malware.binary" alarms reportedly sounded, each graded at the top of FireEye's criticality scale, and which were seen by Target's information security teams first in Bangalore, and then Minneapolis.' Unfortunately, it appears Target's security team failed to act on the threat indicators."
Honestly, how hard can be be to look after the source of executive pay?
A feeling of having made the same mistake before: Deja Foobar
In Target's defense, FireEye said it would have to restart the computer to remove the threats.
How can I believe you when you tell me what I don't want to hear?
...maybe they just had shitty email prioritization and crappy (read: default) alerting configs on their gear? Given that the typical admin in a large corp gets bombarded with a jillion emails daily (ranging from fluff to drop-dead serious, because vendors rarely know the difference), I can see warnings get buried in the pile pretty easily. Mind you this is not to excuse not acting on the warnings, but instead is posited as a way to explain why the warnings got missed in the first place.
All that said, any security admin who doesn't make alerting and prioritization thereof his first priority really shouldn't be employed as a security admin.
Quo usque tandem abutere, Nimbus, patientia nostra?
I'd wager there's about an 80% chance someone said the following:
"There's no way someone could have infected the POS systems; must be something wrong with this stupid FireEye thing..."
How do you undo moderation when you are the first post? Who exactly were you moderating?
From TFA:
"With today's amount of detection data, just signaling an alarm isn't enough. The operator/analyst should be able to understand the risk as well as the recommendation of each incident, in order to be able to prioritize."
My experience is that companies skimp on the 7x24 NetworkOperationCenter personnel. Get cheap "eyes" on the logs and then hope that they are trained to recognize what is going on.....In most cases they just forward to someone else, and when you get the 15 false positive everybody relaxes and assumes the 16th is false as well...this is where the professionalism comes in.
It isn't clear (at least to me) how many false alarms they got before they got the real one. The key to a good security monitoring system is not just to catch all the real threats, but to not flag imaginary or minor ones.
They had a target on their back.
In C++, your friends can see your privates.
The customers who were liable for exactly $0 of fraudulent charges under US law?
Well it was a real knee slapper. /sarc
We don't know if outsourcing was an issue.
But, if it was it probably won't be fixed because outsourcing saved them money. It doesn't matter about the crappy service we are used to from Bangalore and the stupid idea (from a security perspective) of outsourcing any security. They saved money by outsourcing. They continue to save money. Even after any fines or expenses they are going to have to pay, it is still a money maker to outsource the labor. Customers be fucked.
The laws which shield consumers from this liability are actively being lobbied against by the banks.
The banks are trying to use chip and pin to shift this liability to their customers.
source: in the banking industry for 15 years.
As we put more online we need to adjust laws to properly punish companies otherwise they'll continue not to care. Fine them something like 50% of their revenue (not profit) for the year of the incident and then they'll start to care.
The world has moved on and left you behind. The most effective silicon validation team I know is in Bangalore. We employ people in Bangalore because they're good.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Their alerts are the closest thing to security magic I have ever seen. Their false positive rate is astronomically low and they really do detect brand new malware.
On the FireEye system I use at work if it alerts we take action. Always. For URLs they sometimes get it wrong but we see 1 false positive a year with binaries. That's way beyond impressive when protecting tens of thousands of particularly gullible users, it's downright witchcraft. We often find another systems like URL filtering, IPS or endpoint protection prevented a true infection but we always do the homework when FireEye triggers. When you have real confidence the security threat is real doing legwork to confirm infection is easy.
For Target to have ignored FireEye's data borders on criminally negligent. It's really common to dig back through IPS logs once you know something was wrong and find a trove of data about the attack. FireEye is something else altogether; it's the most actionable security intelligence I have ever seen. It's truly astonishing technology since it's so effective. It captures binaries and URLs from the wire (IPS-style), email (SMTP MTA) and file shares and runs them in VMs. If enough malicious activity is detecting like deleting itself, changing registry keys, or contacting suspicious or blacklisted IPs (along with lots of other things) the binary is flagged in an alert. It's prefect for filling in the gaps left by traditional antivirus and the noise of intrusion prevention.
Chip and pin is being forced by Visa and Mastercard not the banks.
I am becoming gerund, destroyer of verbs.
Probably pays market rate. Which I would imagine would be somewhat less, but not astonishingly so for a world-class (assuming he's correct) team anywhere in the world.
Sure, you start with the cheap outsourcing because it's cheap. I've done so for specific jobs, and sometimes I've also hired a specific contractor full time simply because they were great.
Aside from english skills and time zone differences, I honestly (as a small hiring manager) have not seen much difference in the quality of people from both markets. Yes, 80% of the available work force is trash. Most outsourcing companies are trash. That percentage is the same in the US, it's just you're paying a hell of a lot more for the trash.
The 20% who actually are worth working with, get paid pretty similar no matter where they are in the world because they are worth it, they know it, and they have options. I tell all my new hires that I could care less if they work from a plane, a beach, the middle of Africa - it's completely irrelevent. Just get the job done on time and intelligently.
Welcome to the Internet. If you didn't see the regional barriers going completely away for high-end tech work, you have to be blind or part of the 80%. In time, "virtual" skills (e.g. work that can be done via the internet) will be one of the most egalitarian markets for competition that has ever existed. Yes, this will mean far less overpaid idiots. That is a good thing.
It still amazes me that companies are willing to outsource or "right shore" their critical IT development and functions to third parties like this. Still, Target Management who have now been sent packing are ultimately held responsible, except of course the CEO and the Board who probably rubber stamped the deal because it could "save them money." At one time I held a senior position at a major transportation company and the first question during budget reviews with our CIO was "what are we going to outsource this year?" It wasn't about did it add value or add a capability we didn't already have, it was one of his initiatives that he received a bonus for meaning if he outsourced X% of what was considered "IT administration" he'd get his fat bonus.
There are a lot of competent IT outsourcing firms out there and they exist because IT isn't viewed as a value added function within a business like it used to be. Unfortunately with the competent ones there's a ton of incompetent ones. The real problem is the perception that it's just a few PCs and Servers in a closet and we don't change that much so why do we have all of this staff and budget. Therein lies the problem because the person responsible for that, the CIO, hasn't done his/her job of communicating effectively to their peers and the board about the role that IT plays in the organization. Sure, are there bloated IT organizations or functions that can be outsourced or eliminated? In most cases yes but that doesn't mean wholesale outsourcing is always called for or should be done at all. In this case Target fucked up and didn't have the proper management structure in place to address the problem when it was being pointed out to them.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
“As I hurtled through space, one thought kept crossing my mind - every part of this rocket was supplied by the lowest bidder.” - John Glenn
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It is utterly amazing how many people find solace in the aspect of satisfying PCI guidelines particularly when that which makes the security industry being human makes security a moving target (on daily, not annual basis). Not to mention that with what the NSA did was render all the security upgrades everyone was forced to pay for worthless as the encryption was broken well before it was released to the market and packaged and put to work in new compiled libraries to run in payment card apps. I think its pretty safe to say that AES-256 is dead, RSA is dead, pc security is dead. Faced with a police state under which the value of our money is dictated on a whim and reinforced (at gunpoint) that it is actually worth something. Maybe we should trade marbles?
its the first time my lazy ass bank changed my debit card number in a decade
The first time this story was posted a month ago, it was reported that Target's internal security team warned management months in advance that there was a huge problem.
Target's Internal Security Team Warned Management
So which is it?
Brought to you by Carl's Junior.
Then the few serious hacks are handled by the capable PHB, Management will barely hear about it, and wonder why 2 expensive PHB and a expensive intrusion system are used. After all, what information could really be hacked.
It is not like that target have to pay the victims. The risk is not at the correct party.
The article said that after Bangalore the alarms got handled in Minneapolis. Can't complain about rightshoring with that.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
No, I was commenting on the OP that blamed IT/India Outsourcing which you can't really blame on anybody except whoever had the responsibility of dealing with the problem. Rightshoring/Outsourcing doesn't obviate an organization from being responsible for the data but it can make the problem much worse if upper management think it's not their responsibility anymore.
Harrison's Postulate - "For every action there is an equal and opposite criticism"