(LA Times (http://www.latimes.com/business/la-fi-target-security-chief-gm-20140611-story.html)) Target Corp. is hiring an IT expert from General Motors Co. to beef up its data security following a massive breach that continues to weigh on its reputation.
Brad Maiorino will head up technology risk and information strategy, a newly created position.
It's the latest move by Target to tighten security over its huge amount of shopper data. The Minneapolis company has increased monitoring of accounts and implemented new safeguards at its point-of-sale systems.
~~snip~~
Target, the nation’s third-largest retailer, has been struggling with the fallout from its disclosure in December that hackers stole credit and debit card information from tens of millions of customers.
Its revenue dropped 5% in the crucial fourth quarter and its chief executive, Gregg Steinhafel, stepped down last month. That followed the exit of Beth Jacob, the retailer's former chief information officer.
(Bloomberg Business (http://www.businessweek.com/articles/2014-03-13/target-missed-alarms-in-epic-hack-of-credit-card-data)) The biggest retail hack in U.S. history wasn’t particularly inventive, nor did it appear destined for success. In the days prior to Thanksgiving 2013, someone installed malware in Target’s (TGT) security and payments system designed to steal every credit card used at the company’s 1,797 U.S. stores. At the critical moment—when the Christmas gifts had been scanned and bagged and the cashier asked for a swipe—the malware would step in, capture the shopper’s credit card number, and store it on a Target server commandeered by the hackers.
It’s a measure of how common these crimes have become, and how conventional the hackers’ approach in this case, that Target was prepared for such an attack. Six months earlier the company began installing a $1.6 million malware detection tool made by the computer security firm FireEye (FEYE), whose customers also include the CIA and the Pentagon. Target had a team of security specialists in Bangalore to monitor its computers around the clock. If Bangalore noticed anything suspicious, Target’s security operations center in Minneapolis would be notified.
On Saturday, Nov. 30, the hackers had set their traps and had just one thing to do before starting the attack: plan the data’s escape route. As they uploaded exfiltration malware to move stolen credit card numbers—first to staging points spread around the U.S. to cover their tracks, then into their computers in Russia—FireEye spotted them. Bangalore got an alert and flagged the security team in Minneapolis. And then …
Nothing happened.
In testimony before Congress, Target has said that it was only after the U.S. Department of Justice notified the retailer about the breach in mid-December that company investigators went back to figure out what happened. What it hasn't publicly revealed: Poring over computer logs, Target found FireEye’s alerts from Nov. 30 and more from Dec. 2, when hackers installed yet another version of the malware. Not only should those alarms have been impossible to miss, they went off early enough that the hackers hadn’t begun transmitting the stolen card data out of Target’s network. Had the company’s security team responded when it was supposed to, the theft that has since engulfed Target, touched as many as one in three American consumers, and led to an international manhunt for the hackers never would have happened at all.
Target had a team of security specialists in Bangalore to monitor its computers around the clock.