Rethinking Security

~~There have been a number of news stories in recent months that highlight a pattern of computer and internet security issues that has slowly emerged as more and more companies rely on internet connections and networks to complete transactions and store customer data. Most of these problems were reported as a single flaw in one layer of security, but the more investigators probed the security breaches and their causes, the more they found that the problems existed in several layers of the security systems that were in place. Though there have been several stories of data being leaked, today we will focus on Target’s breach in network security.
By now, most people have heard of, or been a victim of, the Target point-of-sale breach which happened last November and December over the course of a month and a half in 2013. This breach harvested credit card information from Target’s point-of-sale card swipe machines at their brick and mortar stores and sent that information to hackers. Hackers did this by infecting their POS systems with malware. Though Target had anti-malware data leak prevention software installed on their systems, for some reason, the program did not catch the malware, thereby allowing it to infect Targets credit card machines. But there were more layers of security that were compromised that made it easier for the hackers to get into Target’s system. Investigators believe that the breach was first made through a third-party contractor – possibly maintenance staff – who had remote access to Target’s computer systems. These contractors probably had their own security issues that Target did not check into properly, and thus this third party contractor was more vulnerable to hacking, thus making Target more susceptible. There was no two-factor authentication system in place to make sure it was the third party company logging in and not imposters. Another layer of security that was compromised was the lack of proper segregation in Target’s networks. The third-party contractor, that investigators believe was the point of entry into Target’s systems by hackers, had access to heating and cooling systems, but that also gave the hackers access to the systems handling credit card payments. To make matters worse, Target was warned of these flaws in its security, and the warnings did not get to the right personnel who could have corrected the matter. The failure of communication resulted in a failure of another layer of their security.
It’s easy to see in hind-sight how the different layers of security failed to work together to prevent the infamous breach of Target’s credit card systems. Proper lines of communication and chain of command within the IT branch of Target in addition to proper vetting and over-sight given to third-party contractors, separating the less sensitive networks from the more sensitive credit card point-of-sale networks, and keeping malware up to date and working seamlessly with the other layers of security would have helped to prevent hackers from obtaining sensitive credit card information. TRA Consulting, Inc., in Long Beach can help your business avoid problems like Target’s by working with you to find security solutions for all your computer networks and systems. We can consult with you to help your business expand its layers of security and to make sure they are all working together seamlessly.