Now that the dust has cleared from the cyber attack and data breach on Target stores last year, it is time to reflect on what happened and ensure your organization is not susceptible to a similar breakdown in security.
How did Target’s data get compromised?
All the facts surrounding this attack have not been disclosed or verified, but it seems likely that two types of malware infected Target’s network. One type of malware was installed on POS terminals to steal payment card data and the second type of malware was used to exfiltrate data outside the breached network.
While analyzing the kill chain of this attack is useful, an important fact to consider is that Target’s malware detection software alerted their SOC to the infection, but apparently their security team did not respond to the alerts.
Target is a large organization with significant resources. This underscores the fact that successful security operations must rely on people, process and technology. Any one of these alone is insufficient.
Lessons Learned from Targets Data Breach
The lessons to be learned from the Target breach extend beyond retail to any organization with valuable data. We recommend the following:
- Point security products are important but they must be monitored 24×7
- Security teams should leverage to case management tools and track response to incidents
- Organizations must have the resources and skills to prioritize and investigate suspicious behavior
- Advanced correlation techniques are necessary to pinpoint complex multi-stage attacks
- Business context modeling and use cases should be used to highlight attacks on vulnerable assets
- Threat Intelligence data that identifies malicious IP sources and destinations plays an important role in identifying malware
- Predictive analytics and automated defense techniques are important tools to prevent attacks that could otherwise lead to data breaches
- Log retention and access to security logs is required for forensic analysis if a breach should occur
In conclusion, the lesson from the Target breach is security monitoring is not simple.
