Revisiting a major 2013 event.

Target Corporation Data Breach occurred in December, 2013. Attackers breached Target Corporation and retrieved an estimated 70 million pieces of personally identifiable information. The identity of the attackers remains unknown. The tactics, techniques, and procedures of the attackers were fairly generic, resulting in their activity being difficult to trace and identify. The tools they may have used were not necessarily malicious and rather seem to have been generic IT tools.

Attackers used stolen HVAC credentials, most likely though the use of a simple phishing scam, to gain initial access into the system. After making their way into web services via these credentials, malware was applied onto Target’s servers based in Massachusetts. The malware then simply implemented an SMB protocol to periodically retrieve pertinent data from the network.

While headlines at the time of the event made the situation look dire, the overall loss or impact to Target was very minimal from a long term point of view. Target actually reported increased revenue for the year of 2013, while reporting a 34.3% reduction in profit for the year. Stock prices initially dropped 10% after the leak, but recovered within two months to regular levels. Investors for the time being appear to have taken the stance that major outlets are universally prone to having private data successfully breached, which explains the Target Corporation's steadfastness.

Following these leaks, the Target Corporation was subject to two class action lawsuits, settled for 10 million and 18.5 million dollars US respectively. These numbers are trivial when compared to company’s current 69.5 billion annual revenue and over 20 billion dollars in gross profit.

In response to another American department store chain data leak, a data leak from J. C. Penney Company Inc., the Target Corporation and other retailers alike universally invested in better security measures. This increased investment didn’t appear to serve as a successful deterrent against Target being compromised. This seems to indicate that, while investment is necessary, it will be some time before security standards are able to successfully withstand the constantly mounting threat that exists.

Organizations can certainly learn from Target’s experience, starting with a few recommendations based on what experts have been able to gather from their breach. Firstly, organizations need to be fully invested in PCI-Compliance, not only to meet mandatory standards, but to stay well ahead of them; investing in PCI-compliance will directly reduce the risk of debit and credit card loss. Secondly, ensuring chip readers are enabled at all cash registers in all locations is crucial. This relatively modern security standard effectively renders malicious and widespread RFID scanners useless. Thirdly, programs running in our point-of-sale systems should be authorized only by a strict whitelist, thus disabling any potential malicious software. Fourthly, organizations need to eliminate any excessive reliance it has on outbound communications for C&C channels. While organizations could implement more efforts to monitor these communications, these actions would likely be futile, as was demonstrated in Target’s case. Distributing data, communications, and traffic across a larger number of smaller subsystems will likely cut an organization’s losses in the event of an attack. As our final recommendation, organizations should be willing to participate in information sharing agencies as a countermeasure against threats as they arise.

Common Vulnerabilities and Exposures, commonly known as CVEs, are recorded information and security issues that aim to create an easily accessible list of security threats for professionals. It's sponsored by the United States Department of Homeland Security, with the intent of beign readily available for security administrators who need information about specific security threats.

Assembling all of this information into one, trustworthy, organized place does a tremendous service to security experts, making the task of solving most security issues much less burdensome. CVE defines a vulnerability as "a mistake in software code that provides an attack with direct access to a system or network." Vulnerabilities create the possibility for an attacker to illegitimately gain access to a given system. Successful implementation of these vulnerabilities could result in damaged equipment, unwanted access privileges, or tampered data. The potential implications of this, depending on the targeted system, include damaged customer trust, financial loss, even loss of life.

Works Cited

• Target. “A Message from CEO Gregg Steinhafel about Target's Payment Card Issues.” A Bullseye View, Target, 20 Dec. 2013, corporate.target.com/article/2013/12/target-ceo-gregg-steinhafel-message.
• Krebs, Brian. “Cards Stolen in Target Breach Flood Underground Markets.” Krebs on Security, 20 Dec. 2013, krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/.
• Krebs, Brian. “Sources: Target Investigating Data Breach.” Krebs on Security, 18 Dec. 2013, krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/.
• Kvochko, Elena, and Rajiv Pant. “Why Data Breaches Don't Hurt Stock Prices.” Harvard Business Review, Harvard Business Review, 31 Mar. 2015, hbr.org/2015/03/why-data-breaches-dont-hurt-stock-prices.
• Lennon, Mike. “Target Confirms Point-of-Sale Maleware Was Used in Attack.” Security Week, 13 Jan. 2014, www.securityweek.com/target-confirms-point-sale-malware-was-used-attack.
• Lin, Philippe. “Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems.” Trend Micro - TrendLabs Security Intelligence Blog, 13 July 2015, blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-systems/.
• McCoy, Kevin. “Target to pay $18.5M for 2013 data breach that affected 41 million consumers.” USA Today, 23 May 2017, www.usatoday.com/story/money/2017/05/23/target-pay-185m-2013-data-breach-affected-consumers/102063932/.
• McGrath, Maggie. “Target Profit Falls 46% On Credit Card Breach And The Hits Could Keep on Coming.” Forbes - Investing, Forbes, 26 Feb. 2014, www.forbes.com/forbes/welcome/?toURL=https://www.forbes.com/sites/maggiemcgrath/2014/02/26/target-profit-falls-46-on-credit-card-breach-and-says-the-hits-could-keep-on-coming/&refURL=&referrer=#78fe56737326.
• McGregor, Jena. “Target CEO opens up about data breach.” The Washington Post, 13 Jan. 2014, www.washingtonpost.com/news/on-leadership/wp/2014/01/13/target-ceo-opens-up-about-data-breach/?utm_term=.37ba2c32e0b2.
• Pagliery, Jose. “Welcome to the Age of Hacks.” CNN, CNNMoney, 4 Sept. 2014, money.cnn.com/2014/09/04/technology/security/age-of-the-hack/?iid=EL.
• Riley, Charles, and Jose Pagliery. “Target will pay hack victims $10 million.” CNN, CNNMoney, 19 Mar. 2015, money.cnn.com/2015/03/19/technology/security/target-data-hack-settlement/index.html.
• Schwartz, Mathew J. “Target Breach: Phishing Attack Implicated.” Dark Reading, InformationWeek IT Network, 13 Feb. 2014, www.darkreading.com/attacks-and-breaches/target-breach-phishing-attack-implicated/d/d-id/1113829.
• Target. “Target Confirms Unauthorized Access to Payment Card Data in U.S. Stores.” A Bullseye View, Target, 19 Dec. 2013, corporate.target.com/press/releases/2013/12/target-confirms-unauthorized-access-to-payment-car.
• “Target stores hit by data breach affecting 40 million cards.” Edited by The Associated Press, CBC, Canadian Broadcasting Corporation, 19 Dec. 2013, www.cbc.ca/news/world/target-stores-hit-by-data-breach-affecting-40-million-cards-1.2469895.
• Aorato Labs. “The Untold Story of the Target Attack Step by Step.” Around Cyber, Aorato Labs, Aug. 2014, aroundcyber.files.wordpress.com/2014/09/aorato-target-report.pdf.

‍