Target's Internal Security Team Warned Management 236
david.emery writes "According to this story, Target's own internal computer security team raised concerns months before the retailer lost millions of credit card numbers in an attack. (Quoting a paywalled story in the Wall Street Journal.) Target's management allegedly 'brushed them off.' 'At least one analyst at the Minneapolis-based retailer wanted to do a more thorough security review of its payment system.' This raises a more general question for the Slashdot community: how many of you have identified vulnerabilities in your company's/client's systems, only to be 'brushed off?' If the company took no action, did they ultimately suffer a breach?"
Every single company (Score:5, Insightful)
There are security concerns in every company, without exception. Obviously, even the NSA itself had inadequate security!
Yes, many times security concerns are brought up, and brushed off. But this is not necessarily an indication of a problem. Every security risk must be weighed based on the likelihood of occurrence, and the severity of the impact, should it occur. Many of these calculations are inexact, and must be based on incomplete information.
Should Target have protected themselves better? Probably. But hindsight is 20/20. The difficult part is to anticipate the problems that might occur, without crippling your organization through impossibly tight security.
Re:Posting anonymously for obvious reasons... (Score:5, Insightful)
You do realize that making people change their passwords all the time simply leads to people using weaker passwords or writing them down, right? This type of policy though up by some self-proclaimed security expert amongst the IT monkeys almost always leads to worse security than not. And you don't even need to take my word for it:
The downside of changing passwords is that it makes them harder to remember. And if you force people to change their passwords regularly, they're more likely to choose easy-to-remember -- and easy-to-guess -- passwords than they are if they can use the same passwords for many years. So any password-changing policy needs to be chosen with that consideration in mind.
https://www.schneier.com/blog/... [schneier.com]
Re:Posting anonymously for obvious reasons... (Score:5, Insightful)
Interesting that you should mention "changing passwords on a regular basis" as a "horrible security flaw". Have you considered that changing passwords generally introduces more risk than it guards against, and doesn't actually have an effect on most actual hack attacks?
The attacker strikes with whatever credentials he finds, whenever he finds them. The second step of an attack is to create a separate back-door, so that if the first password is changed he's back in anyway. And how does an attacker find credentials? When someone's entering them, which includes changing them, or if someone's handling them. There is often a case when you have people who can't remember their newest recently cycled password who call the Help Desk. The phone drone resets it to something like "ForgottenPassword#1", then voicemails the chump with the temporary password. If a hacker's able to listen to their voicemail, he simply calls in a phony forgotten password request and it's Winner, Winner, Chicken Dinner!
So what does changing the password every 30 days actually protect against? I suppose if you wrote the password on your blog, then in 31 days you're safe. Of course, if you wrote the password on your blog, I don't think password rotation should be your highest priority for fixing your security issues. Do you honestly think hackers have machines that can crack passwords in 31 days, but not 30? Either he can crack it in an hour or less, or he likely can't crack it at all and won't bother trying.
Changing passwords periodically was only a good idea when there was one password shared by many people, and you had to exclude your former colleagues. But those days ended back with moats and longbowmen on the castle walls. In these modern days of electronic passwords that are never shared, it's a ritualistic holdover with negative consequences.
It's okay to write them down. (Score:4, Insightful)
As long as you keep them in your wallet then writing them down is fine.
You're MUCH more likely to be aware when someone steals your wallet than when someone steals your password. So keep your passwords in your wallet if you cannot remember them.
Similar for home systems. Keep them safe at home. Criminals breaking into your home to steal stuff are not USUALLY going to be looking for a piece of paper with your passwords on it.
Re:Posting anonymously for obvious reasons... (Score:2, Insightful)
Password rotation at least closes the hole of former employees still having access at some point in the future.
No. If former employees still have access, that means the network admin folks are incompetent or the off-boarding procedure is broken.
When an employee terminates, their account should be disabled. Problem solved.
There should never be any anonymous or independent accounts that can cause damage (e.g.,, an FTP box could have anonymous access if nothing confidential is kept there, but it should never be allowed write access).
Re:Posting anonymously for obvious reasons... (Score:5, Insightful)
Ditto here... once you make the employees know that their screw-ups will end up costing them, they tend to not screw up as much, and tend to report things much, much faster should something go awry.
That said, the Target penetration wasn't directly caused by a Target employee/user - the bad guys snuck in through a contractor that was given network access that they should have never had. This was more due to lazy architecture/vlan partitioning than it was $random_employee with a bad post-it note habit.
If anything, the network admins should be facing the barrel before anyone else, followed very closely by most of the security admins, if not simultaneously (excepting the guy who shouted the warning and those who demonstrably supported him; that dude should be promoted post-haste.)
Re:but when you work with HVAC vendors who sub wor (Score:5, Insightful)
*raises hand* ooh! ooh! Pick me! Pick me! Been there! Done that!
Two things:
1. It's not that they need access to the CORPORATE network. It's that they need access to the INTERNET so that the machinery can report back to the vendor when something starts to go wrong. That's usually in the service agreement. The sooner detected the sooner fixed without problem.
2. For managers who like to look at stuff. There is usually an internal web server on the HVAC. You go there and it displays things like the temp and the humidity and blah blah blah.
Thus, dumb managers (I've dealt with them) want them on the corporate network. It's easier for everyone.* Including the crackers who are looking for these exact vulnerabilities.
*Security people are not included in this definition of "everyone" in this case.
Re:Posting anonymously for obvious reasons... (Score:5, Insightful)
It's kinda backwards in a way. Retail is always a huge target, the bigger the company the bigger the score. From a security design viewpoint, the "backend" and the "financial" systems should have been physically separated at all times, using some encrypted EDI to exchange whatever (inventory, overstock, per piece price, etc). The credit card terminals should have been "payment only" and not loaded down with all their SHIT like "cash back?" "cure cancer?" "are you sure?" "join our rewards / store card" and wtf other messages I have to tap on your stupid touchscreen a million times just to pay you. Some of them even have ads on them.
Soon, Walgreens, CVS, Dollar whoever...the more sophisticated we make these terminals where our card touches their system, the more exploitable they will become. It's the slow feature creep, the "we need to upload new ad images at 2:50AM" by developers in a far-off land...pushed forward by managers who just want "shiney bright things" that make us give up even more information, waste our time more, and provide little real actual benefit.