What Can IT Learn from the Target Breach?

With the Department of Justice investigating the credit and debit card security breach at Target, IT professionals are also digging deeper into learnable lessons from what industry watchers are calling the second largest breach in U.S. history.

We turned to James Lyne, global head of security research at Sophos, for his thoughts on the breach, which led to the theft of about 40 million credit and debit card accounts between Nov. 27 and Dec. 15. Only the TJX Cos. scam took a heavier toll on customers, impacting about 45.7 shoppers in 2005.

EUIt is claimed to be data stealing code on the terminals handling transactions though details are scarce,EU Lyne told us. EUThis means widespread deployment of malicious code across many terminals raising the question of how this made it through the build checks and whitelisting into TargetEUs standard. Even still, more details may come to light shortly but we should assume the worst.EU

Encryption 101

According to Lyne, loss of the track information from the credit cards is particularly nasty as it can allow for card cloning. That said, he continued, just the cardholderEUs name, card and security code has the potential for widespread online ordering fraud.

EUSuch sensitive information should always be encrypted, segmented and carefully secured,EU Lyne said. EUA loss of such a late stockpile of cards indicates poor architectural and business process practices -- though the full details of the root cause are not entirely known yet. Target is just another name to add to the list of financial data breaches this year, though this could be one of the largest yet.EU

LyneEUs conclusion: It is critical that organizations handling such data take steps to protect it -- such large volumes of data should never be accessible by one user or process -- should be encrypted to segment the data and should...

Comments are closed.