Information Security

Information Assurance

Chaston Carter

04/17/17

Target Corporation

Target has had many ethical challenges over the years but one of the biggest ones they have encountered was the a credit and debit card data breach thought to have exceed ed $700 million which was the biggest retail hacking in U.S. history to date. While this is serious, what is even more serious is that Target had clear warning signs that hacking was occurring, but due to the lack of action the hacking continued within the organization. It was estimated that close to 70 million people had their personal data stolen. That information consisted of names, mailing addresses, phone numbers and email addresses. Not only was it personal information shared , but a-lot of people encountered unauthorized, charges on their credit card or debit card. The organization was shocked at the amount of people that were affected by this recent attack.

I had only 10 days to implement changes to its security policies, to prevent this from happening again. The ultimate goal was to come up with quick solutions to solve this problem. My first goal was to develop a written information security program, which would ultimately document potential security risk. Since the confidentiality of the customers information is a important key factor. The goal of the whole credit breach is to prevent customers information from getting stolen . We can start by eliminating the problem, by offering security training to current workers, this would not only educate them but they would learn the importance of safeguarding personal information , and it will allow them to learn when to be alert to potential threats. To insure integrity in the organization a system must be put in place to detect any changes in data that might cause the server to crash when making a purchase, or interfere when a customers makes a purchase at a target store.

To Ensure Availability in Target Corporation , we would maintain all certain possible customers information, to prevent any data from being lost, data could be store in a isolated protected location. One of the main issues with the credit cards hacked in the breach was that when the cards were swiped the magnetic strip on the back contained unchanging data. Whoever accessed the data got ahold of information necessary to make purchases. Which eventually made traditional cards prime targets for counterfeiters. The problem with Target corporation is that they had no real structure on how to be alerted when there was suspicious activity in a customers account. The main objective for this information assurance plan is to develop an alerting system that will alert a middle man when there is suspicious, or unusual activity in a customers account.

Even Though , target already had current policies in place, six months prior to hackers

getting into their security system . They had began a $1.6 million malware detection tool

they purchased from a computer security firm called FireEye. Even with this billion dollar

infrastructure, which was much more extensive than other retailers. It still couldn't do much

for the company because, target failed to act upon their finding in the new security system.

Hackers were eventually able to infiltrate Target’s network by using an HVAC. When

they gained access, they installed a pair of malware programs. They then sent malware

designed to steal credit card numbers to cashier stations in every domestic Target store.

November 30, 2013, FireEye was alerted to the presence of the malware. Target’s security

teams in Bangalore were immediately notified of the potential breach. FireEye had the ability

to automatically disable the malware, but Target had turned this feature off. By target turning

the feature off, they no longer had any way of being alerted so FireEye also alerted Target on

December 2 after hackers released a new version of malware. (Adkins, 2014)

Based on the evaluation, the best approach to targets security system . Is to come up with a security system that alerts the user immediately giving the middle man the opportunity to find a quick solution to the breach and putting a stop to it right away. There are several key leaders since confidentiality is a important factor , it is essential to have designated a security officer who would be responsible for coordinating and executing the program that would protect customers information . This security officer would also report to someone outside of the organization to make sure everything is secure and in line. The officer would also offer classes to current employees , by teaching them how to detect a potential threats to the organization.

Thats why it is important develop a risk assessment team who would manage the security program. This team would be one the most important key factors to the organization because they would identify the risk and would ultimately decide on the appropriate, most cost effective ways to manage them. The main objective would be to minimize potential threats , but not eliminate them . To insure integrity in the organization and to prevent data integrity failure an alerting system would be put into place. This system will be designed to detect potential threats, and give the risk assessment team options on how to get rid of the threats.

Target already has had a bad reputation with immediate response to the breaches. They also claimed that it had suffered a data breach despite its best efforts, but it was later revealed that it had been alerted more than once about breaches. It was said Target also waited six days after it was informed to tell consumers about the hacking attack, and about a month before it revealed the extent of it. More than 90 lawsuits have been filed against Target by both customers and banks, and Target's profit during the holiday shopping period dropped 46 percent from the previous year.

Since a lot of customers were left out of the loop, target came up with the solution of

sending customers emails with general security tips and were offered with one year of free

credit monitoring and identity theft protection. Additionally, The CEO assured customers

that they would not be held liable for any fraudulent charges made to their credit cards as a

result of the hack. Customers were offered 10 percent off in-store purchases following the

data breach.

The best solution thus far was Target announcing that it would begin to release credit and debit cards with chips instead of magnetic strips on the back of the cards by 2015. They had invested over $100 million in registers and technology that will be able to read the new chip cards.

As result of the breach Target lost a huge percentage of customers and CEO Gregg Steinhafel also stepped down. As a result a statement of policy had to be put in place to outline the incident response protocols, disaster response protocols, access control protocols, and maintenance plan, which will serve as controls and guidelines to address instances of unauthorized access to Targets information and also as response to disastrous events or conditions that might adversely impact operations at Target.

Incidence Response Protocols have become integral part of information technology and they are used for detecting and handling incidents, minimizing loss and destruction, mitigating weaknesses and restoring IT services (Cichonski et.al, 2012). The incident response process has several phases which includes preparation, detection & analysis, containment, eradication and recovery and post incident activities (Cichonski et.al, 2012).

The preparation phase attempts to limit or prevent the number of security incidence that might occur by selecting controls such as regular risk assessments, host security, network security, malware prevention, and implementing user awareness training etc. that will effectively reduce the number of incidence occurring (Cichonski et.al, 2012).

Detection and analysis phase uses precursors and indicators to monitor and analyze attack vectors such as external media, attrition, web, email, impersonation, improper usage or unauthorized accesses etc. that can be used to propagate attacks against an organization. Some of the precursors that have been put in place at Target includes:

Intrusion Detection and Prevention systems to identify and log suspicious events, alert the necessary response team and take automated mitigative actions;

Security information and event management (SIEM) products to generate alerts based on the analysis of log data;

Antivirus and Anti-malware softwares to detect and prevent attacks from infecting the systems;

File integrity checker to detect changes to important files during attack incidents, and

Awareness programs for both internal and external users to keep them abreast of the latest attack incidents and to create a reporting route after anomalies have been identified (Cichonski et.al., 2012).

The Containment, Eradication and Recovery phase is used to manage incident attacks before they overwhelm the system and result into more fatal damages, using predetermined procedures such as disabling system functions or shutting down the systems and disconnecting them from the network to mitigate the effects of any attack (Cichonski et.al, 2012).

Finally the post incident activity phase is used by the organization or response team to reflect on the new threats and use lessons learned to improve on incident response plan (Cichonski et.al, 2012).Within Target, the incident response plan created will be used in responding to a variety of potential threats such as:

Unauthorized access or unauthorized privilege escalation and data breaches,

Denial or Distributed Denial of Service Attacks,

Firewall Breaches,

Viruses and malware outbursts,

Theft or physical loss of equipment, and

Insider Threats (Rouse, 2014).

To mitigate these issues, some of the recommended actions that have been put in place at Target include the following:

Incident Type	Kill Chain Stage	Priority Level	Recommended Action
Unauthorized Access	Exploitation & Installation	High	Detect, monitor and investigate unauthorized access attempts with priority on those that mission critical or contain sensitive data.
Unauthorized Privilege Escalation	Exploitation & Installation	High	Critical systems are configured to record all privileged escalation events and set alarms for unauthorized privilege escalation attempts.
Data Breach	System Compromise	High	During a data breach, all evidence is captured carefully and evidentiary data is collected. Alarms are set to alert system and administrators and emergency system shut down and data recovery steps is initiated. All critical documents or data are backed up on a different system.
Denial or Distributed Denial of Service Attacks	Exploitation & Installation	High	An IPS is implemented to monitor, detect and automatically terminate all traffic patterns that steps out of the normal behavior of the system.
Viruses or Malware	Delivery & Attack	Low	Remediate any malware infections as quickly as possible. The rest of the network needs to scanned to ensure no further compromise were associated with the outbreak.
Insider Breach	System Compromise	High	User accounts are routinely monitored using system log events and security information and event management products that can generate alerts based on the analysis of log files
Theft of Physical Loss	System Compromise	High	Whole disk encryption is used to protect all laptops and mobile devices. Lockout screen or remote wiping is lost or stolen equipment is used to remotely remove all critical data on stolen or lost equipment.
Firewall Breaches	System Compromise	High	Technology additions and updates are used to evaluate firewall settings and adjust them as needed in order to minimize the impact on business. Firewall rules are regularly reviewed and actively updated to protect against the latest security threats and dedicated and ongoing monitoring practices are employed to maximize system uptime while actively defending network and connected network devices.

Justification of Incident Response protocol

Since it is really difficult to assume the path that an attacker will take to infiltrate the network, target decided to create their incidence response plan through the cyber kill chain sequence (Malik, 2016). The cyber kill chain sequence is the stages required for an attacker to successfully infiltrate a network and exfiltrate data from it. The cyber kill chain involves the following stages:

Reconnaissance and Probing - This is the stage when the attacker is probing the network to exploit any vulnerability or opportunities that may present in the system (Malik, 2016).

Delivery and Attack – Once a vulnerability has been established, then a delivery mechanism (attack mechanism) is put in place to deliver the attacks or social engineering is employed to induce the target (Malik, 2016).

Exploitation and Installation – This is the stage after the attacker have found the vulnerability to the system. They proceed to exploit those vulnerability in order to acquire access to the system and once access has been granted, they proceed to elevate their user privileges in order to elevate the access or even install persistence payload (Malik, 2016).

System Compromise - At the stage, high value data is been exflitrated as quickly as possible (Malik, 2016).

Designing an incidence response plan or protocol around these different stages will allow Target to understand the threats being faced in their network environment, the steps an attacker can used to exploits such threats and take steps to adequately prevent or mitigate the effects of any of such security threats.

In the Disaster response protocols are other critical components of computer security operations that ensure the continuation of vital business processes in the event that a disaster occurs (Martin, 2002). At Target, the disaster response and recovery protocols was not only focused on the physical infrastructure, back up and restoration systems but was expanded to include other critical components such as perimeter defenses, IDS network, threat evaluation and assessment, virus protections, patches and host configurations and vulnerability surveillance (Velliquette, 2005). Paying proper attention all these aspects is very critical to addressing computer security within disaster recovery planning to ensure the most efficient and successful recovery operations (Velliquette, 2005). Some of the major components that was developed into the disaster response protocols at Target includes:

Crisis Management Plan: This was a plan designed to ensure continuation of vital business processes in case of an emergency (Martin, 2002). This plan was developed to provide information, procedures, responsibilities and checklists that will enhance an organized and effective system of handling situations during a crisis occurrence (Martin, 2002).

Alternate Recovery Site: To ensure that IT services and recovery time matches the business recovery time objective, Target implemented a back-up site at an alternate location, where all data infrastructure is configured to run similar hardware and software applications to ensure that regular operations can be restored at the shortest time possible in the case of a disaster occurrence (Velliquette, 2005).

Regular Data Backup: Target also implemented a scheduled hardware and software backup and periodically validates that critical systems, applications and data are accurately backed up in a standard hardware in order to be able to easily replicate a new hardware in the case of a disaster.

Perimeter Defenses: Perimeter defenses such as firewall and VPN management are important aspects of Target disaster recovery plan because they assist in monitoring traffic during a recovery process and also ensuring a safe connection for users and clients to the alternate network in order to get the operation back online and reduce downtime (Velliquette, 2005).

Intrusion Prevention and Protection: This is another component that been built into the recovery plan to ensure that during the recovery process, proper configuration is established to keep virus definition files current and to ensure new threat and vulnerability are detected and prevented to improve the fortification process in order to reduce system downtime and return the system back to normal operations (Velliquette, 2005).

Justification of Disaster Response Protocol

The primary goal of Target is to get critical infrastructure, networks and systems back up and running as quickly as possible in order to minimize the potential long term impact on the business. Having a crisis management plan is highly important to coordinate the recovery effort in a systematic way that enables the disaster response team to make quick and effective decisions that will limit the impact of such disaster or crisis. Not having this type of systematic plan might cause ineffective decisions to be made and in turn cause an increase in disruption time, which can be very detrimental not only to the business but also to customers, stakeholders and investors alike (Velliquette, 2005). The presence of an alternate recovery site, an emergency response location and backup data are instrumental to the strategic and tactical implementation of the recovery procedures, without which the recovery process is impossible. Also implementing perimeter defenses, intrusion prevention system and virus protection during the recovery process will ensure that new threats that could impede the recovery process do not arise and increase the magnitude of the already bad situation (Martin, 2005). The survivability of any organization after a disaster is dependent on the premise of a successful continence planning, which would determine how effective an organization would responds to mitigate the business impacts of such disaster (Martin, 2005).

Access Control Protocols

Security challenges faced at Target due to data breaches caused the management to implement network access control protocols that will provide endpoint assessment, authentication and authorization of entities trying to gain access to their network, while also limiting the privileges of user assigned roles. First, Target decided to implement smart cards for employees, which digital certificate and underlying password associated with individual users. The smart cards provided authentication and authorization used by employees and users to gain secure access to the organization’s network (Boscolo, 2008). It also formed the basis of accountability for users in ensuring that their smart card are used in accordance to the organization’s acceptable use policy and cannot be shared with any other users (Boscolo, 2008).

Target also implemented the Role Based Access Control List, which grants permissions to users based on assigned roles rather than granting permission to actual users. Users can only inherit certain permissions or privileges based on the role they have been assigned to (Conklin & White, 2015). The least privilege security approach was also implemented to grant the least necessary permission and privileges that will enable users to perform their daily tasks according to their assigned roles (Conklin & White, 2015).

Finally, the company also implemented separation of duties with the different departments. This concept ensures that tasks are broken down into several duties to be performed by different individuals, in order to limit the probability of an employee exploiting the organization system for their personal gains (Conklin & White, 2015).

Justification of Access Control Protocols

Target decided to utilize smart cards, because it satisfies two factor authentication, which was more secure than a one factor authentication process such as passwords. Even though it cost more in terms of infrastructure to support it, two factor authentication provided two step verification process, which makes data breaches twice as hard for an external intruder, because not only do they need to have physical control of the smart card but they will also need to have the pin number associated to that card before they can be granted access to the organization’s network (Conklin & White, 2015). The smart card also created accountability measures, which makes the owner of the card responsible for it usage on the network. It also provided non repudiation, which means that a user cannot deny to certain information as long as their digital signatures was associated with the retrieval or access of such information. In order words, it provided easy tracking of user and employee activity across the network. Finally it improves integrity of information because users can use embedded digital signatures / private keys to encrypt files and emails before transmission and also makes it easy for other members of organization to easily decrypt such files or information using the corresponding public keys (Conklin & White, 2015).

Target also decided to utilize role based access control list because of the flexibility it create of granting and revoking user access based on specified roles within the organization. Users can be granted permissions to objects in terms of the specific duties they must perform and not according to a security classification associated to the individual objects (Rouse, 2012).

Finally implementing separation of duties helps Target manage conflict of interest and fraud, by restricting power held by any one individual. This provides checks and balances and also limits the harm that can be caused by one single individual and reduces the organization’s exposure to damage (Conklin & White, 2015).

Maintaining Information Assurance Plan

Target understands that maintaining this information assurance plan will involve every member of the organization and also require a day to day monitoring, so it is stays effective and relevant in improving their network security. Therefore management created some critical steps and programs that will enforce daily maintenance and continuous implementation of the plan.

Security Awareness Programs: Target management decided to implement monthly security meetings to talk about security policies, risks and incidents assessments performed for the organization. The awareness program serves as a monthly refresher to the daily security risks facing the organization as well as creating continous awareness for relevant security incidents that has occurred within their organization or industry (Kadam, 2002).

Monitor and Review Security Performance: Since the implementation of an information assurance policy is not a one-time event, target created controls to monitor and review performance of the plan, to ensure that it is still serving the purpose for which it was created (Kadam, 2002).

Quarterly Audits: Target IT department also set up quarterly audits with an external auditor to review the various performance controls in place, gather performance results, document all non-conformities that will require corrective actions and identify new threats (Kadam, 2002).

Management Review: This review meetings will be conducted to revisit issues, analyze audit reports and take decisive actions, whether to keep the information assurance plan as is or to recommend improvements in order to accommodate the newly identified threats (Kadam, 2002).

Justification of Maintenance Plan

The importance of these maintenance steps is that they help to periodically access risks, identify new risks, and measure effectiveness of the program. Periodic audits are important because they serve as compliance controls that help the organization to monitor compliance to the plan. They also help access new risks, which gives the management the most updated information concerning risk facing their organization, and helps determine proper corrective actions to taken in order to ensure the most adequate security controls are implemented.

Awareness training programs are also critical to keep users and employees abreast of the latest security information that will ensure conformance or unanimous compliance to the most updated security controls (Garbars, 2002). When users are unaware of the latest threats, then they cannot protect themselves nor the organization from such threats and damages that will ensue afterwards.

Monitoring the effectiveness of the information assurance plan is also critical to the safety and security of the organization. After plan has been created and implemented, it is important to monitor and review the security performance of the plan in order to analyze its effectiveness in improving the security posture of the organization (Garbars, 2002).

Overall this assurance plan , will be put in place to protect Targets data breach from happening again, and will be the overall shield and plan target needs to protect the company from ever being in such a bad situation again. With Awareness training programs , bringing awareness to employees will be the most important key factor.

References:

Kossman, S. (2016, xxsssdddFebruary 02). 8 FAQs about EMV credit cards. Retrieved April 21, 2017, from http://www.creditcards.com/credit-card-news/emv-faq-chip-cards-answers-1264.php

Initiative, Daniels Fund Ethics, University Of New Mexico, and Http://danielsethics.mgt.unm.edu. Target: Putting Customers First? (n.d.): n. pag. Web.

Boscolo, C. (2008). How to Implement Network Access Control. Retrieved from

http://www.computerweekly.com/opinion/How-to-implement-network-access-control

Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer Security Incident Handling Guide. NIST Special Publication Vol 800, pp. 61

Conklin, W. & White, G. (2015). All-in-one CompTIA Security+ Exam Guide. Fourth Ed.

(Exam SYO-401). San Francisco: McGraw Hill.

Garbars, K. (2002). Implementing an Effective IT Security Program. Retrieved from

https://www.sans.org/reading-room/whitepapers/bestprac/implementing-effective-security-program-80

Kadam, A. (2002). Implementation Methodology for Information Security Management System.

Retrieved from https://www.giac.org/paper/gsec/2693/implementation-methodology-information-security-management-system-to-comply-bs-7799-requi/104600

Martin, B. C. (2002). Disaster Recovery Plan Strategies and Processes. Retrieved from

https://www.sans.org/reading-room/whitepapers/recovery/disaster-recovery-plan-strategies-processes-564

Rouse, M. (2012). Role Based Access Control (RBAC). Retrieved from

http://searchsecurity.techtarget.com/definition/role-based-access-control-RBAC

Rouse, M. (2014). Incidence Response Plan (IRP). Retrieved from

http://searchsecurity.techtarget.com/definition/incident-response-plan-IRP

Velliquette, D. (2005). Computer Security Considerations in Disaster Recovery Planning. Retrieved from http://www.sans.org/reading-room/whitepapers/recovery/computer- security-considerations-disaster-recvery-planning-1512.