As a result of their major data breach late last year, Target has undergone a major house-cleaning to signify to the market just how seriously they are taking cyber security.
In the past few weeks, not only did Target make the controversial decision to replace their CEO, but they also announced the appointment of a new CIO and are continuing their search for a new CISO and CCO. In addition to leadership changes, the company revealed details about updates to their security strategy, which include (via BankInfoSecurity):
- Enhancing monitoring and logging, including implementation of additional rules, alerts, centralizing log feeds and enabling additional logging capabilities;
- Installing application whitelisting point-of-sale systems;
- Implementing enhanced segmentation, including the development of point-of-sale management tools, review and streamlining of network firewall rules and development of a comprehensive firewall governance process;
- Reviewing and limiting vendor access, including decommissioning vendor access to the server impacted in the breach and disabling select vendor access points, including FTP and telnet protocols;
- Enhancing security of accounts, including coordinating the reset of 445,000 Target team member and contractor passwords, broadening the use of two-factor authentication, disabling multiple vendor accounts, reducing privileges for certain accounts and developing additional training related to password rotation.
- Adopting chip-and-PIN techology in their branded credit and debit cards
But do these changes actually make Target more secure? Policies, procedures and technology are great (and are absolutely necessary), however, without assessing implementation and performance factors on an ongoing basis, there's no knowing whether or not specific strategic changes have actually improved an organization's security effectiveness.
