Interesting facts about Target attack which confirm my theory that PCI compliance alone is unable to protect merchants from card data breaches.
Target was certified as meeting the standard for the payment card industry (PCI) in September 2013.
Company officials say its information security staff now numbers more than 300 people.
A three-year study by Verizon Enterprise Solutions (VZ) found that companies discover breaches through their own monitoring in only 31 percent of cases. For retailers, it’s 5 percent.
Poring over computer logs, Target found FireEye’s alerts from Nov. 30 and more from Dec. 2, when hackers installed yet another version of the malware. Not only should those alarms have been impossible to miss, they went off early enough that the hackers hadn’t begun transmitting the stolen card data out of Target’s network.
Even the company’s antivirus system, Symantec Endpoint Protection (SYMC), identified suspicious behavior over several days around Thanksgiving—pointing to the same server identified by the FireEye alerts.
the intruders had gained access to the system by using stolen credentials from a third-party vendor.
RSS Feed
