The Target breach proved once again that in security, technology is the easy part.
I've been fascinated by the information that keeps coming out about last December's Target data breach. Recent revelations by some of the people who studied the actual malware code have described it as "absolutely unsophisticated and uninteresting -- almost amateurish." Others noted anti-malware software is available that could easily have stopped this attack before any damage was done.
Too bad Target didn't have it, right? But it did! Six months before the attack, Target had installed and tested software from FireEye (which the CIA also uses to protect its networks). In fact, Target had put in place 24-hour monitoring of the system to alert the monitoring team, who in turn would notify Target's Security Operations Center (SOC) in Minnesota.
So what happened? The alarm was raised, the monitors notified the SOC, and the SOC ... did nothing!
The FireEye software also has an option to automatically remove malware when it's detected. According to various reports, Target's security team had turned off that option. Is it any wonder that Target's CIO fell on her sword and resigned in the aftermath of this debacle?
For those of us not directly affected by the breach, the scenario as it played out is just one more example illustrating what I've tried to instill in my audiences for more than a decade: Technology is easy; it's people that are hard.
Dave Kearns is a senior analyst for Kuppinger-Cole, Europe's leading analyst company for identity-focused information security and networking. His columns and books have provided a thorough grounding in the basic philosophies of directory technology, networking, and identity ... View Full Bio
We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
2017 State of IT ReportIn today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.