Four lessons retailers should have learned from the Target security breach

Netwrix recommends best practices for retailers to maintain security during holiday shopping season

Irvine, CA, November 25, 2014

The Target security breach last year compromised approximately 40 million credit and debit card accounts. This ultimately caused the resignation of Target’s CIO and two months later Target’s CEO had to leave the company. This was one of the largest in the wave of massive breaches hitting retail and restaurant chains which also included The Home Depot and Dairy Queen. These security incidents have resulted in costly fines and extensive damages to brand reputations, forcing the IT community to focus closer attention to sensitive data security.

As the holiday sales season approaches, Netwrix, the #1 provider of change and configuration auditing software, outlines the key steps retail companies should take to ensure that customers’ sensitive data is protected:

• Enable complete visibility into all IT systems. Security procedures effectiveness is mostly rooted in ensuring that all IT systems are under complete control. Security policies should always include auditing of the entire IT infrastructure, enabling data protection on different levels. Even if a culprit gets a chance to penetrate into IT infrastructure, complete visibility will allow the detection of suspicious activity in the shortest time possible.
• Implement rigorous access control and monitoring of users’ activity. Continuous monitoring of user accounts, with a closer look on user access rights, creation and removal of user accounts and suspicious user activity, are necessary components to security policy established for cardholder’s data protection. Auditing access and changes to the IT systems will expose any critical activity or unauthorized access to the data across IT infrastructure.
• Educate and train employees. The success or failure of security policy is often in the hands of a company’s employees. In order to provide the necessary level of competence, develop detailed instructions and documentation, organize awareness trainings for employees, and explain their actions in case of emergency and their level of responsibility when dealing with sensitive data.
• Invest in security solutions responsibly. It is known that the malware detection system deployed by Target spotted suspicious activity and informed the company about the intrusion. However, Target overlooked this warning among high volume of alerts and took no action. The noteworthy lesson for IT departments is to implement monitoring solutions that allow reduction of noise-to-signal ratio by providing comprehensive and actionable events that can be crosschecked with alerts generated by IDS, SIEM (or similar) systems. This practice will ensure a quick detection of security incidents and simplify root-cause analysis, thus eliminating devastating consequences of a security violation.

"During the holiday season, especially Black Friday, retailers become the main target for security attacks that can compromise the personal and financial information of millions of people. It is always important to stay one jump ahead of cyber thieves and ensure that sensitive data is well-protected," said Michael Fimin, CEO and co-founder of Netwrix. "Having complete visibility across the entire IT infrastructure can help to understand what is happening in your IT systems and mitigate risks of insider threats. And, in case security breach occurs, complete visibility will allow you to quickly detect violation and simplify root-cause analysis."

About Netwrix Corporation

Netwrix Corporation, the #1 provider of change and configuration auditing solutions, delivers complete visibility into who did what, when and where across the entire IT infrastructure. This streamlines compliance, strengthens security, and simplifies root cause analysis. Founded in 2006, Netwrix is ranked in the Inc. 5000 list and Deloitte Technology Fast 500 list. Netwrix software is used by 160,000 users worldwide.

Social networks:

Netwrix blog
Twitter
LinkedIn
YouTube
Spiceworks
Facebook

Media contact:

Erin Jones
E.S. Jones Public Relations
Phone: 704.664.2170

Contact us:

Your questions and feedback are always welcome. Please dial our toll-free number, 888-638-9749, or enter your question details here and we will reply as soon as possible.