Target did not respond to FireEye security alerts prior to breach, according to report

Share this article:
Mozilla plugs nine vulnerabilities ranked "critical" in its web browser.
Target did not respond to FireEYe security alerts before its massive breach.

Target might have been a tad negligent when it came to observing its security systems last year, according to a Thursday Businessweek report.

Months before hackers stole 40 million payment cards, among heaps of other information, at the end of 2013, the retail giant installed a $1.6 million malware detection system from security company FireEye that later picked up on the attackers' suspicious activity – on multiple occasions.

Target seems to have done nothing about it.

Interviewing more than 10 former Target employees familiar with the company's security, and eight people with knowledge of the attack, Businessweek learned of an alert system that worked like a charm – or at least it was supposed to work.

When asked to explain Target's lack of a response to those alerts, a variation of a media statement was emailed to Businessweek from company CEO Gregg Steinhafel. It begins by explaining that Target had been certified as meeting payment card industry (PCI) standards, before explaining what Target has done since the breach.

In a Thursday email, Eric Chiu, president and co-founder HyTrust, told SCMagazine.com that not responding to these types of alarms is shocking, but not so surprising for a company that, at the time, had security fairly low on its list of priorities.

“We often see organizations ignoring alarms like this because they've become numb to them, receiving too many false positives, or because they're understaffed,” Chiu said. “You can have all the alarms you want, but unless you put security in a prominent position in the company and have enough staff to review them, those alarms don't mean anything.”

Joe Schumacher, security consultant for Neohapsis, offered other reasons to SCMagazine.com in a Thursday email.

“I don't think it is about not paying attention to the technologies as much as fine tuning for actionable, relevant information from the technology,” Schumacher said. “Many security systems (e.g. Web application firewall, log monitoring, Intrusion Detection/Prevention Systems, etc.) correlate large amounts of data into a single repository. Unfortunately, a lot of companies and professional services stop here.”

Share this article:

Sign up to our newsletters

More in News

Study shows how attackers make use of websites existing for less than 24 hours

Study shows how attackers make use of websites ...

Looking at the top 50 of parent domains that produced websites existing for less than 24 hours, researchers with Blue Coat Security Labs observed that 22 percent were malicious.

Phishing campaign lures victims with models' photos

Two nude models' photos reeled in unsuspecting victims who handed over their Facebook logins to gain access to adult material.

IBM projects 2014 bug disclosures may hit three-year low

IBM projects 2014 bug disclosures may hit three-year ...

The number of disclosed vulnerabilities is on track to fall below 8,000 this year, a first since 2011.