{"id":42415,"date":"2014-03-14T06:30:25","date_gmt":"2014-03-14T11:30:25","guid":{"rendered":"http:\/\/www.shotinthedark.info\/wp\/?p=42415"},"modified":"2014-03-14T06:54:48","modified_gmt":"2014-03-14T11:54:48","slug":"no-surprise","status":"publish","type":"post","link":"http:\/\/www.shotinthedark.info\/wp\/?p=42415","title":{"rendered":"No Surprise"},"content":{"rendered":"

I’ve never worked at Target.<\/p>\n

Sure, not the retail operation – but sometimes I feel like I’m one of few people in Twin Cities information technology contracting\/consulting circles that hasn’t done at least a brief hitch doing\u00a0something\u00a0<\/em>at the Minneapolis-based retail behemoth.<\/p>\n

Target, of course, was beset over the holidays by a massive data breach. \u00a0You’ve heard the details; hackers installed malware in Target servers that captured tens of millions of credit card numbers.<\/p>\n

The thing is – according to Bloomberg<\/a> – it could have all been prevented, and very, very easily (emphasis added):<\/p>\n

On Saturday, Nov. 30, the hackers had set their traps and had just one thing to do before starting the attack: plan the data\u2019s escape route. As they uploaded exfiltration malware to move stolen credit card numbers\u2014first to staging points spread around the U.S. to cover their tracks, then into their computers in Russia\u2014FireEye spotted them. Bangalore got an alert and flagged the security team in Minneapolis. And then \u2026<\/p>\n

Nothing happened.<\/p>\n

For some reason, Minneapolis didn\u2019t react to the sirens.\u00a0Bloomberg Businessweek<\/em>spoke to more than 10 former Target employees familiar with the company\u2019s data security operation, as well as eight people with specific knowledge of the hack and its aftermath, including former employees, security researchers, and law enforcement officials. The story they tell is of an alert system, installed to protect the bond between retailer and customer, that worked beautifully. But then, Target stood by as 40 million credit card numbers\u2014and 70 million addresses, phone numbers, and other pieces of personal information\u2014gushed out of its mainframes.<\/p><\/blockquote>\n

Now, I know plenty of good people at Target. But I’ve had exactly two contacts with Target management. One, of course, is from various interviews for contracting and consulting jobs; they do like to lowball.<\/p>\n

But the other was at a different Twin Cities Fortune 1000 company, whose IT department found itself largely middle-managed by ex-Target people…<\/p>\n

…and, over the course of a few years, spinning itself into complete uselessness. \u00a0No, I’m not naming names – but those middle-management Targetoids inadvertently taught me a lot, I think, about Target’s IT culture.<\/p>\n

And I can totally see any of them blitzing on a simple boring phone call from Bangalore.<\/p>\n

That’s a personal observation based on my own impressions. \u00a0Not “journalism”.<\/p>\n

But I think we all arrive at the same endpoint.<\/p>\n","protected":false},"excerpt":{"rendered":"

I’ve never worked at Target. Sure, not the retail operation – but sometimes I feel like I’m one of few people in Twin Cities information technology contracting\/consulting circles that hasn’t done at least a brief hitch doing\u00a0something\u00a0at the Minneapolis-based retail behemoth. Target, of course, was beset over the holidays by a massive data breach.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57],"tags":[],"class_list":["post-42415","post","type-post","status-publish","format-standard","hentry","category-economy-and-the-market"],"_links":{"self":[{"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/posts\/42415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=42415"}],"version-history":[{"count":7,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/posts\/42415\/revisions"}],"predecessor-version":[{"id":42447,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=\/wp\/v2\/posts\/42415\/revisions\/42447"}],"wp:attachment":[{"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=42415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=42415"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.shotinthedark.info\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=42415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}