Target's Attack Model

1. Does Target story follow the general “APT kill chain” attack model? Target’s story follows the general advanced persistent threat attack model. The hackers did the reconnaissance work by finding out Target’s external vendors. Unfortunately, this was easy for the hackers, because Target’s supplier portal and facilities management pages were publicly available information. So, the hackers target Fazio, an external vendor Target used. The hackers then created a targeted “weapon,,” in this case, malware, and sent phishing emails to people at Fazio. Fazio unfortunately did not use from anti-malware software. The hackers gained access to all of Fazio’s usernames and passwords, which allowed access to Target’s systems. The hackers exploited a
At this point, data was stored on the network for days before being transmitted. Apparently, the system to automatically delete malware as they are detected was turned off. This was obviously a major lapse on the part of Target’s security team. While not directly dealing with Target’s security operations, the final breakdown occurred with Target’s poor handling of dealing with the breach. It took time for Target to go public about the breach, but did not provide much information. The website was difficult to navigate and again, the lack of information made it difficult for customers to deal with the aftermath of their information being stolen. 3. What recommendations would you give to the company in order to improve their security operations?To improve Target’s security operations, I would recommend the following:1) It was evident that Target did not know how to handle such a breach. Thus, the first step to improve Target’s security operations is to understand that they can absolutely be targets of such cyberattacks. By properly understanding this, this will lead to better decision making that will protect them from such attacks. 2) Target needs to properly segment its network and apply proper securities for each. Network checks and maintenance should be done regularly. However, this is not enough; the results should be evaluated and lead to action. 3) Ultimately, what is needed is better management and communication. It was unclear who was responsible for the breach. There needs to be clearly defined roles and response options. Target’s security operations need to outline key decisions that need to be made regarding cybersecurity and then define the roles of each person or team involved in making those decisions. Accountability measures must then be