Home Depot Data Breach 2014 Case Study. Introduction. .

How : Hackers gained access to the user records in the database by using a password cracking tool. Passwords which were disclosed are weakly encrypted using outdated hashing technique without salting the password and this has made hacker's job easier to convert the encrypted passwords with no less than 2 hours.

Home Depot is the fastest growing retailer in the U.S. by some accounts. It has a fascinating history of innovation and entrepreneurship. The company had some difficulties in the mid-2000s that some attribute to cultural clashes. However, during this period the company was able to take full advantage of the housing boom. Yet when the bubble burst, Home Depot was forced to claim substantial losses. Despite these loses Home Depot has weathered the storm fairly well and is in prime position to take advantage of an economic recovery; if it ever comes.

Home Depot may be the first stop for home change needs. Be that as it may, prior in 2014, it succumbed to digital thieves who stole up to 60 million card details. The assaults continued for five months prior to they were found. In September 2014, the organization said that any individual who utilized a Visa to shop in the U.S. on the other hand Canada over a six month period could have been a casualty. At the time, Home Depot CEO Frank Blake called security a "noteworthy issue" and attempted to console clients by saying the retailer had reinforced its lines of barrier.

A hacker attacks an easy target first, and then uses it to hide his identity and traces of launching attacks at more secured sites. The aim of an attack is to gain complete control of the system (in order to edit, delete, install or execute any file in any user’s directory), often by gaining access to a “ super-user” account. This will allow both maximum access and the ability to hide your presence.

The correct measure or solution was to use malware defenses. In this case, vendors should use commercial virus software to check and protect the system as well as employ firewalls and other security measures on the systems used to interact with the vendor (Bejtlich, 2004). By doing that Target would have prevented any unwanted attacks and thus prevent the damages caused by the data breach.

What do Premara Blue Cross, Anthem, Chick-fil-A, Sony, USPS, MCX, Staples, Kmart, Dairy Queen, SuperValue, Jimmie John's, Viator, Home Depot, PF Chang's, Community Health Systems, and JP Morgan all have in common? Each of these companies were hacked during 2014-2015. Sadly, this is just a short list showing the breadth of industries and size of operations that are vulnerable. According to Time Magazine in March, 2015, "You're not just imagining it: Lately, a new data breach has been reported almost every week."

The Home Depot (NYSE: HD) is a home improvement, construction products and services retailer operating over 2,000 big-box stores in the United States and abroad. The Home Depot was founded in 1978 by Bernie Marcus and Arthur Blank with the vision of one-stop shopping for do-it-yourself (DIY) customers, installation services for do-it-for-me (DIFM) customers and competitive products for the professional market. Their DIFM installation programs include products such as carpeting, flooring, cabinets, countertops, and water heaters. In addition, the company provides installation of various professional products like generators and HVAC systems.

The costs that the company will incur can be broken down into six different categories: investigation and remediation, notification, identify theft and credit monitoring, disruptions in normal business operations, and lost business. Investigation costs involve those related to examining how and why the data was compromised, and remediation costs relate to the costs incurred to set up safeguards. Home Depot’s pre-tax expense relating to investigation and remediation was $43 million in the third quarter of 2014 alone. Notification costs relate to notifying the relevant individuals, regulators, and media personnel. Simply mailing notification letters, at 49 cents per stamp, equates to a $27.44 million expense. Costs relating to identify theft and credit monitoring include the cost of identity theft protection for each of the victims. Assuming $10 per victim, this results in a $560 million cost for Home Depot. Disruptions to Home Depot’s normal business operations include the opportunity cost of the reduced investments in the company’s operations, as well as reduced time on standard business activities. This cost is estimated to be $20 per victim. Home Depot will likely lose business due to customers being scared away, and the related cost is approximately $30 per victim. Finally, lawsuits relating to the data breach are expected to incur $3 billion in expenses for Home Depot. 44 suits have already surfaced since the cyberattack. (“Home Depot: Will

After two months of investigating it was determined that Target had allowed their HVAC vendor access to their networks. This HVAC account that was created had been compromised and allowed hackers onto the Target’s network (Mlot, 2014). Once on the network the attackers made their way to change user accounts that were already on the system and gave them elevated privileges. Target utilizes BMC management software that creates and utilizes a Best1_user account to authenticate the management software to the network. This account when installed onto the system is not added to any groups and is locked down to only authenticate the BMC services necessary (“29 new clues,” 2014).

The Home Depot used very low technology. Even, the Depot lacked the hardware infrastructure .The small stores not having the required infrastructure for the Large Inventories which posed a huge problem for the Home Depot.

One of the differentiating factors of Home Depot was that it incorporated within its members a major aversion to any kind of beauracracy and hierarchy. It was a usual practice at the stores to ignore all kind of paperwork that was sent to them by the headquarters. They undervalued such directives to the extent that they would throw these papers in the waste basket or mark them with “BS” stamp and send it back to the headquarters. They believed that all this was a waste of time of the managers and they had more important things to address to at their stores, the most important of them being : satisfying the

When Target had a security breach, it became one of the top business compromises that happened. The result of the security breach leads to a $10 million settlement for the consumer $39 million to financial institution, and also awarding $19.9 million in banks’ attorney fees and costs (Bouboushian. 2016). From your post you had very detailed of how did Target got hacked, it is true that there were many mistakes that were made: the HVAC company that receive credentials for the hackers to upload the malware (5 versions), FireEye security monitor alert was ignored, Symantec Endpoint Protection warning being ignored as well, and the last thing that really impacts the final result of data breach was even the security team (experts in Bangalore)

First, Hunter Watertech should have had strict guidelines as to securing their highly sensitive equipment. Had that been the case, Boden would never have been able to, so effectively, tamper with the system. Once he, a disgruntled employee, left the company, he should have been strictly denied access. But that is only one of the layers in a defense-in-depth. There should have been safeguards in place for lost or stolen equipment. How did Hunter Waterteck not realize some of their equipment was missing? There was no authentication between the machines in the SCADA system and the laptop. The system ‘trusted’ the commands from the laptop. Multi-factor authentication is effective because it only allows access once the multiple pieces of security

Technology: it is obvious that TJX had several technology deficiencies mainly driven by systems limitations and vulnerability. For example, inadequate wireless network security allowed the hackers to attack specific stores just by using a laptop and an antenna which permitted the thieves access to the central database. As it was mentioned in the business case, TJX was using (WEP) as the security protocol and it is

From deeply examining the trend in the network intrusion, the attacker might have applied port scan and IP address spoofing method of attack. Forensic evidence gathered from the firewall logins indicated that the attacker used varying IP address to access the network system. This clearly proves IP address spoofing, which occurs when an attacker impersonates a firewall’s trusted IP address. Attackers can henceforth get access to the system and manipulate malicious content (Thomas & Stoddard