Home Depot Security Breaches Case Study

Security and ethical employees will continue to be a vital aspect of ensuring the success of an organization. There will always be a need for ethical IT security professional as hackers will continue to force organizations to make adjustments in their business models to protect their employees, data and customers. Many organizations and managers believe application security requires simply installing a perimeter firewall, or taking a few configuration measures to prevent applications or operating systems from being attacked. This is a risky misconception. By understanding threats and respect impacts, organizations will be equipped to maintain confidentiality, availability and

The Home Depot and Target have been one of the many retail establishments cyber attack breaches that have being targeted by cyber attackers. The Home Depot was the target of a cyberattack payment card system breach where their credit card information was basically stolen on September of 2014. The attacked occurred by attackers gaining third party credentials in order to gain access to the system, after they gained access to the system they weakened the system gaining their own access privileges. After doing all the mentioned above, malware was installed quickly on Home Depot’s self-check-out system. All these steps where taking by the cyber attackers resulting in the loss of more than fifty million credit card accounts and email addresses.

In 2014 there was a security breach that attacked Home Depot’s payment terminal’s which affected 56 million credit card and debit card numbers. The attack estimated about a cost of $194 per customer from credit fraud and re-issuance cost. Making this breach bigger than the holiday attack at target. This attack was reported on September 2nd and its said that was also when the malware was taken off. But the hackers were too fast and began attacking retailers by targeting their payment system.

This case study, written in 2009 is not the only case where a major data breach has occurred within organizations. In the late 2011 Sony’s PlayStation Network (PSN) was breached impacting up to 77 million user’s accounts including data on names, address and possibly credit card details. In late 2013 Target had a cyber-attack that compromised a large quantity of its data and had 110 million accounts compromised. Finally in September 2014 Apple had their iCloud server breached by hacking that compromised all the users of the online server. These occurrences still have some unanswered questions and several experts have yet to decipher the actual reason as to why the security breach occurred.

Statistics show that most security breaches are direct results of insider misconduct rather than being hacked. According to the most recent Verizon Data Breach Investigations Report, about “285 million records were compromised in 2008.” Seventy-four percent of the incidents were from inside sources. Users are more likely to be victims of computer virus infections, inquisitive students/co-workers, and hardware failures than to be victims of an Internet security attack.

Cyber criminals armed with custom-built malware stole an estimated 56 million debit and credit card numbers from Home Depot customers between April and September 2014. This is largest retail card breach on record.

There are many ways to help prevent breaches such as the Home Depot and the similar Target breach. Most retailers these days have multiple locations possibly in two or more countries like The Home Depot. Because of this the retailers need to know exactly where the business of the organization is being conducted. These organizations need to take the extra steps and know where the customer data is at all times especially payment information. They need to keep track of how it is being accessed and how it is being secured. Tom Bain, who is a senior vice president at a company called Security CounterTack, says “Retailers need to get a better grasp on who is being granted access to their networks and why” (Vijayan). Home Depot failed to do this on a daily basis and this is why the breach was so extensive. People do not know the reason as to why the company did not check these daily logs for payment information but this is the reason that they had such a big breach on their payment systems.

Target’s initial media communication to the public was ineffective because Target took more than 24 hours to release an announcement about the security breach after the story broke, which destroyed the corporation’s reputation and credibility. According to Eric Dezenhall, the CEO of public relations firm Dezenhall Resources, Brian Krebs reported the first story of Target’s security breach via a blog post on Dec. 18, 2013. Krebs is a national expert, former Washington Post reporter, and credible blogger who have been covering in-depth security news and investigation for more than fourteen years. Krebs alleged, during the past few days, “Target is investigating a data breach potentially involving millions of customer credit and debit card records”

The Home Depot data breaches exposed volumes of credit/debit card data causing consumer heartbreak and costly retailer ramifications. Reports identify that The Home Depot breach began at the end of April and continued for four months before being discovered. During those four months cardholder data moved inside The Home Depot IT infrastructure and was transferred outside the company without anyone noticing. If simple change and configuration auditing software had been in place, these malicious activities and security violations could have been detected very early on, which would have saved Home Depot millions. Former employees claim that they had warned the company about the risk of a cyber attack dating back to 2008, and the company was slow

Cyber security is critical in any business or organization. The purpose for cyber security is in the name, “security”. All types of information that are important or ment to be secured requires cyber security to defend it. For example if you submitted personal information online regarding maybe your address or even perhaps your social security number, you would not want that information falling into the wrong hands. So I will begin to talk about a cyberattack and how it was executed. The OPM data breach ( office of personal management ). 21 million current and former federal employees had their personal and highly sensitive private information stolen in a massive data breach that highly affected

In between the months of November and December of 2013, the store Target and many of its customers had suffered due to a data breach. Apparently, Target tried to fix the problem before it hit the news, by reporting the breach to the Department of Justice who hired a forensic investigator. But, due to the size of the breach and the amount of people affected, Target failed to cover up the incident.

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

Regardless of the fact that they happen quite often, both internal and external security breaches are surprisingly unforeseen by many corporations. It is imperative that companies know how to go about dealing with one when a breach does occur. It seems that “the best approach to forensic response is to plan the response before an incident occurs” (Week 5 Lecture). There should be a way for employees to know how to handle a security breach and prevent future occurrences. Each individual company needs to have a standard operating procedure that discusses the processes for e-mail, acceptable use, physical security, and incident response.

The potential of violations can come from numerous sources (Lawrence & Weber, 2011) (Consumer Information). Recently Equifax had a data breach of their customer’s personal information. The hackers accessed the names, social security numbers, birthdates, and addresses of 142 million American consumers (Consumer Information). This is frightening and happens more often that we think. According to PricewaterhouseCoopers executive, ”Cybercrime has emerged as a formidable threat. Over the years millions have fallen victim to theses attacks. In a survey of 583 U.S. companies, 90 percent said that hackers breached their company’s computers over the last twelve months (Lawrence & Weber, 2011). Cyber crimes occur when hackers attempt to damage or destroy a computer network or system of company’s data. Criminals will use one of the most harmful systems around. This system is called a zombie. A zombie is

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain