It was the most wonderful time of the year; when shoppers flock to the mall in droves to stock up on holiday gifts.
\nBlack Friday brought deals a-plenty, especially at huge retailers like America's favorite red and white superstore, Target. Millions upon millions shopped and swiped, never thinking that they were at risk of exposing their private information to anyone other than the cashier. Alas, on November 30, 2013, more than 70 million credit card numbers, addresses, phone numbers, and other personal information, were in the hands of hackers in Russia.
\r\nEven though Target boasts the same computer security system as the CIA and Pentagon, malware still made it's way onto their systems. After the malware collected information, the Russian hackers set out to remove it, and Target then failed to heed a Twarnings from their team of security specialists in Bangalore. Multiple communication breakdowns and negligence led to the biggest retail security breach in U.S. history, a 46% decline in sales for the 2013 holiday season, and more than 90 lawsuits from customers and banks.
\r\nRelated: The Top 6 Ways Small Businesses Can Protect Themselves Against Security Threats
\r\nSince the breach, Target has set-up a comprehensive section on their website in which they address commonly asked questions. In response to the question, \"how could Target let all this credit and debit card information to get accessed?\" Target said:
\r\n\"This unauthorized access is a crime, and we are taking it very seriously. While we can't provide specifics because the investigation is ongoing, we are working closely with the United States Secret Service and the Department of Justice to bring those responsible to justice.\"
\r\nTarget's security breach, though complicated, wasn't exactly the most genius hacking of all time, and could have been prevented. Multiple levels of negligence occurred, and exposed one in three Americans to identity theft. Upon investigation of what really went wrong, the FireEye security system they use showed that the warnings had been there all along, meaning the security team in Bangalore missed them, or chose to ignore them. When they finally did let team in Minneapolis know about the breach, the warnings went unheeded.
\r\nIn order to prevent a similar occurrence, Target's CEO Gregg Steinhafel claims they are in the midst of a major investigation and \"have already taken significant steps, including beginning the overhaul of our information security structure and the acceleration of our transition to chip-enabled cards.\"
\r\nBut what else? First and foremost, Target's security teams should have been more alert to the multiple warnings that came through. Though it's an obvious statement, many businesses fail to recognize the warning signs, or disregard them before it's too late.
\r\nRelated: 5 Questions to Ask When a Security Breach Has Occurred
\r\nAccording to the Identity Theft Resource Center, there have been 383 internet security breaches thus far in 2014, a 25% increase from last year. Though Target's breach made news due to the sheer size, hundreds of other businesses are being targeted, like eBay, Neiman Marcus, and AT&T. The ITRC reported that a staggering 14 million identities were stolen in 2013, or one every two seconds.
\r\nThough companies like Target make the news for massive security breaches, small to medium sized businesses make up 75% of data breaches (Tweet This). According to Business News Daily, 40% of SMBs were part of a breach in 2013, and 76% of those were due to a compromised password (Tweet This Too). These numbers are terrifying for any business owner, especially those whose livelihood is increasingly online.
\r\nTo keep the information of your business and that of your customers safe, the FCC recommends the following cyber-security steps:
\r\n1. Train employees in security principles
\r\nEstablish basic security practices and policies for employees, such as requiring strong passwords, and establish appropriate Internet use guidelines that detail penalties for violating company cybersecurity policies.
\r\n2. Protect information, computers and networks from cyber attacks
\r\nKeep clean machines: having the latest security software, web browser, and operating system are the best defenses against viruses, malware, and other online threats.
\r\n3. Provide firewall security for your Internet connection
\r\nA firewall is a set of related programs that prevent outsiders from accessing data on a private network. Make sure the operating system's firewall is enabled or install free firewall software available online. If employees work from home, ensure that their home system(s) are protected by a firewall.
\r\n4. Create a mobile device action plan
\r\nMobile devices can create significant security and management challenges, especially if they hold confidential information or can access the corporate network. Require users to password protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks.
\r\n5. Make backup copies of important business data and information
\r\nRegularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files.
\r\n6. Control physical access to your computers and create user accounts for each employee
\r\nPrevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended.
\r\n7. Secure your Wi-Fi networks
\r\nIf you have a Wi-Fi network for your workplace, make sure it is secure, encrypted, and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router.
\r\n8. Employ best practices on payment cards
\r\nWork with banks or processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations pursuant to agreements with your bank or processor.
\r\n9. Limit employee access to data and information, limit authority to install software
\r\nDo not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.
\r\n10. Passwords and authentication
\r\nRequire employees to use unique passwords and change passwords every three months.
\r\nRelated: Threats to Cybersecurity Increasing: How Secure is Your Network?
\n","docType":"article","guid":"articles_2c2b628432b0f02e2213409df9512ea7","lastModified":"2014-07-24T12:00:00.000Z","published":"2014-07-24T12:00:00.000Z","structuredData":null,"subtitle":null,"template":"v1","title":"What Target Should Have Done to Prevent Their Security Breach","type":"article","author":{"avatar":"https://staging.business.com/images/author/57a/cf9d93087b1b242e98f88/100-100","bio":"Shayna Marks is the founder and principal at Citrine Marketing, a boutique marketing studio that utilizes content marketing and social media for brilliant brand storytelling. Prior to launching Citrine, Shayna built her career by creating engaging, educational content on behalf of influential brands on digital mediums. \r\n\r\nShayna Marks has a degree in Literary Journalism from UC Irvine, where she learned rich storytelling skills to later pair with her love of new media and technology.","name":"Shayna Marks","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/shaynamarks","twitter":"shaynamrx","website":"http://www.citrinemarketing.com/"},"status":"enabled","title":null,"type":"Staff","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"Summit Pro Source","jobTitle":"Founder & VP of Operations","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Security","slug":"security"}},"meta":{"robots":"index, follow","description":"Target had a massive security breach last winter. Here's how your small business can avoid a similarly devastating cybersecurity mistake.","title":"What Target Should Have Done to Prevent Their Security Breach - business.com"},"parsedContent":{"toc":[{"id":"how-could-something-like-this-happen","title":"How could something like this happen?"},{"id":"how-could-this-have-been-prevented","title":"How could this have been prevented?"},{"id":"how-to-keep-your-business-safe-from-a-data-breach","title":"How to keep your business safe from a data breach"}],"json":[{"component":"p","children":["It was the most wonderful time of the year; when shoppers flock to the mall in droves to stock up on holiday gifts."]},{"component":"p","children":["Black Friday brought deals a-plenty, especially at huge retailers like America's favorite red and white superstore, Target. Millions upon millions shopped and swiped, never thinking that they were at risk of exposing their private information to anyone other than the cashier. Alas, on November 30, 2013, more than 70 million credit card numbers, addresses, phone numbers, and other personal information, were in the hands of hackers in Russia."]},{"component":"h2","props":{"id":"how-could-something-like-this-happen"},"children":["How could something like this happen?"]},{"component":"p","children":["Even though Target boasts the same computer security system as the CIA and Pentagon, malware still made it's way onto their systems. After the malware collected information, the Russian hackers set out to remove it, and Target then failed to heed a Twarnings from their team of security specialists in Bangalore. Multiple communication breakdowns and negligence led to the biggest retail security breach in U.S. history, a 46% decline in sales for the 2013 holiday season, and more than 90 lawsuits from customers and banks."]},{"component":"p","children":[{"component":"strong","children":["Related:"]}," ",{"component":"Link","props":{"href":"/internet-security/top-5-ways-small-businesses-can-protect-internal-security-threats/","target":"_blank"},"children":["The Top 6 Ways Small Businesses Can Protect Themselves Against Security Threats"]}]},{"component":"p","children":["Since the breach, Target has set-up a comprehensive section on their website in which they address commonly asked questions. In response to the question, \"how could Target let all this credit and debit card information to get accessed?\" Target said:"]},{"component":"p","props":{"style":{"paddingLeft":"30px"}},"children":[{"component":"em","children":["\"This unauthorized access is a crime, and we are taking it very seriously. While we can't provide specifics because the investigation is ongoing, we are working closely with the United States Secret Service and the Department of Justice to bring those responsible to justice.\""]}]},{"component":"h2","props":{"id":"how-could-this-have-been-prevented"},"children":["How could this have been prevented?"]},{"component":"p","children":["Target's security breach, though complicated, wasn't exactly the most genius hacking of all time, and could have been prevented. Multiple levels of negligence occurred, and exposed one in three Americans to identity theft. Upon investigation of what really went wrong, the FireEye security system they use showed that the warnings had been there all along, meaning the security team in Bangalore missed them, or chose to ignore them. When they finally did let team in Minneapolis know about the breach, the warnings went unheeded."]},{"component":"p","children":["In order to prevent a similar occurrence, Target's CEO Gregg Steinhafel claims they are in the midst of a major investigation and \"have already taken significant steps, including beginning the overhaul of our information security structure and the acceleration of our transition to chip-enabled cards.\""]},{"component":"p","children":["But what else? First and foremost, Target's security teams should have been more alert to the multiple warnings that came through. Though it's an obvious statement, many businesses fail to recognize the warning signs, or disregard them before it's too late."]},{"component":"p","children":[{"component":"strong","children":["Related:"]}," ",{"component":"Link","props":{"href":"/internet-security/5-questions-to-ask-when-a-security-breach-has-occurred/","target":"_blank"},"children":["5 Questions to Ask When a Security Breach Has Occurred"]}]},{"component":"h2","props":{"id":"how-to-keep-your-business-safe-from-a-data-breach"},"children":["How to keep your business safe from a data breach"]},{"component":"p","children":["According to the Identity Theft Resource Center, there have been 383 internet security breaches thus far in 2014, a 25% increase from last year. Though Target's breach made news due to the sheer size, hundreds of other businesses are being targeted, like eBay, Neiman Marcus, and AT&T. The ITRC reported that a staggering 14 million identities were stolen in 2013, or one every two seconds."]},{"component":"p","children":["Though companies like Target make the news for massive security breaches, small to medium sized businesses make up 75% of data breaches ",{"component":"a","props":{"href":"http://ctt.ec/va7Pb","target":"_blank"},"children":[{"component":"em","children":["(Tweet This)"]}]},". According to Business News Daily, 40% of SMBs were part of a breach in 2013, and 76% of those were due to a compromised password ",{"component":"a","props":{"href":"http://ctt.ec/L0JOu","target":"_blank"},"children":[{"component":"em","children":["(Tweet This Too)"]}]},". These numbers are terrifying for any business owner, especially those whose livelihood is increasingly online."]},{"component":"p","children":["To keep the information of your business and that of your customers safe, the FCC recommends the following cyber-security steps:"]},{"component":"p","children":[{"component":"strong","children":["1. Train employees in security principles"]}]},{"component":"p","children":["Establish basic security practices and policies for employees, such as requiring strong passwords, and establish appropriate Internet use guidelines that detail penalties for violating company cybersecurity policies."]},{"component":"p","children":[{"component":"strong","children":["2. Protect information, computers and networks from cyber attacks"]}]},{"component":"p","children":["Keep clean machines: having the latest security software, web browser, and operating system are the best defenses against viruses, malware, and other online threats."]},{"component":"p","children":[{"component":"strong","children":["3. Provide firewall security for your Internet connection"]}]},{"component":"p","children":["A firewall is a set of related programs that prevent outsiders from accessing data on a private network. Make sure the operating system's firewall is enabled or install free firewall software available online. If employees work from home, ensure that their home system(s) are protected by a firewall."]},{"component":"p","children":[{"component":"strong","children":["4. Create a mobile device action plan"]}]},{"component":"p","children":["Mobile devices can create significant security and management challenges, especially if they hold confidential information or can access the corporate network. Require users to password protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks."]},{"component":"p","children":[{"component":"strong","children":["5. Make backup copies of important business data and information"]}]},{"component":"p","children":["Regularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files."]},{"component":"p","children":[{"component":"strong","children":["6. Control physical access to your computers and create user accounts for each employee"]}]},{"component":"p","children":["Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended."]},{"component":"p","children":[{"component":"strong","children":["7. Secure your Wi-Fi networks"]}]},{"component":"p","children":["If you have a Wi-Fi network for your workplace, make sure it is secure, encrypted, and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router."]},{"component":"p","children":[{"component":"strong","children":["8. Employ best practices on payment cards"]}]},{"component":"p","children":["Work with banks or processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations pursuant to agreements with your bank or processor."]},{"component":"p","children":[{"component":"strong","children":["9. Limit employee access to data and information, limit authority to install software"]}]},{"component":"p","children":["Do not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission."]},{"component":"p","children":[{"component":"strong","children":["10. Passwords and authentication"]}]},{"component":"p","children":["Require employees to use unique passwords and change passwords every three months."]},{"component":"p","children":[{"component":"strong","children":["Related:"]}," ",{"component":"Link","props":{"href":"/internet-security/threats-cybersecurity-increasing-secure-network/","target":"_blank"},"children":["Threats to Cybersecurity Increasing: How Secure is Your Network?"]}]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5d1/b58ff9c658a86148b457e/1500-0-","caption":"SFIO CRACHO/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"What Target Should Have Done to Prevent Their Security Breach","canonical":"https://www.business.com/articles/target-done-prevent-security-breach/","slug":"target-done-prevent-security-breach","thumbnail":"https://www.business.com/images/content/5d1/b58ff9c658a86148b457e/1500-0-","dek":"It was the most wonderful time of the year; when shoppers flock to the mall in droves to stock up on holiday gifts.","lastModified":"2014-07-24T12:00:00Z","published":"2014-07-24T12:00:00Z","sponsored":false},{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"5 Preventable Human Errors That Leave Your Company Vulnerable to a Cyberattack","canonical":"https://www.business.com/articles/preventable-human-errors/","slug":"preventable-human-errors","thumbnail":"https://www.business.com/images/content/5b0/306f192a3a4090f8b4577/1500-0-","dek":"Most cyberattacks stem from internal human error, but companies can protect themselves.","lastModified":"2018-05-21T07:00:00Z","published":"2018-05-21T07:00:00Z","sponsored":false},{"title":"Decoding the Hierarchy of Data Protection","canonical":"https://www.business.com/articles/data-protection-hierarchy/","slug":"data-protection-hierarchy","thumbnail":"https://www.business.com/images/content/5ad/e2b331039eba5148b456a/1500-0-","dek":"What are your options for protecting your data and how do you decide on a strategy?","lastModified":"2018-04-23T19:00:00Z","published":"2018-04-23T19:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay - 08-05","canonical":"https://staging.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://staging.business.com/images/content/5c5/afd7f54d26d67178b458d/1500-0-","dek":"Edit 07-24 - subtitle","lastModified":"2019-08-05T20:58:00Z","published":"2018-06-21T16:05:00Z","sponsored":null},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"Biometrics and the Future: What It Means for Small Businesses","canonical":"https://www.business.com/articles/biometrics-facial-recognition-small-business/","slug":"biometrics-facial-recognition-small-business","thumbnail":"https://www.business.com/images/content/5ad/744c11039eb027a8b4599/1500-0-","dek":"Biometrics are popping up everywhere. Find out why it's good for business.","lastModified":"2018-04-19T12:40:00Z","published":"2018-04-19T12:40:00Z","sponsored":false},{"title":"How to Select the Right Encryption Key Management Solution","canonical":"https://www.business.com/articles/encryption-key-management-considerations/","slug":"encryption-key-management-considerations","thumbnail":"https://www.business.com/images/content/5b3/b6aae92a3a480118b457d/1500-0-","dek":"Encryption key management is a necessary component of effective data protection.","lastModified":"2018-07-03T12:06:00Z","published":"2018-07-03T12:06:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"How to Protect Your Web Application – Even If You Don't Own Sensitive Data","canonical":"https://www.business.com/articles/protecting-web-applications/","slug":"protecting-web-applications","thumbnail":"https://www.business.com/images/content/5b5/204c251ee47ed578b4568/1500-0-","dek":"Keep you web application and customer data secure by following these 4 steps.","lastModified":"2018-07-20T07:00:00Z","published":"2018-07-20T07:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df905909c658a7e538b4567/Faxing_junce_Getty.jpg","canonical":"https://staging.business.com/categories/online-fax-services/","title":"The Best Online Fax Services of 2021","dek":"Online fax services are growing as more companies divest from conventional fax machines in favor of an automated, scalable and cost-effective option. Here's a look at some of the best online fax services on the market. ","slug":"online-fax-services","lastModified":"2021-03-02T16:07:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2014-07-24T12:00:00.000Z","template":"v1","title":"What Target Should Have Done to Prevent Their Security Breach","meta":{"robots":"index, follow"},"docType":"articles","slug":"target-done-prevent-security-breach","canonical":"https://staging.business.com/articles/target-done-prevent-security-breach/","skipTOC":false}},"staticQueryHashes":[]}