{"id":230,"date":"2014-02-06T17:01:45","date_gmt":"2014-02-06T17:01:45","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=230"},"modified":"2014-02-06T19:13:28","modified_gmt":"2014-02-06T19:13:28","slug":"target-data-breach-started-through-stolen-hvac-contractor-login","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/","title":{"rendered":"Target Data Breach Started through Stolen HVAC Contractor Login"},"content":{"rendered":"

\"Target<\/a>According to a recent post by Brian Krebs on his Krebs on Security blog<\/a>, the infamous Target data breach started with hackers stealing the a network log in from a HVAC contractor working for Target Corporation. Mr. Krebs – a former reporter for The Washington Post wrote, “Sources close to the investigation said the attackers first broke into the retailer\u2019s network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services, a Sharpsburg, Penn.-based provider of refrigeration and HVAC systems.”<\/p>\n

This revelation speaks directly to the challenge many organizations face with regard to allowing third-parties like contractors access to internal systems. One of the most talked about features in modern Identity and Access Management systems is the concept of Identity Federation or more specifically, “role-based” identity federation where a contractor is provided limited access to the necessary applications required to perform their work.<\/p>\n

In the case of the Target breach still more needs to be understood. As Mr. Krebs states, “It\u2019s not immediately clear why Target would have given an HVAC company external network access, or why that access would not be cordoned off from Target\u2019s payment system network. But according to a cybersecurity expert at a large retailer who asked not to be named because he did not have permission to speak on the record, it is common for large retail operations to have a team that routinely monitors energy consumption and temperatures in stores to save on costs (particularly at night) and to alert store managers if temperatures in the stores fluctuate outside of an acceptable range that could prevent customers from shopping at the store.”<\/p>\n

For those of you responsible for cyber security in your organization watching this Target spectacle unfold from a parallel perch, we cannot emphasis the importance of Identity Management enough. As we state in our Free 2014 Solutions Identity and Access Management Buyers Guide<\/a>, “The best practice for the enterprise is to implement an Identity and Access Management (IAM) solution. And given the regulatory, security and public relations implications, an IAM solution may be the single most important best practice you will implement \u2013 ever.”<\/p>\n","protected":false},"excerpt":{"rendered":"

According to a recent post by Brian Krebs on his Krebs on Security blog, the infamous Target data breach started with hackers stealing the a network log in from a HVAC contractor working for Target Corporation. Mr. Krebs – a former reporter for The Washington Post wrote, “Sources close to the investigation said the attackers […]<\/p>\n","protected":false},"author":1,"featured_media":231,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[],"acf":[],"yoast_head":"\nTarget Data Breach Started through Stolen HVAC Contractor Login<\/title>\n<meta name=\"description\" content=\"The best practice for the enterprise is to implement Identity & Access Management solution and may be the most important solution you will implement \u2013 ever.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Doug Atkinson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/\",\"name\":\"Target Data Breach Started through Stolen HVAC Contractor Login\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg\",\"datePublished\":\"2014-02-06T17:01:45+00:00\",\"dateModified\":\"2014-02-06T19:13:28+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae\"},\"description\":\"The best practice for the enterprise is to implement Identity & Access Management solution and may be the most important solution you will implement \u2013 ever.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg\",\"width\":600,\"height\":270,\"caption\":\"Target Data Breach Started through Stolen HVAC Contractor Login\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/identity-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Target Data Breach Started through Stolen HVAC Contractor Login\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/identity-management\/\",\"name\":\"Identity and Access Management Solutions | Solutions Review\",\"description\":\"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae\",\"name\":\"Doug Atkinson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=mm&r=g\",\"caption\":\"Doug Atkinson\"},\"description\":\"An entrepreneur and executive with a passion for enterprise technology, Doug founded Solutions Review in 2012. He has previously served as a newspaper boy, a McDonald's grill cook, a bartender, a political consultant, a web developer, the VP of Sales for e-Dialog - a digital marketing agency - and as Special Assistant to Governor William Weld of Massachusetts.\",\"sameAs\":[\"https:\/\/solutionsreview.com\"],\"url\":\"https:\/\/solutionsreview.com\/identity-management\/author\/doug-atkinson-4\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Target Data Breach Started through Stolen HVAC Contractor Login","description":"The best practice for the enterprise is to implement Identity & Access Management solution and may be the most important solution you will implement \u2013 ever.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/","twitter_misc":{"Written by":"Doug Atkinson","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/","url":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/","name":"Target Data Breach Started through Stolen HVAC Contractor Login","isPartOf":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg","datePublished":"2014-02-06T17:01:45+00:00","dateModified":"2014-02-06T19:13:28+00:00","author":{"@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae"},"description":"The best practice for the enterprise is to implement Identity & Access Management solution and may be the most important solution you will implement \u2013 ever.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#primaryimage","url":"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg","contentUrl":"https:\/\/solutionsreview.com\/identity-management\/files\/2014\/02\/Target-Data-Breach-Started-through-Stolen-HVAC-Contractor-Login.jpg","width":600,"height":270,"caption":"Target Data Breach Started through Stolen HVAC Contractor Login"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/identity-management\/target-data-breach-started-through-stolen-hvac-contractor-login\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/identity-management\/"},{"@type":"ListItem","position":2,"name":"Target Data Breach Started through Stolen HVAC Contractor Login"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/identity-management\/#website","url":"https:\/\/solutionsreview.com\/identity-management\/","name":"Identity and Access Management Solutions | Solutions Review","description":"Evaluating Enterprise IAM Software, Identity Governance & Access Control Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/identity-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae","name":"Doug Atkinson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/identity-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=mm&r=g","caption":"Doug Atkinson"},"description":"An entrepreneur and executive with a passion for enterprise technology, Doug founded Solutions Review in 2012. He has previously served as a newspaper boy, a McDonald's grill cook, a bartender, a political consultant, a web developer, the VP of Sales for e-Dialog - a digital marketing agency - and as Special Assistant to Governor William Weld of Massachusetts.","sameAs":["https:\/\/solutionsreview.com"],"url":"https:\/\/solutionsreview.com\/identity-management\/author\/doug-atkinson-4\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/230"}],"collection":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/comments?post=230"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/posts\/230\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media\/231"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/media?parent=230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/categories?post=230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/identity-management\/wp-json\/wp\/v2\/tags?post=230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}