Credit: Thinkstock/ CSO Online
In what some security experts are calling a "game changer," a Minnesota federal court held Target liable earlier this month for data breach losses because the company had ignored its own security alerts.
Target is based in Minnesota, but the Minnesota Plastic Card Security Act, which specifically allows banks that issue payment cards to sue breaching merchants, also covers any company that does business in that state, according to Karl Belgum, an attorney with Nixon Peabody LLP.
The decision does not involve a financial penalty against Target, but it does allow the case to move forward to the next step.
Now, financial institutions that say they have spent billions of dollars issuing replacement cards can now proceed with a negligence class action lawsuit against Target.
"Although the third-party hackers' activities caused harm, Target played a key role in allowing the harm to occur," Judge Paul Magnuson said in his ruling. "Indeed, Plaintiffs' allegation that Target purposely disabled one of the security features that would have prevented the harm is itself sufficient to plead a direct negligence case."
The judge also agreed with the banks' argument that Target failed "to heed the warning signs as the hackers' attack began."
Too many alerts, too little time
The problem, according to Brian Foster, CTO at Atlanta-based security firm Damballa, Inc., is that companies can't possibly respond to every single security alert they get.
In Target's case, for example, the company failed to heed warnings from its FireEye prevntion system and for disabling the automatic blocking feature.
But how many companies would immediately disconnect devices from their network based on an alert? he asked.
"Most are false positives," Foster said.
For example, a piece of malware might cross a company's network on its way to an endpoint device but never get installed because the user rejects it, antivirus catches it, it's sandboxed, or its designed for a different operating system or environment.
According to a Ponemon survey to be released next month, enterprises that have between 10,000 and 15,000 employees see an average of 17,000 security alerts a week. Target has over 300,000 employes.
According to the Ponemon study, only 19 percent of the incoming alerts are reliable.
In another survey, Damballa found that the average number of actual, successful daily infections was 97.
Foster recommends that companies look at the security tools they are using and if they generate too many unactionable alerts, that they either staff up, or look for new tools.
"They're going to have to hire an army of humans to look at all the alerts, and not let any slip through," he said. "And that's not really sustainable. For one thing, the number of humans trained in this space is already in high demand."
Sign up for Computerworld eNewsletters.