Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Target CIO's Resignation: 7 Questions

After the data breach, why didn't the buck stop with PCI assessors or CEO? Search for accountability reveals flawed system, much finger-pointing.

9 Notorious Hackers Of 2013
9 Notorious Hackers Of 2013
(click image for larger view and for slideshow)

Pop quiz for discount retailers who suffer a high-profile data breach that impacts millions of customers, weakens sales, shaves a few points off of your stock price, and may cost your company hundreds of millions of dollars to clean up: What happens next?

For Target, that would be the departure of CIO Beth Jacob, who announced Wednesday -- in a letter to Gregg Steinhafel, Target's chairman, president, and CEO -- that she was resigning "effective immediately." The same day, Steinhafel said in a statement that Target planned to make a number of technology, information security, and compliance changes, and to hire an "interim CIO" to oversee that transition.

To be clear, Jacob was in charge of IT for a retailer that fell victim to a hack attack that resulted in 40 million credit and credit cards and personal information on 70 million customers being compromised. But was she unfairly forced out? And does an episode like this mean the end of a CIO's career?

Here are seven related points to consider:

1. Did Target make CIO a scapegoat?
Some people think Target's management team jettisoned Jacob, finding her a convenient scapegoat. "Target has been obviously impacted. People are questioning Target's security. And she was the fall guy," Walter Loeb, a New York-based independent retail consultant, told The Christian Science Monitor.

[For more on Target's shifting management team, read Target Seeks New CIO.]

But for information security industry veteran Ted Julian, who serves as chief marketing officer at incident response firm Co3 Systems, the end of Jacob's Target tenure wasn't a surprise. "Under these circumstances, it's pretty standard, if for no other reason than optically it just shows the company taking action. It allows them to get someone new with some new ideas and enthusiasm and excitement that can be shown to make aggressive changes," he said, speaking by phone.

Still, her post-breach departure was relatively rapid. "It is pretty typical for the CIO to take the fall, though typically not this quickly," Gartner analyst Avivah Litan said, speaking by phone. "The buck typically stops with the CIO, even though it should stop with the CEO."

On the other hand, according to recent studies, a CIO's job tenure lately lasts, on average, about six years. By that measure, Jacob's five years in the job rates as just about the norm.

2. Before the breach: Were warning signs ignored?
One frequent topic of conversation at last week's RSA conference in San Francisco involved a February 2014 Wall Street Journal report that Target staff had warned management that the retailer was at risk of having its POS systems compromised, at least two months prior to the breach.

But more than one RSA panel participant cautioned that it would be the rare information security team that wasn't sounding some types of alerts. The Journal's report also offered no signal-to-noise assessment of what other types of warnings that Target's CIO and senior management team may have received or acted upon.

"For every single breach I've been aware of, the alarms went off, but if you're getting one serious alarm buried in 10,000 or 100,000 alarms, it's hard to pick it out," Litan said. "There's so much noise, it's a lot like the patches on Windows or Internet Explorer -- here's another bug that was discovered, or certificate that was expired. You just get immunity."

Of course, some businesses seem complicit in their data breaches. Sony, for example, laid off most of its security staff in 2011 and was subsequently hacked more than a dozen times. But Target doesn't appear to have skimped on information security. "Here's what we do know: this was not an anemic security department that lacked staff or resources," Co3's Julian said. "That's not to say that maybe they shouldn't have more, but... this looks to be a well-funded, highly competent group, with extensive rapport across Target and the industry."

3. Will IT reboot better secure Target?
Target is now shopping for a new interim CIO and has hired consulting firm Promontory Financial Group to offer technology, staffing, and business process advice for the retailer's IT, information security, compliance, and risk-management reboot.

Instead of splitting information security responsibilities being between several people, Target will also look externally to hire its first-ever CISO as well as its first-ever chief compliance officer. The latter role was previously overseen by Ann Scovil, Target's VP of risk assurance and compliance, who has long planned to retire at the end of this month, the Wall Street Journal reported.

Asked about how the company planned to now handle risk management -- and whether it would designate a chief risk officer -- Target spokeswoman Molly Snyder said via email, "We haven't provided any additional details on that to date."

4. Target's vacant technology jobs: caveat emptor?
In 2008, with the Great Recession gaining force, Jon Stewart famously asked then-presidential candidate Barack Obama: "With the kind of issues that face the country now... is there a sense that you don't want this?"

Might the same cautionary note be sounded for anyone

Next Page

Mathew Schwartz served as the InformationWeek information security reporter from 2010 until mid-2014. View Full Bio

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
3/10/2014 | 2:40:52 PM
Re: Where is the CEO's responsibility?
Who would you put in charge of security if not the CIO?
User Rank: Apprentice
3/10/2014 | 2:07:13 PM
Re: Where is the CEO's responsibility?
Yes, JREY146's post is the article that Information Week should have written.

Target decided as a matter of business strategy to run the risk of customers' data loss rather than incur the cost of duely diligent security. 

OK, part of being in the C-suite (CIO in this case) means falling on your sword, or agreeing to be pushed on it. But this is classic scapegoating. Candidates to fill the CIO position will want to ask whether Target is going to give data security higher priority than before, and whether they'll spend the money to make it so.

It's also time for the rest of the e-commerce world (banks, credit card companies, regulators...) to admit that core data losses are a different kind of problem, not the same as the slow trickle of individual identity compromises, and stop treating all data losses as just the cost of being in this business.
User Rank: Apprentice
3/10/2014 | 3:08:20 AM
Garcinia Cambogia Pro

Thank you for broadening my knowledge on this aspect to groom up my skills here.


Garcinia Cambogia Gold  / Garcinia Cambogia Pro
User Rank: Apprentice
3/9/2014 | 4:10:48 PM
Where is the CEO's responsibility?
Isn't it the CEO's responsibility to run the company?  For years Cybersecurity has been on the forefront, when are CEOs and their C-suite pals going to wake up and realize that putting the CIO in charge of information security is like bringing an Accountant to a murder trial?  Information Security is not a tehcnical problem, it is a business problem and should have a strategy that aligns with the business along with representation at the C level.  Additionally, boards of directors are ultimately responsible for the business (with delegation to the CEO).  They should be demanding these organziational alignments, regular updates, etc.  Doing all this will not stop the breaches 100%, but it will make them much more secure than they are now...
User Rank: Apprentice
3/7/2014 | 5:18:50 PM
Re: Retail IT security woes
If you think she resigned of her own choice, you are kidding yourself.  This was not about taking accountability, this is about Target firing her under the guise of her resignation. 

User Rank: Apprentice
3/7/2014 | 10:30:46 AM
Re: Retail IT security woes
As long as they "are" smart CIOs.  She had a long history with Target, back to 1984 if I recall her bio correctly, a degree in retail sales and MBA which means she knew the retail industry from Target's point of view and it is important to provide a path for your best employees.  That does not always translate however to being able to manage and fully understand technology's risks/security.  30 years in the same company also promotes tunnel vision.  In smaller companies, you might be able to get away with running on autopilot (as one of my bosses once said, promoted beyond his level of competence) but as one of the largest, leading retailers they should have had a CIO with CIO credentials.  Hiring CISO and audit/compliance professionals is a step in right direction, after leaving the barn door open.
User Rank: Apprentice
3/6/2014 | 5:07:04 PM
You raise a good point about the PCI assessors. Not holding assessors accountable in some way is the moral equivalent of letting an auditing firm off the hook in the face of corporate fraud. Hopefully enterprises haven't forgotten the lesson of Enron and Arhur Andersen.  Now that government sector is embracing third party assessors with FedRAMP, the role of IT / security assessors is likely to become more important (and probably more competitive.)  In the meantime, it's hard to believe Target is only now looking to hire a CISO.  Just goes to show,  risk management still doesn't prepare you for Black Swan events.

Thomas Claburn
Thomas Claburn,
User Rank: Ninja
3/6/2014 | 4:45:18 PM
Re: Retail IT security woes
Is may be worth asking why other CIOs have remained in their jobs after major breaches. After all, this is hardly the first massive data breach or organization that has been compromised.
Lorna Garey
Lorna Garey,
User Rank: Ninja
3/6/2014 | 3:56:59 PM
Re: Retail IT security woes
Personally I find it refreshing to see a leader take ownership of what happened on her watch. Is it fair? Well, as we all know, life isn't fair. But the US could do with more accountability by top leaders.
User Rank: Apprentice
3/6/2014 | 3:19:18 PM
Retail IT security woes
Don't go into retail? If the smart CIOs walk away from retail, we're in trouble. Turnaround experts have an opportunity here, right?
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-...
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in "upload tftp syslog" and "upload tftp configuration" in the CLI via a crafted filename...
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific to V1600D, V1600G1, and V1600G2) is contained in the firmware images.