Team 4 – Mack, Josh, Felicia, Kevin and Walter Case Study – Target Team 4 – Mack, Josh, Felicia, Kevin and Walter Senior Testing and Internal Audit team

Team 4 – testing and auditing How would you describe your current testing and auditing to your Senior Leadership? Our current testing and auditing process is comprehensive. We use Payment Card Industry Data Security Standard PCI-DSS We competed baseline testing based on PCI-DSS Passed PCI compliance audits on the POS systems

Team 4 – testing and auditing What would you like to change for testing going forward? A comprehensive approach to testing/auditing will include all assets, not just those that fall under compliance regulations. We need to test ALL the subsystems going forward, not just the credit card systems.

Team 4 – testing and auditing How would you test your interactions with vendors and suppliers? Require vendors to use commercial virus checking software and other security precautions on their interfacing systems. Require commercial virus scanning software that would have prevented malware used in the attack on the vendor machines. Security Skills Assessment and Appropriate Training: Require vendors to go through basic security training or agree to train staff. Can be accomplished by auditing vendor’s security training records. Malware in phishing attack would have failed. Hackers would not have obtained access to vendor portal credentials. Begin testing for two-factor authentication from vendor.

Team 4 – testing and auditing What assurances can your testing provide to your leadership? From lessons learned and using approved comprehensive testing and audit procedures, when the next attack happens, we can assure that the detection and identification of the threat will happen quickly enough, so that we can react and recover in a timely manner.

Team 5 – interfaces and trust Team 5: Senior Corporate Operations Group What is the best way to manage the risk of others interfacing with our network and systems? Focus on being proactive Understand ALL asset vulnerabilities Timely Incident response Implement comprehensive testing and audit procedures How should you control others on your network for access and authorization? Compartmentalize/segregate users based on roles/needs Use 2-factor Authentication Periodic review of authorized users

Team 5 – interfaces and trust Team 5: Senior Corporate Operations Group What should be required of vendors and sub-contractors to work with your systems? Service Level Agreement (SLA) They should meet the PCI compliance requirements How do you ensure proper training and certification of sub-contractors and vendors? Require certification documentation be sent to IA office when updated/annually -or- require their IA office to submit training reports