Menu
US retailers Target and Neiman Marcus defend security practices

US retailers Target and Neiman Marcus defend security practices

Some US lawmakers call for new data security regulations, but others question how to keep the law current with criminal attacks

Recent data breaches at Target and Neiman Marcus were sophisticated attacks not detected by robust cybersecurity measures, executives with the two companies told U.S. lawmakers.

The attacks on the two stores seemed to be targeted at defeating specific cybersecurity measures deployed by the two companies, witnesses told the U.S. House of Representatives Energy and Commerce Committee's commerce subcommittee Wednesday. The attacks likely came from "highly technical, sophisticated criminal organizations," said William Noonan, deputy special agent in charge of the Criminal Investigations Division for Cyber Operations at the U.S. Secret Service.

Executives with the two companies, testifying for the second straight day before Congress, defended their security practices. Target has invested "hundreds of millions" of dollars in cybersecurity, said John Mulligan, CFO at Target. Neiman Marcus has spent "tens of millions of dollars," added Michael Kingston, the company's CIO.

No antivirus software would have stopped the malware that attacked Neiman Marcus' card-processing network, because it was rewritten to target the company, Kingston said. "It was very specifically designed for an attack on our systems," he said.

While several lawmakers and witnesses called for a federal data security standard and breach notification rule, Mulligan and Kingston seemed to suggest those regulations wouldn't have stopped the breaches at their companies. Both men said their companies deploy a wide range of security measures, and both companies notified affected customers within days of discovering the breaches.

In both cases, the malware stole customer information right after they swiped their credit or debit cards and before the companies could encrypt that information, the two executives said. The U.S. retail system needs to move away from old magnetic-strip credit cards to newer chip-based cards that are deployed across Europe, Mulligan said.

Some lawmakers questioned, however, whether Congress could require chip-based cards because attackers are constantly changing their methods. Chip-based credit cards would add an "additional layer of security," but the technology would not prevent all data breaches, added Phillip Smith, senior vice president at cybersecurity vendor Trustwave Holdings.

Cybercriminals are looking to new targets, including mobile commerce, making it difficult to manage specific defenses, he said. "The technology's changing so quickly, and the attack vectors are going to change," he added.

Still, many of the previous data breaches in the U.S. happened because the companies were not following basic security practices, such as regularly patching software and encrypting personal data, said Edith Ramirez, chairwoman of the U.S. Federal Trade Commission. Ramirez called on Congress to pass a law mandating basic security practices and requiring companies to notify consumers of data breaches.

"I think it's time for Congress to act," she said. "Companies continue to make very basic mistakes when it comes to data security."

Many committee members agreed. The committee will try to pass legislation this year, said Representative Joe Barton, a Texas Republican.

Other committee members questioned the need for data security regulations. It will be difficult for Congress to define data security standards when cyberattacks are changing so quickly, said Representative Marsha Blackburn, a Tennessee Republican.

Consumers should be responsible for protecting their personal information, not companies they do business with, suggested Representative Mike Pompeo, a Kansas Republican.

Ramirez disagreed. "I don't believe the burden should be placed on consumers," she said. "There are steps consumers can take to be vigilant in this area, but ... companies continue to make very fundamental mistakes when it comes to security."

Customers should be able to choose where to shop, based on security risks, without the government stepping in, Pompeo said. "If you think your material is going to be stolen from your home, you can buy a home security system," he said. "There are a lot of places where there are risks to private property, and we allow consumers to step in and decide if they want to pay ... for their own security."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is grant_gross@idg.com.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags governmentregulationlegislationTargetU.S. House of Representatives Energy and Commerce CommitteeU.S. Secret ServiceJoe BartonMarsha BlackburnNeiman MarcusPhillip SmithWilliam NoonanTrustwave HoldingsMichael KingstonMike Pompeo

Featured

Slideshows

Reseller News kicks off awards season in 2019 with Judges' Lunch

Reseller News kicks off awards season in 2019 with Judges' Lunch

The 2019 Reseller News Innovation Awards has kicked off with the Judges Lunch in Auckland with 70 judges in the voting panel. The awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors. Photos by Christine Wong.

Reseller News kicks off awards season in 2019 with Judges' Lunch
Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

The channel came together for the inaugural Reseller News Emerging Leaders Forum in New Zealand, created to provide a program that identifies, educates and showcases the upcoming talent of the ICT industry. Hosted as a half day event, attendees heard from industry champions as keynoters and panelists talked about future opportunities and leadership paths and joined mentoring sessions with members of the ICT industry Hall of Fame. The forum concluded with 30 Under 30 Tech Awards across areas of Sales, Entrepreneur, Marketing, Management, Technical and Human Resources. Photos by Gino Demeer.

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019
Show Comments