RESPOND TO THESE DISCUSSION POST BASED ON THE TOPIC “Incident response is an important component in a security awareness program. While not all incidents can be prevented, incident response capabilities can promptly detect and reduce the losses resulting from security attacks.
 

In September 2014, Home Depot stated that over 56 million credit cards had been compromised in a five-month cyber-attack on their payment systems. This attack simply highlighted the vulnerability of the U.S. retail store’s payment systems. Research the Home Depot incident and reflect on the basic elements of an incident response plan and the attack vectors.
 

In your initial post, answer the following questions:

Was the Home Depot incident handled correctly? Incorrectly?

Could more have been done? If so, what?

Then, thoughtfully respond to your classmates. Give feedback as to whether you think their ideas model elements of an incident response plan. Are there other real-life scenarios that you can use to identify ways of handling cyber-attacks correctly or incorrectly?.” (TWO (2) PARAGRAPHS EACH WITH REFERENCES ON EACH OF THEM SEPARATELY, NOT TOGETHER)

1.vIrIA pAtT  

In September 2014 Home Depot was the compromised by a cyber-attack. “Hackers used a vendor’s stolen log-on credentials to penetrate Home Depot’s computer network and install custom-built malware that stole customer payment-card data and e-mail addresses, the retailer announced Thursday.” (Winter, 2014) It was later found this software was installed on the stores self-checkout registers. One downfall I believe Home Depot had was not having the proper crisis planning in place. Home Depot originally stated that only customers credit card information had been affected. This later turned into customers email addresses being affected but the company was still unsure of if customers using checks were in danger. If Home Depot had a proper plan and team in place they might have been able to reduce the severity of the incident. Also, it was found that “Home Depot didn’t have secure configuration of the software or hardware on the POS terminals. There was no proof of regularly scheduled vulnerability scanning of the POS environment.” (Institute, 2017) To me this brings up the question shouldn’t Home Depot had a better security system in place or even scanned its environment considering Target had a major credit card breach in December 2013? In the end Home Depot announced that it will be installing an enhanced encryption data system as well as providing credit card monitoring and a $50 gift card to all loyal customers.

2.aLxY bLmS). INC RSP

The hackers that perpetrated the data breach of Home Depot in 2014 were able to use 3rd party vendor credentials to gain entry to the Home Depot network (Hawkins, 2015).  Once inside the network they utilized memory (RAM) scraping technology to obtain the payment information of customers (Hawkins, 2015).  In response to these attacks, Home Depot rolled increased security measures of enhanced encryption and the use of EMV Chip-and-pin technology (Home Depot, 2014).  While Home Depot was already in the process of implementing encryption technology; however, the breach hastened the company’s efforts to roll out the technology to all of its store locations (Home Depot, 2014).  The company’s use of Chip-and-pin technology added additional layers of security and protection for the payment cards of clients (Hawkins, 2015).

It is not apparent from reporting whether the company was completing monthly vulnerability scanning of its network (Hawkins, 2015).  With this security measure in place, they may have detected the breach sooner and decreased the impact of the intrusion.  It is absolutely critical that the payment system should have been segregated from the rest of the network, in order to protect the system’s other assets (Cichonski).  In addition, a training program, regarding the lessons learned from the data breach would be beneficial to help employees become better equipped to partner in protecting the network from unauthorized access.

3.tYlR rSpNsE).inc RSPN

I believe that the Home Depot data breach was responded to in a timely fashion which could not be said about other breaches such as Target.  This does allow people more time to turn their cards off and investigate any fraudulent charges, the longer you wait the more severe the consequences.  With that being said I do believe that Home Depot should have learned from other breaches that happened years before it (Kohgadai, 2016).  One major takeaway is the Point of Sale System that are in use in America.  The switch to EMV- Chip Cards could have prevented the malware on the POS from stealing the card info.  We as a country must move away from magnetic strips, these data storage vessel are unencrypted and pose a serious security threat (Hawkins, 2015).  The best way to respond to a breach is to prevent it from happening in the first place.

PLEASE READ THIS.IT IS VERY IMPORTANT

Allow your discussion posts to be detailed and capable of sharing knowledge, ideas and points.  You must discuss the topic using your own words first.  Using your own words indicate you understand the topic of discussions.  Secondly, you must cite your sources in-text.  This is necessary to justify your points. Sources from several sources showed good research abilities.  Lastly, you must provide references at the bottom of your post.  A discussion post without justification with sources does not show proper research abilities. A terse and not detailed discussions represent post that would not provide enough sharing of knowledge or proper understanding of the topic. DO NOT just copy and paste a sentence from online with citation at the end as your own discussion. I have not asked for definitions, I asked for discussions and will not buy this.  You must show understanding of the discussion topic by using your own words to describe the topic and then justify that with sources.

www.citationmachine.net to format references into the APA style if necessary. Extremely important. Intext citations is very essential and highly needed as well.