6 ms·

Target CIO resigns amid breach investigations

42 points by at-fates-hands 13y ago

brudgers 13y ago
'Target CEO Gregg Steinhafel described the search for an interim CIO as a “first step.”' Well actually the first step was scapegoating the CIO rather than those responsible for putting someone without an IT background in the position. This was the failure of institutional culture, not an individual who accepted an offered promotion to a level but not a position for which they were qualified. Target's hiring of a consultant specializing in risk management and regulatory compliance says it all. The culture hasn't changed and Target's board still doesn't see technological expertise as a core skill.
- chaostheory 13y ago
  "Jacob, who holds an M.B.A. from the University of Minnesota, first joined the company in 1984 as a department store assistant buyer when it was known as Dayton’s, then left and returned in 2002 to Target as director of guest contact centers. She was promoted to CIO and executive vice president of Target Technology Services in 2008, and reported to Steinhafel." Yes, whoever promoted Jacob to CIO should also resign.
  - brudgers 13y ago
    To me, it looks like a corporate culture where CIO was just another position and happened to be the one that was open when it was her turn to be promoted. It's the sort of decision of which the board and senior management would all be aware.
    - babesh 13y ago
      They still don't seem to know what happened. That is not good.
    - logicallee 13y ago
      Didn't you mean to say that she was the one who happened to be available, when the position needed to be filled? If it's "her turn to be promoted" I find that they just invent an appropriate title.
    - at-fates-hands 13y ago
      I've been told Target is a total shark tank. If you come in and show potential (whatever your background is) they go to great lengths to push you up the hierarchy and get you promoted. Those managers who don't have "The drive" as they call it, are effectively culled from the herd and never promoted and languish in middle management until they either move on or let go. Judging by her youthful looks, I'd say she was clearly on one of these "fast tracks" and landed in the CIO position exactly as you pointed out.
      - nobleach 13y ago
        I worked at Target while in college. The people that were brought in as managers (execs) were not people I had ever met. They'd show up one day from some internship program, and bam 6 months later, they'd be in charge of everything. That said, the people typically were top notch... so I couldn't complain about their management abilities. We'd always say, "they showed up already promoted". It was college life for me though, so I had no illusions of ever wanting to be more than a minimum wage salesfloor guy for a couple of years. 15 years later, and I still have dreams that I still somehow am employed there, and I just happen to check the schedule... and CRAP, I have a shift this week!
  - rasz_pl 13y ago
    Nah, I bet she has a bunch of certs and knows PCI by heart. I also bet that Target is covered on paper. This is how big business operates. They dont care about real security of data, all they care is compliance.
    - at-fates-hands 13y ago
      >>> They dont care about real security of data, all they care is compliance. Not so sure about that either: http://arstechnica.com/uncategorized/2008/08/target-to-pay-6-million-to-settle-site-accessibility-suit/ http://arstechnica.com/uncategorized/2008/08/target-to-pay-6... "Target has settled a class action lawsuit with the National Federation of the Blind over accessibility complaints with Target.com. Despite the law being unclear as to whether the Americans with Disabilities Act (ADA) applies to websites, the company will pay a substantial fee and update its web site to make it accessible to the blind." This was after repeated appeals by the NFB to have them correct the site. It took a class action lawsuit for them to actually to do something. Even then Target sought to have the case dismissed: http://en.wikipedia.org/wiki/National_Federation_of_the_Blind_v._Target_Corporation http://en.wikipedia.org/wiki/National_Federation_of_the_Blin... "Target moved to dismiss the case, claiming its brick and mortar stores are accessible to the blind, and that civil rights laws apply to the accessibility of its stores."
- taivare 13y ago
  From experience, they hire top level by religious affinity however, this time they most likely were burned by this tradition.
  - rhizome 13y ago
    What religion?
    - firebones 13y ago
      I wonder if the poster is referring to this. http://www.theawl.com/2010/08/real-america-the-ceo-of-target-and-the-anti-gay-christian-right http://www.theawl.com/2010/08/real-america-the-ceo-of-target... Not so much affinity, as ideology?
- rasz_pl 13y ago
  CIOs are actively discouraged from possessing any IT background. Just look at the retardation UW is teaching: https://www.coursera.org/course/inforiskman https://www.coursera.org/course/inforiskman https://www.coursera.org/course/inforisk https://www.coursera.org/course/inforisk https://www.coursera.org/course/infosec https://www.coursera.org/course/infosec Those "people", they call themselves teachers/professionals in the field, will tell you that Information Security is ALL about covering your ass and shifting blame to a third party. All three courses are about getting a slip of paper that says you delegated responsibility clearing your company from any lawful obligations in case of a breach. Not a single peep about technical aspects or real security of data/infrastructure. Its all about getting that "we paid company X to do it for us" waiver. There was (deleted now) a huge thread on Coursera forum titled Disappointment covering this topic and demonstrating total lack of professionalism or any real world knowledge. Whole UW program is a government funds skimming scheme. Just look at this garbage: "Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research" I highly encourage you to check out those courses (I think there is preview available for old lectures) if you are in need of a laugh, or reality check concerning state of CIO education.
  - brudgers 13y ago
    Every Coursera course has a big thread labled "disappointed" or words to that effect.
    - hga 13y ago
      Do they all have specifics like razl_pl says, and do they all get deleted?
rdl 13y ago
I actually think the Target CISO (or CIO maybe) job would be awesome. Target as a company overall is great; they might not be up to standard on IT/IT Security, but now that the board sees how IT and IT security can affect their bottom line (or indeed existence), whoever takes the role should be able to do amazing things. Plus, it's high visibility when you succeed.
- redbeard0x0a 13y ago
  > Plus, it's high visibility when you succeed. Actually, no. That is one of the biggest problems with properly functioning IT systems, they become invisible - nobody notices until something screws up...
  - rdl 13y ago
    In general, yes, but after a company has gotten fucked as much as Target, it's pretty easy to turn this into a high-profile "we must bring the US payment card industry into the 1980s!" position.
  - chaz 13y ago
    I think that's true at smaller organizations where the head of IT isn't on the exec team. But at large companies, the head of IT is a pretty serious role (Jacob was CIO/EVP), with a very large budget, mission-critical systems, and a big team. Someone who successfully runs IT at a company like Target can pretty much get hired into a similar role at any other Fortune 500 company.
- rhizome 13y ago
  Have you ever worked with POS systems before?
  - rdl 13y ago
    Sadly, yes (retrofitting NFC into them, basically the inverse of what Square does, in 2003)
- codeonfire 13y ago
daphneokeefe 13y ago
It says in the linked article "The primary responsibility for information protection ultimately falls on the Target Information Protection team, a group separate from Target Technology Services that reports up through Bjerke to Target Financial Services, an arm of the company that handles credit and noncorporate financial operations, the person said." So the woman who is the scapegoat wasn't even responsible for data security?
new_corp_dev 13y ago
I have worked at the Walmart home office, and if Target's corporate culture is remotely like Walmart's I can tell you their former CIO likely knew half as much about Target's security practices as any of us do. Walmart has zero career paths for technical expertise. There are low-level technical positions (rarely entry-level) and they peak at "Technical Expert", and to get past that you have to switch to pure people management. The IT division, internally called ISD, is so completely inept that the majority of the company still runs on Windows XP despite the fact that support will expire in about a month. They had a Windows 7 team at one point, but that team was dissolved and the rollout "suspended indefinitely". ISD is so universally recognized as terrible that they were actually the only reason I had a job there. Individual departments and divisions have been forming their own "IT Teams" for years, because it's a hell of a lot cheaper to pay somebody $70,000/year to create a half a dozen new applications yearly than it is to pay ISD $2.8 million to do one of those applications poorly over the course of two years. And then completely dissolve the development team responsible and offer little to no ongoing support for the application. Despite those exorbitant costs ISD is hemorrhaging money just trying desperately to keep the lights on, mostly because they're still running decades-old legacy applications and hardware. They only recently started drawing up plans to start sunsetting some of the hundreds of legacy systems over the course of the next decade or so. This is really just scratching the surface of how terrible retail IT can be, and how little they value real technical expertise. Given what I've seen I wasn't so much surprised that the Target et al breach happened, only that it didn't also include Walmart or happen much sooner.
- rdl 13y ago
  Particularly sad because in the 1980s/1990s, IT was supposed to have been one of Walmart's competitive strengths (EDI focused interactions with suppliers, realtime inventory tracking, etc.). Maybe they're suffering because they were early and now have a bunch of legacy stuff to support.
- nemothekid 13y ago
  Huh, I thought Walmart would be better as the Walmart Labs team seems fairly confident. IS Walmart labs different from Walmart IT?
alayne 13y ago
Does Target still run on mainframes?
- Shivetya 13y ago
  Out of curiosity, do you think that would be bad if they did? Also, how big of a machine do you need to have before its considered a mainframe?
- ja27 13y ago
  I don't know about Target because they were one of the few major retailers we never sold to, but most of the rest run at least parts of their business on IBM mainframes. It was very common for us to work on integration projects between Windows or AIX boxes at stores and data centers and the mainframe(s). I would never claim that mainframes are fuckup-proof, but they generally are much better protected than the Windows / AIX boxes. It wasn't uncommon for us to be able to get any of a half-dozen IT guys with sudo / root to quickly make any change we needed on an AIX box, but then to make a change on a mainframe we'd have to set up a meeting with multiple people and discuss the changes. We fought one losing battle over extending a record format: "We haven't even recompiled that code in 7 years."

'Target CEO Gregg Steinhafel described the search for an interim CIO as a “first step.”' Well actually the first step was scapegoating the CIO rather than those responsible for putting someone without an IT background in the position. This was the failure of institutional culture, not an individual who accepted an offered promotion to a level but not a position for which they were qualified. Target's hiring of a consultant specializing in risk management and regulatory compliance says it all. The culture hasn't changed and Target's board still doesn't see technological expertise as a core skill.

chaostheory 13y ago
"Jacob, who holds an M.B.A. from the University of Minnesota, first joined the company in 1984 as a department store assistant buyer when it was known as Dayton’s, then left and returned in 2002 to Target as director of guest contact centers. She was promoted to CIO and executive vice president of Target Technology Services in 2008, and reported to Steinhafel." Yes, whoever promoted Jacob to CIO should also resign.
- brudgers 13y ago
  To me, it looks like a corporate culture where CIO was just another position and happened to be the one that was open when it was her turn to be promoted. It's the sort of decision of which the board and senior management would all be aware.
  - babesh 13y ago
    They still don't seem to know what happened. That is not good.
  - logicallee 13y ago
    Didn't you mean to say that she was the one who happened to be available, when the position needed to be filled? If it's "her turn to be promoted" I find that they just invent an appropriate title.
  - at-fates-hands 13y ago
    I've been told Target is a total shark tank. If you come in and show potential (whatever your background is) they go to great lengths to push you up the hierarchy and get you promoted. Those managers who don't have "The drive" as they call it, are effectively culled from the herd and never promoted and languish in middle management until they either move on or let go. Judging by her youthful looks, I'd say she was clearly on one of these "fast tracks" and landed in the CIO position exactly as you pointed out.
    - nobleach 13y ago
      I worked at Target while in college. The people that were brought in as managers (execs) were not people I had ever met. They'd show up one day from some internship program, and bam 6 months later, they'd be in charge of everything. That said, the people typically were top notch... so I couldn't complain about their management abilities. We'd always say, "they showed up already promoted". It was college life for me though, so I had no illusions of ever wanting to be more than a minimum wage salesfloor guy for a couple of years. 15 years later, and I still have dreams that I still somehow am employed there, and I just happen to check the schedule... and CRAP, I have a shift this week!
- rasz_pl 13y ago
  Nah, I bet she has a bunch of certs and knows PCI by heart. I also bet that Target is covered on paper. This is how big business operates. They dont care about real security of data, all they care is compliance.
  - at-fates-hands 13y ago
    >>> They dont care about real security of data, all they care is compliance. Not so sure about that either: http://arstechnica.com/uncategorized/2008/08/target-to-pay-6-million-to-settle-site-accessibility-suit/ http://arstechnica.com/uncategorized/2008/08/target-to-pay-6... "Target has settled a class action lawsuit with the National Federation of the Blind over accessibility complaints with Target.com. Despite the law being unclear as to whether the Americans with Disabilities Act (ADA) applies to websites, the company will pay a substantial fee and update its web site to make it accessible to the blind." This was after repeated appeals by the NFB to have them correct the site. It took a class action lawsuit for them to actually to do something. Even then Target sought to have the case dismissed: http://en.wikipedia.org/wiki/National_Federation_of_the_Blind_v._Target_Corporation http://en.wikipedia.org/wiki/National_Federation_of_the_Blin... "Target moved to dismiss the case, claiming its brick and mortar stores are accessible to the blind, and that civil rights laws apply to the accessibility of its stores."
taivare 13y ago
From experience, they hire top level by religious affinity however, this time they most likely were burned by this tradition.
- rhizome 13y ago
  What religion?
  - firebones 13y ago
    I wonder if the poster is referring to this. http://www.theawl.com/2010/08/real-america-the-ceo-of-target-and-the-anti-gay-christian-right http://www.theawl.com/2010/08/real-america-the-ceo-of-target... Not so much affinity, as ideology?
rasz_pl 13y ago
CIOs are actively discouraged from possessing any IT background. Just look at the retardation UW is teaching: https://www.coursera.org/course/inforiskman https://www.coursera.org/course/inforiskman https://www.coursera.org/course/inforisk https://www.coursera.org/course/inforisk https://www.coursera.org/course/infosec https://www.coursera.org/course/infosec Those "people", they call themselves teachers/professionals in the field, will tell you that Information Security is ALL about covering your ass and shifting blame to a third party. All three courses are about getting a slip of paper that says you delegated responsibility clearing your company from any lawful obligations in case of a breach. Not a single peep about technical aspects or real security of data/infrastructure. Its all about getting that "we paid company X to do it for us" waiver. There was (deleted now) a huge thread on Coursera forum titled Disappointment covering this topic and demonstrating total lack of professionalism or any real world knowledge. Whole UW program is a government funds skimming scheme. Just look at this garbage: "Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research" I highly encourage you to check out those courses (I think there is preview available for old lectures) if you are in need of a laugh, or reality check concerning state of CIO education.
- brudgers 13y ago
  Every Coursera course has a big thread labled "disappointed" or words to that effect.
  - hga 13y ago
    Do they all have specifics like razl_pl says, and do they all get deleted?

rdl 13y ago

I actually think the Target CISO (or CIO maybe) job would be awesome. Target as a company overall is great; they might not be up to standard on IT/IT Security, but now that the board sees how IT and IT security can affect their bottom line (or indeed existence), whoever takes the role should be able to do amazing things. Plus, it's high visibility when you succeed.

redbeard0x0a 13y ago
> Plus, it's high visibility when you succeed. Actually, no. That is one of the biggest problems with properly functioning IT systems, they become invisible - nobody notices until something screws up...
- rdl 13y ago
  In general, yes, but after a company has gotten fucked as much as Target, it's pretty easy to turn this into a high-profile "we must bring the US payment card industry into the 1980s!" position.
- chaz 13y ago
  I think that's true at smaller organizations where the head of IT isn't on the exec team. But at large companies, the head of IT is a pretty serious role (Jacob was CIO/EVP), with a very large budget, mission-critical systems, and a big team. Someone who successfully runs IT at a company like Target can pretty much get hired into a similar role at any other Fortune 500 company.
rhizome 13y ago
Have you ever worked with POS systems before?
- rdl 13y ago
  Sadly, yes (retrofitting NFC into them, basically the inverse of what Square does, in 2003)
codeonfire 13y ago

daphneokeefe 13y ago

It says in the linked article "The primary responsibility for information protection ultimately falls on the Target Information Protection team, a group separate from Target Technology Services that reports up through Bjerke to Target Financial Services, an arm of the company that handles credit and noncorporate financial operations, the person said." So the woman who is the scapegoat wasn't even responsible for data security?

new_corp_dev 13y ago

I have worked at the Walmart home office, and if Target's corporate culture is remotely like Walmart's I can tell you their former CIO likely knew half as much about Target's security practices as any of us do. Walmart has zero career paths for technical expertise. There are low-level technical positions (rarely entry-level) and they peak at "Technical Expert", and to get past that you have to switch to pure people management. The IT division, internally called ISD, is so completely inept that the majority of the company still runs on Windows XP despite the fact that support will expire in about a month. They had a Windows 7 team at one point, but that team was dissolved and the rollout "suspended indefinitely". ISD is so universally recognized as terrible that they were actually the only reason I had a job there. Individual departments and divisions have been forming their own "IT Teams" for years, because it's a hell of a lot cheaper to pay somebody $70,000/year to create a half a dozen new applications yearly than it is to pay ISD $2.8 million to do one of those applications poorly over the course of two years. And then completely dissolve the development team responsible and offer little to no ongoing support for the application. Despite those exorbitant costs ISD is hemorrhaging money just trying desperately to keep the lights on, mostly because they're still running decades-old legacy applications and hardware. They only recently started drawing up plans to start sunsetting some of the hundreds of legacy systems over the course of the next decade or so. This is really just scratching the surface of how terrible retail IT can be, and how little they value real technical expertise. Given what I've seen I wasn't so much surprised that the Target et al breach happened, only that it didn't also include Walmart or happen much sooner.

rdl 13y ago
Particularly sad because in the 1980s/1990s, IT was supposed to have been one of Walmart's competitive strengths (EDI focused interactions with suppliers, realtime inventory tracking, etc.). Maybe they're suffering because they were early and now have a bunch of legacy stuff to support.
nemothekid 13y ago
Huh, I thought Walmart would be better as the Walmart Labs team seems fairly confident. IS Walmart labs different from Walmart IT?

alayne 13y ago

Does Target still run on mainframes?

Shivetya 13y ago
Out of curiosity, do you think that would be bad if they did? Also, how big of a machine do you need to have before its considered a mainframe?
ja27 13y ago
I don't know about Target because they were one of the few major retailers we never sold to, but most of the rest run at least parts of their business on IBM mainframes. It was very common for us to work on integration projects between Windows or AIX boxes at stores and data centers and the mainframe(s). I would never claim that mainframes are fuckup-proof, but they generally are much better protected than the Windows / AIX boxes. It wasn't uncommon for us to be able to get any of a half-dozen IT guys with sudo / root to quickly make any change we needed on an AIX box, but then to make a change on a mainframe we'd have to set up a meeting with multiple people and discuss the changes. We fought one losing battle over extending a record format: "We haven't even recompiled that code in 7 years."