Target finally gets its first CISO
That it often takes a data breach to get one is a sad reality for many companies, analyst says
Computerworld - Target has hired a chief information security officer (CISO), a move that's noteworthy mainly because it is the first time the company has ever had anyone in this role, even though it is one of the largest retailers in the U.S.
Target on Tuesday announced that Brad Maiorino is its new senior vice president and CISO. In that role, Maiorino will be responsible for managing Target's technology risk strategy and for taking steps to avoid a repeat of the massive data breach at the company last year.
Maiorino was previously the chief information security and information technology risk officer at General Motors, where he was responsible for overhauling the auto maker's global information security organization, Target said in a statement.
Prior to GM, Maiorino was CISO at General Electric. As Target's CISO, Maiorino will report to Bob DeRodes, the company's recently appointed CIO.
Target's decision to hire Maiorino comes about six months after the company disclosed a massive breach that exposed data on about 40 million credit and debit cards and personal data on about 70 million customers.
Target's security practices came under intense scrutiny following the breach, with many faulting the company for not having basic precautions in place for detecting and responding to the intrusion. The breach has already cost Target's former CIO Beth Jacobsen her job and was at least partly responsible for Target CEO Gregg Steinhafel's decision to step down as well.
Recently, Institutional Shareholder Services (ISS), a company that advises institutional shareholders on governance risk and proxy voting issues, said it wanted seven of Target's 10 board directors voted out for not paying enough attention to data security risks.
The report noted that Target's board should have been aware, even before the breach, of the possibility of theft of sensitive information given the company's size and the number of credit and debit card transactions it handles.
Consequently, the company's move to appoint a new CISO and a chief compliance office appears to be a case of too little too late, ISS noted. "The addition of these 'new' positions raises serious concern about how Target could have been running a business of its size and complexity without these permanent roles," the report said.
Target, though, is not the only large company guilty of such oversight.
Neiman Marcus, another big name retailer that suffered a recent data breach, is also only now looking to hire a CISO. In a recent job ad, the company said it is looking for a vice president and chief information security officer to establish and maintain an enterprise-wide information security program.
The position will be responsible for "identifying, evaluating and reporting on security risks in a manner that meets or exceeds compliance and regulatory requirements," the job ad noted.
A recent survey-based report by PwC on the state of U.S. information security practices (download PDF) found that a "vast majority" of the companies that participated had cybersecurity programs that fell well short of recommended best practices. For instance, just 28% of the companies had a CISO.
The fact that many companies, including large ones like Target, get religious about security only after a breach is a surprising, but "sad reality," said Richard Stiennon, principal security analyst at IT-Harvest.
Companies like Target should have hired a CISO years ago -- particularly after breaches at companies like TJX, which highlighted the threat retailers face, Stiennon said. "Nobody pays attention to security until after an intrusion. It is the same story playing out even after a decade" of high-profile breaches.
Target's decision to choose a security executive from the manufacturing industry is also interesting because it would have made more sense for the company to hire someone with experience in retail, Stiennon added.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!