Vendor Access as an Attack Path

Brian Krebs reported on 5 February 2014 that the intrusion began with credentials stolen from Fazio Mechanical Services, a refrigeration and air conditioning contractor based in Sharpsburg, Pennsylvania. Attackers first accessed Target's network on 15 November 2013.

The detail most often lost is what that access was for. In a statement quoted in that reporting, Fazio's president said the company's data connection to Target was exclusively for electronic billing, contract submission, and project management. It was not a connection to building controls. The popular telling in which attackers pivot through a thermostat is not what the sources say, and the real version is more instructive: the account was mundane, which is exactly why it was available.

Fazio's own compromise was attributed to a phishing attack, reported by outlets including SC Media and Dark Reading, occurring at least two months before card data was taken. From the initial foothold, malware was tested on selected point-of-sale registers between 15 and 28 November, deployed more broadly in late November, and used to harvest card data from 27 November to 15 December 2013, affecting roughly 40 million card accounts, with exfiltration routed through compromised servers abroad. The US Senate Commerce Committee published a kill chain analysis in March 2014 that remains a useful primary document.

The often quoted figure of several hundred million dollars originated as a Gartner analyst estimate of potential losses rather than a reported cost, and should be described that way or omitted.

The step the sources do not fully document

They are exempted from controls as a matter of practicality. Multi-factor enrolment, device requirements, and password policy are built around employees with corporate identities and managed devices. Vendors have neither, so exceptions are made at onboarding, and exceptions persist indefinitely because nothing prompts a review.

Nobody owns their lifecycle. An employee leaving triggers deprovisioning. A contract ending triggers an invoice. Vendor accounts commonly outlive the engagements that justified them, and the organisation has no signal that they should be closed.

Access is granted at the level of a system, not a task. A vendor needing to submit invoices gets an account on a platform that can reach other things. The gap between what the vendor needs and what the account can touch is the attack surface, and it is usually never measured.

The vendor's own security is invisible to you. Fazio was compromised by phishing, which is entirely outside Target's control. Any assessment of a supplier is a point-in-time claim about a moving target.

Shared credentials are common in the contractor world. Small suppliers frequently share one login across staff, which destroys attribution and means the credential survives staff turnover.

Segmentation, above everything else. The question is not whether an attacker can obtain a vendor credential, because eventually one can. It is what that credential can reach. A billing portal should not be able to route to systems processing payments, and enforcing that is a network design decision rather than an identity one.

Egress and lateral movement monitoring. A foothold has to move to be useful, and that movement looks anomalous against a baseline: a billing account touching internal hosts it has never touched, at hours it has never been used. Detecting it requires that someone established what normal looks like.

Least privilege scoped to the task. Access to submit an invoice is not access to a network. Where a vendor needs a specific function, exposing that function rather than a general path removes the pivot entirely.

A vendor account register with expiry. Every external account tied to a contract, an owner, and a review date, with expiry as the default rather than something requested. This is the control that closes the accounts nobody remembers.

Phishing-resistant authentication where you can require it. You cannot fix a supplier's internal security, but you can require strong authentication on the access they have to you, and make it a condition of the connection rather than a preference.

Watch for detection that fires and is not acted on. In several large breaches, alerting produced signals during the intrusion and they were not escalated. Investing in detection without investing in the triage path behind it buys the evidence for the postmortem and not the outcome.