In the Target breach described in the material, which governance weakness helped attackers move from a third-party vendor’s access to broader systems?

### Why this is right The case identifies inadequate network segmentation as a governance failure that allowed unauthorized access to reach systems beyond the third-party entry point. Segmentation separates networks or systems so that access to one area does not automatically provide access to others. ### The concept A third-party connection can create risk because a vendor’s access may become a path into the organization. Access should be limited to what the vendor needs, and network boundaries should restrict movement between systems. Monitoring can help detect suspicious activity, but it does not replace access restrictions or segmentation. ### The other options - **B. Excessive employee cybersecurity training.** The case identifies vendor risk management and segmentation failures, not excessive training, as weaknesses. - **C. Overly frequent incident-response exercises.** Exercises prepare teams; they are not identified as a cause of the breach. - **D. The use of continuous monitoring.** Monitoring is presented as a security lesson, not as a cause of unauthorized access. ### Terms - **Network segmentation**: Dividing a network into separated areas to restrict access and limit the spread of an intrusion. - **Third party**: An external organization, such as a vendor, that provides services or has access to an organization’s systems. ### Remember A vendor’s access should be bounded, and network separation should limit where that access can lead.