Which lesson from the Target breach most directly addresses the risk created when a supplier has access to corporate systems?

### Why this is right The Target case involved attackers entering through a third-party heating, ventilation, and air-conditioning vendor. The stated lesson is to strengthen vendor risk management and restrict third-party access so that an external connection does not create unnecessary exposure. ### The concept Organizations often rely on suppliers, but supplier access can introduce security risk. Governance should establish who may connect, what systems they may reach, and how that access is controlled and monitored. Network segmentation adds a further boundary, limiting movement if an account or connection is compromised. ### The other options - **B. Allow vendors unrestricted access so they can resolve issues quickly.** This increases exposure and contradicts the lesson of strict access controls. - **C. Replace incident response planning with employee awareness training.** Training and response planning serve different purposes; neither replaces vendor controls. - **D. Focus on recovery only after all third-party connections are removed.** Removing all supplier connections is not the stated lesson; controlled access and risk management are. ### Terms - **Third-party access control**: Rules and safeguards that limit an external provider’s access to organizational systems. - **Network segmentation**: Separating network areas to restrict access and limit the spread of an intrusion. ### Remember Give vendors only the access they need, and limit how far that access can reach.