Vulnerabilities / Threats

6/24/2014
09:27 AM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Despite Target, Retailers Still Weak On Third-Party Security

A new survey from TripWire shows mixed results about retailers' security practices.

The big Target breach last year was actually the second stage of an attack that began by breaching the retail giant's third-party HVAC subcontractor (although the general public seems to forget that fact). This should have taught companies a lesson about the risks of letting business partners run pell-mell around one's network without paying any mind to their own security posture. However, according to new research from TripWire, at least one-quarter of retailers have not yet learned that lesson.

On one end of the spectrum, 12% of retailers who responded say they require third-party partners to pony up regular reports on vulnerability scans on their network and Web applications. On the other end of the spectrum, 26% said, "We don't evaluate the security of our business partners."

In fact only 70% of respondents said that the Target breach affected the level of attention that their businesses' executives pay to security. This number was even lower (57%) for online-only retailers.

Happily, 60% of respondents said they could identify a breach within 72 hours, 7% said they could do it in a month, and 1% within three months. However, a full 20% simply admitted that they weren't confident they could identify breaches quickly -- and that's particularly discouraging if within three months is considered "quickly."

Some 18% confessed that they were "not at all confident" that their security controls could detect rogue applications (including malware), 35% said they were very confident, and the rest said they were "somewhat" confident.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/30/2014 | 10:23:34 AM
Hard to believe
I find it hard to believe that 60% of respondents can really identify a breach within 72 hours. Maybe they get an alert, but what happens after that? 
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/30/2014 | 12:57:27 AM
Third-parties
On the other end of the spectrum, 26% said, "We don't evaluate the security of our business partners."

I'm glad you mentioned the HVAC contractor as the entry point. I think this breach should serve as as a reminder of just how interconnected businesses and their partners can be when it comes to network access and security and what the implications of that can be.

BP
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
6/24/2014 | 10:35:46 AM
Change the Game
We really need to get to a widespread chip-and-PIN system, which would make it harder for scammers to make duplicate credit cards w/ stolen card numbers. Tokenization would also go a long way in making stored data less of a target. Without these kinds of wholesale changes, even the most diligent and vigilant retailers are still going to be vulnerable.
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
BlueBorne Attack Highlights Flaws in Linux, IoT Security
Kelly Sheridan, Associate Editor, Dark Reading,  12/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.