Vulnerabilities / Threats
6/24/2014
09:27 AM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Despite Target, Retailers Still Weak On Third-Party Security

A new survey from TripWire shows mixed results about retailers' security practices.

The big Target breach last year was actually the second stage of an attack that began by breaching the retail giant's third-party HVAC subcontractor (although the general public seems to forget that fact). This should have taught companies a lesson about the risks of letting business partners run pell-mell around one's network without paying any mind to their own security posture. However, according to new research from TripWire, at least one-quarter of retailers have not yet learned that lesson.

On one end of the spectrum, 12% of retailers who responded say they require third-party partners to pony up regular reports on vulnerability scans on their network and Web applications. On the other end of the spectrum, 26% said, "We don't evaluate the security of our business partners."

In fact only 70% of respondents said that the Target breach affected the level of attention that their businesses' executives pay to security. This number was even lower (57%) for online-only retailers.

Happily, 60% of respondents said they could identify a breach within 72 hours, 7% said they could do it in a month, and 1% within three months. However, a full 20% simply admitted that they weren't confident they could identify breaches quickly -- and that's particularly discouraging if within three months is considered "quickly."

Some 18% confessed that they were "not at all confident" that their security controls could detect rogue applications (including malware), 35% said they were very confident, and the rest said they were "somewhat" confident.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/30/2014 | 10:23:34 AM
Hard to believe
I find it hard to believe that 60% of respondents can really identify a breach within 72 hours. Maybe they get an alert, but what happens after that? 
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/30/2014 | 12:57:27 AM
Third-parties
On the other end of the spectrum, 26% said, "We don't evaluate the security of our business partners."

I'm glad you mentioned the HVAC contractor as the entry point. I think this breach should serve as as a reminder of just how interconnected businesses and their partners can be when it comes to network access and security and what the implications of that can be.

BP
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
6/24/2014 | 10:35:46 AM
Change the Game
We really need to get to a widespread chip-and-PIN system, which would make it harder for scammers to make duplicate credit cards w/ stolen card numbers. Tokenization would also go a long way in making stored data less of a target. Without these kinds of wholesale changes, even the most diligent and vigilant retailers are still going to be vulnerable.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.