Risk
10/30/2013
06:35 AM
Tim Wilson
Tim Wilson
Quick Hits
Connect Directly
RSS
E-Mail
50%
50%

Study: Cyber Monday Attacks Cost Enterprises Up To $3.4M Per Hour

Holiday shopping season is popular time for launch of sophisticated attacks, RSA study says

The upcoming holiday shopping season could be prime time for attackers who hope to catch enterprises at their weakest moments, according to a study published this week.

According to a new survey of 1,100 retail companies conducted by the Ponemon Institute and sponsored by RSA, daily revenue surges by an average of 55 percent during the holiday season. If a retail site is hacked or disabled, average losses may amount to as much as $500,000 per hour, or $8,000 per minute.

Two-thirds of respondents (66 percent) said that such a disruption would also result in customer churn that would damage reputation and brand, pushing losses as high as $3.4 million from a single hour of disruption.

"This time of year is not just an opportunity for retail fraud, but an opportunity to launch attacks that take advantage of business logic vulnerabilities, DDoS [distributed denial-of-service] attacks, and more sophisticated attacks as well," says Demetrios Lazarikos, IT threat strategist at RSA.

Yet while 64 percent of organizations said they see significant increases in attack activity during the holidays, more than 70 percent of organizations do not take additional precautions in anticipation of increased attacks. And with their currently installed technology, 51 percent say that they do not have real-time visibility into Web traffic, making it difficult to identify the root cause of such attacks, the study says.

Just 23 percent of respondents said they feel that most holiday-season attacks can be quickly detected and remediated.

The report also identifies the top nine attacks organizations will likely face during the holiday season. In order of likelihood, these attacks are:

1. Botnet and distributed denial-of-service (DDoS)
2. App store fraud
3. Mobile access/account compromise
4. Click fraud
5. Stolen credit card validation
6. E-coupon abuse
7. Account hijacking
8. Electronic wallet abuse
9. Brand promotion hijacking

"We expect to see more of these attacks this year, and more attacks targeted at specific companies," says Lazarikos.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio