Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

9/20/2018
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Retail Sector Second-Worst Performer on Application Security

A "point-in-time" approach to PCI compliance could be one reason why so many retailers appear to be having a hard time.

The retail industry's cybersecurity preparedness continues to lag behind almost every other sector despite efforts by the major credit card associations to bolster retail security via the Payment Card Industry Data Security Standard (PCI DSS).

Third-party risk management firm SecurityScorecard recently analyzed a total of 1,444 domains in the retail industry with an IP footprint of at least 100. Researchers from the firm passively monitored externally facing IPs of the retail domains for a period of about five months to see what vulnerabilities they could find.

The exercise showed the retail industry had the second-lowest application security performance among major sectors. In a list of 18 industries, the retail sector ranked 17th, just above the entertainment industry, in terms of having the most vulnerable applications. Last year, the retailer industry was the fourth lowest performer, meaning it dropped in application security performance in the preceding 12 months rather than improved.

Retailers also ranked dead last in terms of their ability to protect against social engineering attacks. SecurityScorecard's analysis showed that criminals employing phishing and other social engineering methods to steal data and commit fraud were likely to have more success with retailers than organizations in any other industry.

The findings are important because criminals target retailers more so than almost any other sector apart from healthcare and banking and finance. In recent years, numerous retailers have experienced spectacular data breaches that have compromised tens and sometime even hundreds of millions of payment cards.

Visa, Mastercard, American Express, and other major card associations have required retailers to implement a set of evolving security controls for protecting card data at rest, in use, while stored, and during transactions. The PCI security standard has been in place for well more than a decade.

Yet many retailers are not fully compliant with it, even though they can face stiff financial penalties in the event of a breach. In fact, SecurityScorecard found that nearly 91% of the retail domains analyzed had issues that likely put them in noncompliance with four or more PCI DSS requirements.

Retailers fared especially poorly with respect to PCI DSS Requirement 6, pertaining to application security. Ninety-eight percent of the domains that SecurityScorecard analyzed had issues that likely put them in noncompliance. Ninety-one percent had problems with a subsection of Requirement 6, pertaining to the need for promptly patching software and systems against known security vulnerabilities.

Fouad Khalil, head of compliance at SecurityScorecard, says his company considered a variety of issues related to application security when assigning performance rankings to various industries.

Security issues that were identified during SecurityScorecard's passive monitoring of the retail domains were weighted to account for differences in severity, Khalil says. When available, SecurityScorecard used industry-accepted standards, such as NIST's Common Vulnerability Scoring System v2, to assign severity ranking. When an identified issue did not have a formal severity ranking available, SecurityScore used recognized authorities and its own internal resources to determine severity.

"These weighted issue types are then rolled up into a factor score for application security," he says. "We repeated this same process for every major US industry, and when we compared the retail industry’s factor score to the rest, it came second-lowest," Khalil explains. To determine compliance or noncompliance with PCI DSS requirements for app security, SecurityScorecard flagged vulnerabilities that were "litmus test indicators of noncompliance" with a particular PCI requirement, he notes.

A "point-in-time" approach to PCI compliance could be one reason why so many retailers appear to be having a hard time with the application security requirement and several of the other requirements, SecurityScorecard said in its report. It is not just enough to implement PCI-manadated security controls, but also to maintain them on an ongoing basis, especially with regard to issues like patching and applying software updates.

SecurityScorecard used a somewhat similar process to arrive at its ranking for social engineering threats. In this case, the company looked at issues including retail employees using their corporate account information to sign up for services, such as social networks, personal finance accounts, and marketing lists, that can be exploited. In addition, SecurityScorecard monitored employee dissatisfaction levels using publicly available data, Khalil says. As with application security, the retail industry fared badly in comparison with other industries on this front, too.

In this instance, the retail industry's generally younger workforce may be a factor, according to SecurityScorecard. Many retail sector employees who are targets of phishing and social engineering scams don't know enough about the threat to be able to recognize it.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Artist Uses Malware in Installation
Dark Reading Staff 5/17/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12184
PUBLISHED: 2019-05-19
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...