New Research Shows One Third of Retail Breaches Originated from Third-Party Vulnerabilities

PRESS RELEASE

CAMBRIDGE, MA – Nov. 18, 2014 – BitSight Technologies, the standard in Security Ratings, today released new research measuring the security performance of 300 major U.S. retailers from Nov. 1, 2013 to Nov. 1, 2014. The report reveals that retail is still under attack and consequently the security effectiveness of retail organizations as a whole has continued to decline over the past year. However, almost 75 percent of retailers that experienced a data breach in the last year have improved their security effectiveness since the point of their breach, while a third of the breached retailers link back to compromises via third-party vendors.

The BitSight platform uses publically available data to rate the security performance of an organization on a daily basis. Observed security events and configurations, such as communication with a botnet, malware distribution, and email server configuration, are assessed for severity, frequency and duration and used to generate objective Security Ratings. BitSight Security Ratings range from 250 to 900, with higher ratings equating to higher security performance. BitSight uses a wide breadth of high-quality publicly available security data to calculate Security Ratings data on specific companies and industries.

Key Findings

·         Retail still under wide scale attack - Of the 300 major U.S. retailers analyzed by BitSight from Nov. 2013 to Nov. 2014, 58 percent experienced a decline in overall security performance with an average 90-point decrease. The 34 percent of retailers that improved saw an average 70-point increase, while eight percent of retailers saw no net change in their Security Ratings over the past year.

·         Retailers breached in the last year see improvement - BitSight analyzed the security performance of 20 large retailers that had a high-profile breach within the last year. Of these retailers, nearly 75 percent saw an average increase of 50 points to their Security Rating score, since the point of their breach.

·         Securing the Supply Chain remains a big challenge - BitSight observed that nearly a third of all breaches in the retail sector began with a compromise at a third-party vendor. Retailers share sensitive data with hundreds to thousands of business partners globally; organizations can take steps in securing their own networks, but ignoring risks posed by third-party partners can leave them exposed and vulnerable to breaches.

·         Infection increases in almost all threat vectors – In the span of a year, the retail industry on average suffered from an increase in infections in every individual threat indicator monitored by BitSight, with the exception of spam propagation. Malware distribution accounted for the largest increase, followed by botnet infections. Some prevalent malware strains detected across the industry include Maazben, ZeroAccess, Zeus, Viknok, Conficker and Cutwail.

Ø  Malware Servers: +200 percent

Ø  Botnet Infections: +29 percent

Ø  Potentially Exploited Hosts: +78 percent

Ø  Unsolicited Communication: +43 percent

Ø  Spam Propagation: -21 percent

·         Incident response times are increasing not decreasing - BitSight observed the average response time taken to address infections on retailers’ networks and found a five percent increase in the time it took security teams to respond to potential network security events. While this may seem minimal, the slower the response time, the more potential for damage to be done.

Ø  Nov. 1, 2013: 1.26 days

Ø  Nov. 1, 2014: 1.33 days

About BitSight Technologies


BitSight Technologies is transforming how companies manage information security risk with objective, evidence-based security ratings. The company's Security Rating Platform continuously analyzes vast amounts of external data on security behaviors in order to help organizations make timely risk management decisions. Based in Cambridge, MA, BitSight is backed by Commonwealth Capital Ventures, Flybridge Capital Partners, Globespan Capital Partners, and Menlo Ventures. For more information, please visit www.bitsighttech.com or follow @BitSight on Twitter.

###

Contact
Lauren Hillman
Kulesa Faul for BitSight Technologies
[email protected]
510-449-5972