Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Backoff, Dairy Queen, UPS & Retail's Growing PoS Security Problem
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
aws0513
aws0513,
User Rank: Ninja
8/28/2014 | 9:22:20 AM
Re: Brand reputation
I have seen this corporate finger pointing technique in both the private and public sectors for years.

Almost every time, the public will connect/attribute the brand to the breach problem, not the franchisee or contractor.  Occasionally, the brand can brush off the connection if the problem has particulars regarding specific employees or activities at a specific facility or area.  But when a problem is pervasive across multiple stores or facilities, the brand CANNOT avoid the attribution no matter how many statements they may make.

To me, this is a classic example of poor executive decision making where the management mindset is to divert blame away from the crystal corporate palace.

For me, I would have more confidence and respect for any organization that is willing to stand up to the problem at hand, accept blame even if it really isn't their fault, and attest to (and follow through with) broad measures focused on full and proper remediation.
Stratustician
Stratustician,
User Rank: Moderator
8/28/2014 | 9:19:35 AM
Re: Brand reputation
I agree Marilyn, the corporate headquarters of these brandsmust be responsible for pushing down security guidelines or requirements to each of these franchises.  While it's easy for them to say "well, it's the fault of that particular franchise", the reality is yes, as you mentioned, it's the entire brand that will suffer the fallout when the public decides that they would not rather deal with these companies as they don't appear to value the privacy and security of their customers.  Passing the responsibility around is never going to fix the real issue, that security controls must be incorporated into these sytems.  Perhaps it will come down to legislation to protect the consumer.  While PCI attempted to do this, there is still very little backlash when these events occur.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/28/2014 | 7:36:36 AM
Brand reputation
It's unfathomable to me that franchisors are passing the security buck to their independent franchisees. As a consumer, when I go to a UPS store or a Dairy Queen, do I think of the retailer as a small independent business? Of course not. It's the brand reputation that is at risk in the case of a security breach. Unbelievable!
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-43762
PUBLISHED: 2023-02-08
Lack of verification in B&amp;R APROL Tbase server versions &lt; R 4.2-07 may lead to memory leaks when receiving messages
CVE-2022-43763
PUBLISHED: 2023-02-08
Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&amp;R APROL versions &lt; R 4.2-07.
CVE-2022-43764
PUBLISHED: 2023-02-08
Insufficient validation of input parameters when changing configuration on Tbase server in B&amp;R APROL versions &lt; R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.
CVE-2022-43765
PUBLISHED: 2023-02-08
B&amp;R APROL versions &lt; R 4.2-07 doesn&acirc;&euro;&trade;t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.
CVE-2022-2094
PUBLISHED: 2023-02-08
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting