Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Backoff, Dairy Queen, UPS & Retail's Growing PoS Security Problem
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
aws0513
aws0513,
User Rank: Ninja
8/28/2014 | 9:22:20 AM
Re: Brand reputation
I have seen this corporate finger pointing technique in both the private and public sectors for years.

Almost every time, the public will connect/attribute the brand to the breach problem, not the franchisee or contractor.  Occasionally, the brand can brush off the connection if the problem has particulars regarding specific employees or activities at a specific facility or area.  But when a problem is pervasive across multiple stores or facilities, the brand CANNOT avoid the attribution no matter how many statements they may make.

To me, this is a classic example of poor executive decision making where the management mindset is to divert blame away from the crystal corporate palace.

For me, I would have more confidence and respect for any organization that is willing to stand up to the problem at hand, accept blame even if it really isn't their fault, and attest to (and follow through with) broad measures focused on full and proper remediation.
Stratustician
Stratustician,
User Rank: Moderator
8/28/2014 | 9:19:35 AM
Re: Brand reputation
I agree Marilyn, the corporate headquarters of these brandsmust be responsible for pushing down security guidelines or requirements to each of these franchises.  While it's easy for them to say "well, it's the fault of that particular franchise", the reality is yes, as you mentioned, it's the entire brand that will suffer the fallout when the public decides that they would not rather deal with these companies as they don't appear to value the privacy and security of their customers.  Passing the responsibility around is never going to fix the real issue, that security controls must be incorporated into these sytems.  Perhaps it will come down to legislation to protect the consumer.  While PCI attempted to do this, there is still very little backlash when these events occur.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/28/2014 | 7:36:36 AM
Brand reputation
It's unfathomable to me that franchisors are passing the security buck to their independent franchisees. As a consumer, when I go to a UPS store or a Dairy Queen, do I think of the retailer as a small independent business? Of course not. It's the brand reputation that is at risk in the case of a security breach. Unbelievable!
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-34491
PUBLISHED: 2022-06-25
In the RSS extension for MediaWiki through 1.38.1, when the $wgRSSAllowLinkTag config variable was set to true, and a new RSS feed was created with certain XSS payloads within its description tags and added to the $wgRSSUrlWhitelist config variable, stored XSS could occur via MediaWiki's template sy...
CVE-2022-29931
PUBLISHED: 2022-06-25
Raytion 7.2.0 allows reflected Cross-site Scripting (XSS).
CVE-2022-31017
PUBLISHED: 2022-06-25
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the serve...
CVE-2022-31016
PUBLISHED: 2022-06-25
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated A...
CVE-2022-24893
PUBLISHED: 2022-06-25
ESP-IDF is the official development framework for Espressif SoCs. In Espressif&acirc;&euro;&trade;s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can resul...