Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Study: Cyber Monday Attacks Cost Enterprises Up To $3.4M Per Hour

Holiday shopping season is popular time for launch of sophisticated attacks, RSA study says

The upcoming holiday shopping season could be prime time for attackers who hope to catch enterprises at their weakest moments, according to a study published this week.

According to a new survey of 1,100 retail companies conducted by the Ponemon Institute and sponsored by RSA, daily revenue surges by an average of 55 percent during the holiday season. If a retail site is hacked or disabled, average losses may amount to as much as $500,000 per hour, or $8,000 per minute.

Two-thirds of respondents (66 percent) said that such a disruption would also result in customer churn that would damage reputation and brand, pushing losses as high as $3.4 million from a single hour of disruption.

"This time of year is not just an opportunity for retail fraud, but an opportunity to launch attacks that take advantage of business logic vulnerabilities, DDoS [distributed denial-of-service] attacks, and more sophisticated attacks as well," says Demetrios Lazarikos, IT threat strategist at RSA.

Yet while 64 percent of organizations said they see significant increases in attack activity during the holidays, more than 70 percent of organizations do not take additional precautions in anticipation of increased attacks. And with their currently installed technology, 51 percent say that they do not have real-time visibility into Web traffic, making it difficult to identify the root cause of such attacks, the study says.

Just 23 percent of respondents said they feel that most holiday-season attacks can be quickly detected and remediated.

The report also identifies the top nine attacks organizations will likely face during the holiday season. In order of likelihood, these attacks are:

1. Botnet and distributed denial-of-service (DDoS)
2. App store fraud
3. Mobile access/account compromise
4. Click fraud
5. Stolen credit card validation
6. E-coupon abuse
7. Account hijacking
8. Electronic wallet abuse
9. Brand promotion hijacking

"We expect to see more of these attacks this year, and more attacks targeted at specific companies," says Lazarikos.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.