Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/21/2013
02:19 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Technology Sector Lags In Security Effectiveness, Analysis Shows

Report analyzed security ratings for more than 70 Fortune 200 companies in energy, finance, retail, and technology

CAMBRIDGE, MA – Nov. 20, 2013 – BitSight Technologies, the only company to measure security effectiveness using objective and evidence-based ratings, today released the first BitSight Insight report, which analyzed security ratings for over 70 Fortune 200 companies in four industries – energy, finance, retail and technology. The objective was to uncover quantifiable differences in security effectiveness and performance across industries from October 2012 through September 2013. The study revealed that, in spite of all the attacks from criminals and hactivists over the past year, the financial industry has performed well. In contrast, the technology industry falls far behind, pointing to a need for greater focus on cyber risk management in this sector.

Leveraging big data for observed security incidents, including communication with known command and control servers, spam propagation and malware distribution, BitSight SecurityRatings provide a unique perspective on risk from the outside-in. BitSight SecurityRatings range from 250 to 900, with higher numbers equating to better security effectiveness. Factors used to determine ratings include the classification, frequency, and duration of observed security incidents.

"BitSight's outside in, data driven approach to rating shows clear differences amongst industries," said Stephen Boyer, BitSight co-founder and CTO. "By looking at evidence of compromise, we focus on outcomes rather than policies. Companies can have very similar policies, but their effectiveness can still vary widely. For example, the technology sector companies included in this analysis had significantly lower ratings than companies in the financial services sector. The spread is surprising."

Key Findings

· Technology Lags

Technology companies are required to be compliant with the regulations of the industries they serve, including HIPAA, PCI DSS and FISMA. With this consideration, it is surprising that the technology sector measures dramatically lower than retail and finance. High profile breaches including Bit9 and Adobe may indicate why the technology industry rates less effective. The Adobe data breach that also impacted Dun & Bradstreet and LexisNexis went unobserved for months before a third party researcher uncovered the incident. Initial reports suggest these breaches occurred as early as March 2013, yet were unreported until October 2013. The persistency of attacks and time to remediate are key contributors to low SecurityRatings in this industry.

· Finance Rates Highest

In spite of frequent cyber attacks on financial institutions, the finance sector rated the most favorable in terms of security effectiveness. Along with the known tactics employed by cyber criminals, this sector was also hit with several politically motivated DDoS attacks. One reason for the high SecurityRatings is that the companies assessed were quicker to respond to threats than their peers in other industries. Faster response time leads to less damage and loss. Due in part to the need to meet security and privacy regulations and the desire to stay out of news headlines for losing customer data, financial institutions tend to focus more executive level resources on IT security and risk management than other industries.

· Energy and Retail

The energy sector, which includes utilities and oil and gas companies, rated highly in Q4 2012, but fell sharply in the first half of 2013 when faced with extensive malware and botnet attacks. Not only was there an increase in the number of security incidents in Q1 2013, but energy companies were slow to respond to these incidents. However, in the third quarter of 2013, the energy industry's average effectiveness shows an upward trend, suggesting that they may be getting better at thwarting cyber attacks.

The retail sector, which excludes solely online retailers, also started out on an upward trend in Q4 2012, but then hit a rough patch in Q1 2013, showing that they continue to be an attractive target for cybercriminals seeking access to identity and financial information. The retailers included in this study faced an increase in botnet, spam, phishing and malware attacks Q1 2013, and took longer to remediate attacks as their frequency increased. The SecurityRatings of this group have remained relatively flat in the past two quarters, leaving much room for improvement.

About the BitSight Industry SecurityRatings

Industry SecurityRatings were created from the BitSight SecurityRating averages of over 70 U.S. based organizations in the Fortune 200 from October 2012 to September 2013. Below are explanations of the industry designations.

● Energy: utilities and oil & gas

● Finance: banking, investment, securities and financial services

● Retail: primarily brick and mortar organizations

● Technology: device, hardware, software manufacturers and services providers

To download a full copy of the BitSight Insight report, visit http://info.bitsighttech.com/industry-ratings. For more information on the BitSight Partner SecurityRating service, visit www.bitsighttech.com.

About BitSight Technologies


BitSight Technologies is transforming how companies manage information security risk with objective, evidence-based security ratings. The company's SecurityRating Platform continuously analyzes vast amounts of external data on security behaviors in order to help organizations make timely risk management decisions. Based in Cambridge, MA, BitSight is backed by Commonwealth Capital Ventures, Flybridge Capital Partners, Globespan Capital Partners, and Menlo Ventures. For more information, please visit www.bitsighttech.com or follow @BitSight on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.