Retail Sector Second-Worst Performer on Application Security

A point-in-time approach to PCI compliance could be one reason why so many retailers appear to be having a hard time.

The retail industrys cybersecurity preparedness continues to lag behind almost every other sector despite efforts by the major credit card associations to bolster retail security via the Payment Card Industry Data Security Standard (PCI DSS).
Third-party risk management firm SecurityScorecard recently analyzed a total of 1,444 domains in the retail industry with an IP footprint of at least 100. Researchers from the firm passively monitored externally facing IPs of the retail domains for a period of about five months to see what vulnerabilities they could find.
The exercise showed the retail industry had the second-lowest application security performance among major sectors. In a list of 18 industries, the retail sector ranked 17th, just above the entertainment industry, in terms of having the most vulnerable applications. Last year, the retailer industry was the fourth lowest performer, meaning it dropped in application security performance in the preceding 12 months rather than improved.
Retailers also ranked dead last in terms of their ability to protect against social engineering attacks. SecurityScorecards
analysis
showed that criminals employing phishing and other social engineering methods to steal data and commit fraud were likely to have more success with retailers than organizations in any other industry.
The findings are important because criminals target retailers more so than almost any other sector apart from healthcare and banking and finance. In recent years, numerous retailers have experienced spectacular data breaches that have compromised tens and sometime even hundreds of millions of payment cards.
Visa, Mastercard, American Express, and other major card associations have required retailers to implement a set of evolving security controls for protecting card data at rest, in use, while stored, and during transactions. The PCI security standard has been in place for well more than a decade.
Yet many retailers are not fully compliant with it, even though they can face stiff financial penalties in the event of a breach. In fact, SecurityScorecard found that nearly 91% of the retail domains analyzed had issues that likely put them in noncompliance with four or more PCI DSS requirements.
Retailers fared especially poorly with respect to PCI DSS Requirement 6, pertaining to application security. Ninety-eight percent of the domains that SecurityScorecard analyzed had issues that likely put them in noncompliance. Ninety-one percent had problems with a subsection of Requirement 6, pertaining to the need for promptly patching software and systems against known security vulnerabilities.
Fouad Khalil, head of compliance at SecurityScorecard, says his company considered a variety of issues related to application security when assigning performance rankings to various industries.
Security issues that were identified during SecurityScorecards passive monitoring of the retail domains were weighted to account for differences in severity, Khalil says. When available, SecurityScorecard used industry-accepted standards, such as NISTs Common Vulnerability Scoring System v2, to assign severity ranking. When an identified issue did not have a formal severity ranking available, SecurityScore used recognized authorities and its own internal resources to determine severity.
These weighted issue types are then rolled up into a factor score for application security, he says. We repeated this same process for every major US industry, and when we compared the retail industry’s factor score to the rest, it came second-lowest, Khalil explains. To determine compliance or noncompliance with PCI DSS requirements for app security, SecurityScorecard flagged vulnerabilities that were litmus test indicators of noncompliance with a particular PCI requirement, he notes.
A point-in-time approach to PCI compliance could be one reason why so many retailers appear to be having a hard time with the application security requirement and several of the other requirements, SecurityScorecard said in its report. It is not just enough to implement PCI-manadated security controls, but also to maintain them on an ongoing basis, especially with regard to issues like patching and applying software updates.
SecurityScorecard used a somewhat similar process to arrive at its ranking for social engineering threats. In this case, the company looked at issues including retail employees using their corporate account information to sign up for services, such as social networks, personal finance accounts, and marketing lists, that can be exploited. In addition, SecurityScorecard monitored employee dissatisfaction levels using publicly available data, Khalil says. As with application security, the retail industry fared badly in comparison with other industries on this front, too.
In this instance, the retail industrys generally younger workforce may be a factor, according to SecurityScorecard. Many retail sector employees who are targets of phishing and social engineering scams dont know enough about the threat to be able to recognize it.
Related Content:
Number of Retailers Impacted by Breaches Doubles
Clinging to TLS 1.0 Puts Sites Outside PCI DSS Compliance
PCI DSS Adds Standard for Software-based PIN Entry
The Equifax Breach One Year Later: 6 Action Items for Security Pros
Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Retail Sector Second-Worst Performer on Application Security