Retailers face particular challenges for managing cybersecurity during the holidays.
The holiday shopping season brings together a confluence of factors that should push cyber security to the top of the priorities list, including the influx of temporary employees, who may have access to sensitive and confidential information including customers’ financial and personal information, and the fact that retail systems are stressed during the holidays. The National Retail Federation estimates that between 640,00 and 690,000 temporary retail workers will be hired for the 2016 season, which is a 61-day shopping season that comprises just 17 percent of the total shopping days of 2016 but comprises as much as 27 percent of some retailers’ overall annual sales.
And while retailers realize just how important each of these pieces are, an October 2016 Osterman Research report found that the majority of IT and security professionals that mange retailers’ cyber security programs do not feel more pressure during the holiday season to protect their organization’s data.
The “2016 Pre-Holiday Retail Cyber Risk Report” commissioned by Bay Dynamics examines the cyber risks posed by permanent, temporary and contract employees within retail organizations, and what IT and security professionals are doing to minimize those risks.
This second annual retail risk report produced by Bay Dynamics is based on a survey conducted by Osterman Research asking 134 IT and security professionals, who manage retail organizations’ cyber risk and security programs, about the kind of information to which their permanent, temporary and contract employees are granted access, how much visibility they have into employees’ actions, how quickly they patch vulnerabilities, when they feel the most pressure to secure their organizations and more.
The survey found that cybersecurity is no longer a seasonal priority, and that IT and security pros now feel equal pressure year-round to secure their organizations against breaches. Additionally, vulnerabilities are not being patched more quickly than in the past, with almost 60 percent of respondents saying that they patch within 48 hours of discovering a vulnerability.
The survey also found that there has been a four-fold jump in the past year in the number of IT and security pros who report that their permanent employees have accessed and/or sent sensitive data they should not have accessed and/or sent, and there has been a significant decrease in the number of pros who say they are not sure if such actions have occurred. This demonstrates that employees – both permanent and temporary – are being watched more closely and that IT and security teams enjoy a much better understanding of the developments in their environments.
When it comes to temporary employees, retailers have also learned some important lessons. The survey showed that just 6 percent of IT and security professionals report that temporary employees have access to personally identifiable information (PII), and just 13 percent say contractors can access PII. And while 64 percent said they don’t give temporary employees their own accounts, they also report that they are not given access to sensitive data.
And finally, one area that reflects room for improvement is in security awareness training. Only eight percent of those surveyed reported that their companies provide security awareness training after a security problem has occurred. The majority of companies view security awareness training as a one-time happening, when employees are first hired.
