Report Shows Retailers Still Face Security Holes As Holiday Shopping

By Christine Kern, contributing writer

Holiday shopping places greater pressure on IT with temporary employees and increased transactions.

As the 2015 Holiday Shopping Season kicks off, two out of three retailers reported that there is greater pressure on their IT/security organizations during this rush due to additional temporary employees and increased transactions, according to a new report from Bay Dynamics and Osterman Research.  This pressure means greater opportunities for data breaches and other security problems, as evidenced by the string of major breaches in the past, including Target (110 million records breached), Home Depot (56 million), TJX (46 million), and eBay (145 million.)

Osterman Research polled IT decision makers at 125 large retailers (more than 2,000 employees in the US) during November 2015. The survey covered retailers with a combined total of 2.74 million employees, or approximately 18 percent of the total number of retail workers in the U.S.

The “Pre-Holiday Risk Report” found that retailers, overall, believe that they are successful in handing the security of their infrastructure, effectively identifying critical data assets that need to be protected; detecting theft or data leakage efficiently; and controlling employee access to critical data assets.

Yet upon further examination, the study asserts, “it becomes clear that retailers are resting on a false sense of confidence in their security programs and do not realize, or perhaps do not want to acknowledge, that there are significant holes.  Consequently, retailers are elevating their risk of getting breached.”

Among the pitfalls identified by the study are:

• Employees sharing login credential, with 21 percent of permanent retail floor workers and 61 percent of temporary floor workers lacking unique login credentials for corporate systems.
• Thirty-seven percent of employers cannot identify which systems their temporary employees access, and 8 percent cannot identify systems their permanent employees have accessed.
• Twenty-six percent report that they don’t know if their temporary employees have ever accessed and/or sent data they should not have, while 14 percent said they cannot track permanent workers actions in this way.
• All workers create some level of risk, with 47 percent of survey respondents stating that temporary workers are somewhat risky to their organization. Thirty-two percent view temporary workers as a high risk. Meanwhile, two thirds (66 percent) view permanent workers as somewhat risky.
• There is a false sense of confidence. While the majority of retailers ranked themselves with a “6” or higher in terms of identifying critical assets that must be protected, detecting theft or data leakage, and controlling employee access to critical assets, most organizations lack basic security awareness training for its employees.