Retail IT Professionals Show Increased Confidence, Even As Data

By Christine Kern, contributing writer

Study finds great disconnect between perceptions and reality in retail cybersecurity.

Even as cybersecurity breaches at retailers  continue to mount, new research shows that retail IT operations professionals show increased confidence in their cybersecurity capabilities. The study revealed a real disconnect between IT pros’ attitudes and the reality of how long it takes them to discover threats  and respond.

According to a report by Arbor Networks, it takes retailers an average of 197 days to detect advanced threats on their networks. However, Tripwire’s 2016 retail cyber security survey found that ninety percent of the respondents believe they could detect a data breach on critical systems in one week or less. In 2014, seventy percent of respondents believed they could detect a breach in one week or less.

“Unfortunately, these results indicate that we can expect retail breach activity to continue in the future,” said Tim Erlin, director of IT security and risk strategy. “The increase in confidence connected with speed of breach detection is particularly surprising, especially in combination with partial implementation of detection tools. Together these results indicate while retail organizations might feel better about their cyber security capabilities, there’s still a long way to go to close the gap between initial compromise and detection.”

A third of retailers surveyed said that a breach involving personal data had occurred at their companies, up from 14 percent in 2014. Yet, implementation of breach detection technology has remained flat, Tripwire notes. In both 2014 and 2016, 59 percent of the respondents said their breach detection products—including anti-virus software, intrusion detection systems, malware detection, white listing and file integrity monitoring—were only partially or marginally implemented.

The study also found:

• The number of respondents who said they could detect a breach within 48 hours rose from 42 percent in 2014 to 75 percent in 2016.
• Retail data breaches involving personally identifiable information (PII) have more than doubled since 2014, and the number of organizations reporting such breaches has risen from 14 percent in 2014 to 33 percent in 2016.
• Implementation of breach detection technology has remained steady,  with 59 percent of respondents stating that their breach detection products were only partially or marginally implemented.
• The larger the company revenue, the less frequently they monitor configuration parameters on critical payment assets.  The survey found that 65 percent of respondents working for organizations with revenues under $100 million check compliance at least once a week, while only 55 percent of those with revenues of over $100 million responded similarly.

Erlin stated, “Partially implemented tools are a serious liability for information security. Organizations need to move from a checkbox approach to measuring gaps in their security coverage. If you’re not monitoring one hundred percent of your endpoints, you’re leaving room for attackers to gain a foothold.”