While Threats Remain Formidable, Retail Is Among Highest Performing

By Christine Kern, contributing writer

Despite major cyber-attacks on the retail industry in recent years, retail is among the highest performing industries when it comes to cybersecurity. A new report from cyber security ratings company, BitSight, benchmarks the security effectiveness of 30,000 organizations in six industries - finance, federal government, retail, energy/utilities, healthcare and education, finding that 56 percent of retailers are actively investing more in their cybersecurity efforts.

2014 was dubbed by many within the information security sector as the Year of the Retail Breach, with an unprecedented number of major American retailers being targeted by large-scale data breaches affecting millions of customers.  These breaches have affected consumer attitudes towards methods of payment, shopping, and loyalty programs and business-branded credit cards.   That means that retailers have had to respond to these changes proactively. The industry-wide push to EMV adoption in store-branded credit cards, the inception of the R-ISC information-sharing platform, and other moves mean that retailers are starting to fight back.

According to the Bitsight analysis, the retail sector earned a mean Security Rating of 717, placing it just below the federal government’s rating, and demonstrating a slight improvement over the course of the year.  The biggest challenge remains SSL vulnerability including Heartbleed, Freak, and Poodle.

The Third Annual BitSight Insights Industry Benchmark Report found:

• Retail is strengthening its efforts, behind Finance and the Federal government in cybersecurity
• The federal government is the second highest performing industry, second only to finance
• There was a concerning dip in the performance of the energy and utilities sector, putting the industry in-line with the poor performing healthcare sector
• Companies across all industries are still vulnerable to major SSL bugs, and while companies across all industries have mostly updated their servers to protect against Heartbleed, many have failed to act when it comes to Poodle and FREAK (79 percent of government agencies analyzed were vulnerable to Poodle)

BitSight uses publicly available data to rate companies’ security performance on a daily basis, similar to a credit score (250-900). Observed security events and configurations, such as communication with a botnet, malware distribution, and email server configuration, are assessed for severity, frequency and duration and used to generate objective Security Ratings.