OptimumSecurity has created an infographic that is a great representation of many significant data breaches.
OptimumSecurity has created an infographic that is a great representation of many significant data breaches.
According to BDO’s analysis of risk factors listed in the most recent 10-K filings of the 100 largest U.S. retailers, risk associated with a possible security breach was cited unanimously by retailers, claiming the top spot, up from the 18th spot in 2007.
Since major retail security breaches began making national headlines in 2013, retailers have become acutely aware of the growing cyber threat and cyber-related risks. Between new point-of-sale systems and evolving digital channels, the industry faces unique vulnerabilities: Retailers are responsible for safeguarding consumer data as well as their own, in addition to protecting against potential gaps in security related to third-party suppliers and vendors.
2016 marks the 10th anniversary of our retail risk factor analysis, and throughout the decade, we’ve seen the retail landscape undergo a dramatic evolution in response to the recession, new and maturing e-commerce channels and evolving consumer preferences,” said Doug Hart, partner in BDO’s Consumer Business practice. “Retailers over the years have proven to be in tune with the industry-wide issues and trends that could pose risks to their businesses, and they are clearly not tone deaf when it comes to reacting to the urgency of cybersecurity
The following chart ranks the top 25 risk factors cited by the 100 largest U.S. retailers:
|Top 20 Risks for Retailers||2016||2015||2014|
|General Economic Conditions||#1||100%||#1||100%||#1||100%|
|Privacy Concerns Related to Security Breach||#1t||100%||#4t||99%||#8||91%|
|Competition and Consolidation in Retail Sector||#3||98%||#1t||100%||#3||98%|
|Federal, State and/or Local Regulations||#4||96%||#1t||100%||#2||99%|
|Natural Disasters, Terrorism and Geo-Political Events||#5||94%||#7||96%||#13||87%|
|Implementation and Maintenance of IT Systems||#6||93%||#4||99%||#7||92%|
|U.S. and Foreign Supplier/Vendor Concerns||#6t||93%||#6||98%||#4||96%|
|Labor (health coverage, union concerns, staffing)||#9||91%||#7t||96%||#5||94%|
|Impediments to Further U.S. Expansion and Growth||#10||90%||#12t||92%||#17||78%|
|Dependency on Consumer Trends||#11||88%||#9||95%||#6||93%|
|Consumer Confidence and Spending||#12||87%||#15||89%||#8t||91%|
|Credit Markets/Availability of Financing and Company Indebtedness||#13||85%||#11||94%||#11||89%|
|Failure to Properly Execute Business Strategy||#14||82%||#12||92%||#11t||89%|
|Changes to Accounting Standards and Regulations||#15||76%||#14||90%||#13t||87%|
|Loss of Key Management/New Management||#16t||73%||#19||80%||#16||79%|
|Marketing, Advertising, Promotions and Public Relations||#18||66%||#25||68%||#24||64%|
|Consumer Credit and/or Debt Levels||#19||62%||#27||65%||#23||65%|
Additional findings from the 2016 BDO Retail Risk Factor Report:
Cyber Risks Include Compliance Measures
As the cyber threat looms larger, retailers are bracing for new and emerging cybersecurity and data privacy legislation. Risks associated with cyber and privacy regulations were cited by 76 percent of retailers this year. This is in line with the findings from the 2016 BDO Retail Compass Survey of CFOs, in which nearly 7 in 10 retail CFOs said they expected cyber regulation to grow in 2016. These concerns have been highlighted by President Obama’s recently unveiled Commission on Enhancing National Cybersecurity and continued debate in Congress over information sharing between the government and private industry.
Retailers have not escaped regulatory scrutiny. The industry is also subject to Europay, Mastercard and Visa (EMV) standards that bolster credit card authentication and authorization. Industry analysts estimate that just 40 percent of retailers are compliant with EMV standards despite the Oct. 1, 2015 deadline.
“Mandating EMV chip-compliant payment systems is an important first step in shoring up the industry’s cyber defenses, but it’s just the tip of the iceberg,” said Shahryar Shaghaghi, National Leader of the Technology Advisory Services practice group and Head of International BDO Cybersecurity. “Online and mobile transactions remain vulnerable to credit card fraud and identity theft, and POS systems can still be hacked and provide an access point to retailers’ networks. New forms of malware can also compromise retailers’ IT infrastructure and disrupt business operations. Every retailer will experience a data breach at some juncture; the real question is what mechanisms have been put in place to mitigate the impact.”
E-Commerce Ubiquity Drives Brick & Mortar Concerns
Impediments to e-commerce initiatives also increased in ranking, noted by 57 percent of retailers in 2016, a significant contrast from 12 percent in 2007. In 2015, e-commerce accounted for 7.3 percent of total retail sales and is continuing to gain market share.
As e-commerce grows and businesses strive to meet consumers’ demand for seamless online and mobile experiences, retailers are feeling the effects in their physical locations. The recent wave of Chapter 11 bankruptcies and mass store closings among high-visibility retailers has raised concerns across the industry. Ninety percent of retailers are worried about impediments to growth and U.S. expansion this year. Meanwhile, risks associated with owning and leasing real estate jumped 14 percentage points to 54 percent this year.
Heightened worries over the impact of e-commerce on physical locations are far reaching, driving concerns over market competition for prime real estate and mall traffic to rise 19 percentage points to 46 percent. Meanwhile, consumer demand for fast shipping fueled an uptick in risks around the increased cost of mail, paper and printing, rising 10 percentage points from seven percent in 2015 to 17 percent this year.
General Economic Conditions Hold Weight
General economic risks have been consistently top of mind for retailers throughout all ten years of this survey. Even at its lowest percentage in 2008, this risk was still the second most cited, noted by 83 percent of companies.
Despite the fact that since 2013, general economic conditions have remained tied for the top risk, concerns about specific market indicators have receded.
For more information on the 2016 BDO Retail RiskFactor Report, view the full report here.
About the Consumer Business Practice at BDO USA, LLP
BDO has been a valued business advisor to consumer business companies for over 100 years. The firm works with a wide variety of retail and consumer business clients, ranging from multinational Fortune 500 corporations to more entrepreneurial businesses, on myriad accounting, tax and other financial issues.
Ilex International have launched their Breach Confidence Index. The Index is a benchmark survey created to monitor the level of confidence that British businesses have when it comes to security breaches. The Index shows high confidence levels
The Breach Confidence Index raises major concerns for British businesses. Businesses are not currently required to report security breaches and in many cases, may not even know that they have experienced one. The survey found that 49% said their business has not experienced a security breach. In comparison to actual statistics shared at the 2015 Cyber Symposium, there is a major gap between the perception and reality of security breaches among businesses.
|According to the survey the most common weaknesses resulting in a Data Breach were|
|8%||BYOD OR MOBILE ACCESS|
|6%||NON-COMPLIANCE TO CURRENT REGULATIONS|
Weaknesses relating to identity and access management considerably increase as organisations expand their workforce. Some of the most common issues highlighted by large businesses include:
All figures in the Ilex International Breach Confidence Index, unless otherwise stated, are from YouGov Plc. Total sample size was 530 IT Decision Makers. Fieldwork was undertaken between 6th – 12th August 2015. The survey was carried out online.
For any organization connected to the internet, it is not a question of if but when their business will be under attack, according to a recent cybersecurity report from Symantec, which found Canada ranked No. 4 worldwide in terms of ransomware and social media attacks last year. These increasing attacks put customer information, and especially payment data at risk for compromise.
When breaches do occur, response time continues to be a challenge. In more than one quarter of all breaches investigated worldwide in 2014 by Verizon, it took victim organization weeks, or even months, to contain the breaches. It is against this backdrop that global cybersecurity, payment technology and data forensics experts are gathering in Vancouver for the annual PCI North America Community Meeting to address the ongoing challenge of protecting consumer payment information from criminals, and new best practices on how organizations can best prepare for responding to a data breach.
A data breach now costs organizations an average total of $3.8 million. However, research shows that having an incident response team in place can create significant savings. Developed in collaboration with the Payment Card Industry (PCI) Forensic Investigators (PFI) community, Responding to a Data Breach: A How-to Guide for Incident Management provides merchants and service providers with key recommendations for being prepared to react quickly if a breach is suspected, and specifically what to do contain damage, and facilitate an effective investigation.
The silver lining to high profile breaches that have occurred is that there is a new sense of urgency that is translating into security vigilance from the top down, forcing businesses to prioritize and make data security business-as-usual,” said PCI SSC General Manager Stephen W. Orfei. “Prevention, detection and response are always going to be the three legs of data protection. Better detection will certainly improve response time and the ability to mitigate attacks, but managing the impact and damage of compromise comes down to preparation, having a plan in place and the right investments in technology, training and partnerships to support it
This guidance is especially important given that in over 95% of breaches it is an external party that informs the compromised organization of the breach,” added PCI SSC International Director Jeremy King. “Knowing what to do, who to contact and how to manage the early stages of the breach is critical
At its annual North America Community Meeting in Vancouver this week, the PCI Security Standards Council will discuss these best practices in the context of today’s threat and breach landscape, along with other standards and resources the industry is developing to help businesses protect their customer payment data. Keynote speaker cybersecurity blogger Brian Krebs will provide insights into the latest attacks and breaches, while PCI Forensic Investigators and authors of the Verizon Data Breach Investigation Report and PCI Compliance Report, will present key findings from their work with breached entities globally. Canadian organizations including City of Calgary, Interac and Rogers will share regional perspectives on implementing payment security technologies and best practices.
Download a copy of Responding to a Data Breach: A How-to Guide for Incident Management here.
The original PCI SSC press release can be found here.
Banks with weak cybersecurity controls could be downgraded even if they haven’t been attacked, Standard & Poor’s said Monday in a report.
While it hasn’t yet downgraded a bank based on its computer security, the ratings company said it would consider doing so if it determined the lender was ill-prepared to withstand a data breach. It would also drop a bank’s rating if an attack caused reputational harm or resulted in losses that hurt profit, S&P said.
We view weak cybersecurity as an emerging threat that has the potential to pose a higher risk to financial firms in the future, and possibly result in downgrades
S&P analysts led by Stuart Plesser wrote in the report.
Cyberattacks have become a growing threat for banks, with more than a dozen U.S. depository institutions reporting hacks in 2012 and 2013 that prevented consumers from accessing their websites, according to the report. Last year, the personal data of tens of millions of JPMorgan Chase & Co. customers were compromised in a breach. The bank spent $250 million on cybersecurity in 2014 and will increase that to $450 million by next year, S&P said.
Hostile nation-states, terrorist organizations, criminal groups, activists and, in some cases, company insiders are behind most of the global cyberattacks on banks, S&P said. South Korea financial institutions have experienced security breaches in recent years, while a Russian security company working with law enforcement said it uncovered a two-year, billion-dollar theft from banks around the world by a gang of cybercriminals, according to the report, which didn’t identify the lenders.
S&P classified the global risk of cyberattacks as “medium,” saying large banks have taken steps to mitigate the danger. Bigger institutions have an advantage over smaller ones because their revenue base can defray some expenses, according to the report.
Few banks have disclosed the amount they’re spending to guard against attacks, S&P said. Still, any cuts to technology units as part of larger cost-savings efforts would be “disconcerting.”
Cyberdefense is a continual battle, particularly as technology evolves,” according to the report. “Many tech experts believe that if a hostile nation-state put all its resources into infiltrating a particular bank’s tech system, it would probably prove successful
The original article was published in Crain”s New Yokr Business.
An ISACA survey of more than 900 cybersecurity experts shows that
The 2015 Mobile Payment Security Study from global cybersecurity association ISACA suggests that people who use mobile payments are unlikely to be deterred by security concerns.
Other data from the survey show that cybersecurity professionals are willing to balance benefits with perceived security risks of mobile payments:
Mobile payments represent the latest frontier for the ongoing choice we all make to balance security and privacy risk and convenience,” said John Pironti, CISA, CISM, CGEIT, CRISC, risk advisor with ISACA and president of IP Architects. “ISACA members, who are some of the most cyber-aware professionals in the world, are using mobile payments while simultaneously identifying and contemplating their potential security risks. This shows that fear of identity theft or a data breach is not slowing down adoption and it shouldn’t as long as risk is properly managed and effective and appropriate security features are in place
Reports say that contactless in-store payment will continue to grow. Overall, the global mobile payment transaction market, including solutions offered by Apple Pay, Google Wallet, PayPal and Venmo, will be worth an estimated US $2.8 trillion by 2020, according to Future Market Insights.
ISACA survey respondents ranked the major vulnerabilities associated with mobile payments:
What Consumers Need to Know
According to those surveyed, currently the most effective way to make mobile payments more secure is using two ways to authenticate their identity (66%), followed by requiring a short-term authentication code (18%). Far less popular was an option that puts the onus on the consumer installing phone-based security apps (9%).
People using mobile payments need to educate themselves so they are making informed choices. You need to know your options, choose an acceptable level of risk, and put a value on your personal information,” said Christos Dimitriadis, Ph.D., CISA, CISM, CRISC, international president of ISACA and group director of information security for INTRALOT. “The best tactic is awareness. Embrace and educate about new services and technologies
Understand your level of risk: Ask yourself what level of personal information and financial loss is acceptable to balance the convenience of mobile payments.
Know your options: Understand the security options available to manage your risk to an acceptable level. Using a unique passcode should be mandatory, but also look into encryption, temporary codes that expire and using multiple ways to authenticate your identity.
Value your personal information: Be aware of what information you are sharing e.g., name, birthday, national identification number, pet name, email, phone number. These pieces of information can be used by hackers to gain access to accounts. Only provide the least amount of information necessary for each transaction.
Security Governance for Retailers and Payment Providers
In the emerging mobile payment landscape, ISACA notes that there is no generally accepted understanding of which entity is responsible for keeping mobile payments secure—the consumer, the payment provider or the retailer. One approach is for businesses to use the COBIT governance framework to involve all key stakeholders in deciding on an acceptable balance of fraud rate vs. revenue. Based on that outcome, organizations should set policies and make sure that mobile payment systems adhere to them.
Members of the IT or information security group taking part in the discussion should also ensure they are keeping up to date with the latest cybersecurity developments and credentials. A joint 2015 ISACA/RSA study shows that nearly 70% of information security/information technology professionals require certification when looking for candidates to fill open security positions.
The full ISACA Press Release can be found here.