Retailers overconfident in endpoint security

A new study conducted by Dimensional Research evaluated the confidence of IT professionals regarding the efficacy of seven key security controls, which must be in place to quickly detect a cyber attack in progress. Study respondents included 763 IT professionals from various industries, including 100 participants from the retail sector.

Despite unique attacks on their sector, retail IT professionals participating in Tripwire’s study were overconfident in their ability to quickly collect the data needed to identify and remediate a cyber attack. For example, seventy-one percent of the retail respondents believed they could detect configuration changes to endpoint devices on their organizations’ networks within hours. However, only fifty-one percent of the respondents knew exactly how long this process would take.

According to Verizon’s 2016 Data Breach Investigations Report (DBIR), ninety-nine percent of successful system compromises occurred within hours and it took seventy-nine percent of retailers weeks or longer to discover that a breach had occurred. It also found that eighty-nine percent of breaches impacting the retail sector either had a financial or espionage motive, and sixty-four percent of retail data breaches involved point-of-sale intrusions.

The increased scrutiny of retail cyber security in the wake of major breaches has forced organizations to focus on securing their environments, yet these survey results show that there’s still a lot of room for improvement,” said Tim Erlin, senior director of IT security and risk strategy at Tripwire.

Additional retail findings from the study included:

• Eighty-four percent of the respondents said they could isolate and remove an unauthorized device on their networks within hours; however, only fifty-one percent know exactly how long this process would take.
• Only forty-three percent of the respondents know exactly how long it would take for their vulnerability scanning systems to generate an alert if an unauthorized device was detected on their networks, but eighty-one percent believe it would happen within hours.
• Fifty-one percent of the respondents believe their automated tools do not pick up all the necessary information, such as the locations and departments, needed to identify unauthorized configuration changes to endpoint devices.
• Over one-third (thirty-six percent) of the respondents said less than 80 percent of patches succeed in a typical patch cycle.
• Thirty-eight percent of the respondents reported that all detected vulnerabilities are not fixed within 15 to 30 days.