BitSight Technologies’ BitSight Insights report analyzed security ratings for over 70 Fortune 200 companies in four industries – energy, finance, retail and technology – using data for observed security incidents, including communication with known command-and-control servers, spam propagation and malware distribution.
“BitSight’s outside in, data driven approach to rating shows clear differences amongst industries,” said Stephen Boyer, BitSight co-founder and CTO, in a statement. “By looking at evidence of compromise, we focus on outcomes rather than policies. Companies can have very similar policies, but their effectiveness can still vary widely. For example, the technology sector companies included in this analysis had significantly lower ratings than companies in the financial services sector. The spread is surprising.”
Technology companies are required to be compliant with the regulations of the industries they serve, including HIPAA, PCI DSS and FISMA, but the sector measures dramatically lower than retail and finance.
High-profile breaches including Bit9 and Adobe may indicate why the technology industry rates less effective, BitSight noted: the persistency of attacks and time to remediate are key contributors to low security ratings in this industry. The Adobe data breach that also impacted Dun & Bradstreet and LexisNexis went unobserved for months before a third-party researcher uncovered the incident.
Meanwhile, in finance, along with the known tactics employed by cybercriminals, this sector was also hit with several politically motivated distributed denial-of-service (DDoS) attacks. Yet in spite of frequent cyber-attacks on financial institutions, the finance sector rated the most favorable in terms of security effectiveness, mostly because the companies assessed were quicker to respond to threats than their peers in other industries. And faster response time leads to less damage and loss.
Also, due in part to the need to meet security and privacy regulations and the desire to stay out of news headlines for losing customer data, financial institutions tend to focus more executive-level resources on IT security and risk management than other industries.
Meanwhile the energy sector, which includes utilities and oil and gas companies, rated highly last year but fell sharply in the first half of 2013 when faced with extensive malware and botnet attacks. Not only was there an increase in the number of security incidents in the first quarter 2013, but energy companies were slow to respond to these incidents. However, in the third quarter of 2013, the energy industry’s average effectiveness showed an upward trend, suggesting that they may be getting better at thwarting cyber-attacks.
The retail sector, which excludes solely online retailers for the purposes of the report, also started out on an upward trend in Q4 2012, but then hit a rough patch in Q1 2013, showing that they continue to be an attractive target for cyber-criminals seeking access to identity and financial information. The retailers included in the study faced an increase in botnet, spam, phishing and malware attacks in the first quarter of the year, and took longer to remediate attacks as their frequency increased. As a result, the security ratings of this group have remained relatively flat in the past two quarters, leaving much room for improvement.