The technology industry is lacking in security effectiveness and performance across industries from October 2012 through September 2013 compared to three other industries, a new survey said.
In addition to the technology industry, the other industries surveyed by security firm BitSight include: Energy, retail and financial. In spite of all the attacks from criminals and hacktivists over the past year, the financial industry performed well.
Leveraging big data for observed security incidents, including communication with known command and control servers, spam propagation and malware distribution, BitSight SecurityRatings provide a perspective on risk from the outside-in. The ratings range from 250 to 900, with higher numbers equating to better security effectiveness. Factors used to determine ratings include the classification, frequency, and duration of observed security incidents.
“By looking at evidence of compromise, we focus on outcomes rather than policies,” said Stephen Boyer, BitSight co-founder and CTO. “Companies can have very similar policies, but their effectiveness can still vary widely. For example, the technology sector companies included in this analysis had significantly lower ratings than companies in the financial services sector. The spread is surprising.”
Technology companies must be compliant with the regulations of the industries they serve, including HIPAA, PCI DSS and FISMA. With this consideration, it is surprising the technology sector measures lower than retail and finance.
In spite of frequent cyber attacks on financial institutions, the finance sector rated the most favorable in terms of security effectiveness. Along with the known tactics employed by cyber criminals, this sector was also hit with several politically motivated distributed denial of service (DDoS) attacks.
One reason for the high SecurityRatings is that the companies assessed were quicker to respond to threats than their peers in other industries. Faster response time leads to less damage and loss.
The energy sector, which includes utilities and oil and gas companies, rated highly in Q4 2012, but fell sharply in the first half of 2013 when faced with extensive malware and botnet attacks. Not only was there an increase in the number of security incidents in Q1 2013, but energy companies were slow to respond to these incidents. However, in the third quarter of 2013, the energy industry’s average effectiveness shows an upward trend, suggesting that they may be getting better at thwarting cyber attacks.
The retail sector, which excludes solely online retailers, also started out on an upward trend in Q4 2012, but then hit a rough patch in Q1 2013, showing they continue to be an attractive target for cybercriminals seeking access to identity and financial information.
The retailers included in this study faced an increase in botnet, spam, phishing and malware attacks Q1 2013, and took longer to remediate attacks as their frequency increased. The SecurityRatings of this group remained flat in the past two quarters, leaving much room for improvement.
Click here to view a copy of the report.