Despite Target, Retailers Still Weak On Third-Party Security

The big Target breach last year was actually the second stage of an attack that began by breaching the retail giant's third-party HVAC subcontractor (although the general public seems to forget that fact). This should have taught companies a lesson about the risks of letting business partners run pell-mell around one's network without paying any mind to their own security posture. However, according to new research from TripWire, at least one-quarter of retailers have not yet learned that lesson.

On one end of the spectrum, 12% of retailers who responded say they require third-party partners to pony up regular reports on vulnerability scans on their network and Web applications. On the other end of the spectrum, 26% said, "We don't evaluate the security of our business partners."

In fact only 70% of respondents said that the Target breach affected the level of attention that their businesses' executives pay to security. This number was even lower (57%) for online-only retailers.

Happily, 60% of respondents said they could identify a breach within 72 hours, 7% said they could do it in a month, and 1% within three months. However, a full 20% simply admitted that they weren't confident they could identify breaches quickly -- and that's particularly discouraging if within three months is considered "quickly."

Some 18% confessed that they were "not at all confident" that their security controls could detect rogue applications (including malware), 35% said they were very confident, and the rest said they were "somewhat" confident.