Consumer business security survey: taking the longer term view

Deloitte

Description

The survey looks at security in the consumer business industry. It highlights some improvements across the industry with an increase in the number of companies having a formally defined information security strategy, 43% compared with 20% last year.

Sujets

• Surveyor 3

Informations

• Publié par: deloitte
• Nombre de lectures: 131
• Langue: English

Extrait

2 CB 9489ey 0Survhtq _9iw2:49ouet BFO C89e urchro2/20/72 :11  900F 1C

Take the longer term view Consumer Business Security Survey 2009

74  aPeg

249:2te8994thwiuo qyevr_90 C 98uS B9  11:477/02/200hcru e2 C OFB or

1 F o reword

13 C onclusion

2 A b out the survey

10 T r aining and awareness

12 D ata quality

8 T h ird parties

3 K e y findings

4 T h e general state of security

6 T h reats, vulnerabilities and impacts

Contents

2CF egaP  

TekaytiruceSssenis19002eyrvSuremretolgnhterBusumeConview ye0 _9iwC  BuSvr:29489 Cth quote289941 :174  202/00 9ure  27/FO Broch

Despite the economic climate negatively impacting  Third parties form a core part of any supply chain, Consumer Business (CB) organisations, security issues  and now have increasing responsibility for handling remain high on the agenda. In what may be a rare  and processing sensitive data. Understanding the risks piece of good news for the industry this year, we have  associated with third arties seenrealimprovementinseveralareasofsecurityover effectively,whetherth p atbe  in an  d m  ai m nt a a n i a ni g n in g g   c t o h n e ti s n e u  ity the past twelve months – a recognition perhaps that media coverage on data loss incidents still has the  of supply or protecting confidential data, is critical. attention of senior management.  Organisations have started to consider these risks more formally, but few currently assess the effectiveness of The second edition of Deloitte’s annual Consumer  the controls in place around these third parties. Business Security Survey allows companies in the industry to understand current security issues and  Deloitte’s 2009 Consumer Business Security Survey provide a benchmark to their peers.  identified the security issues and threats that are of the greatest concern to CB companies. The survey There are a number of reasons why security is critical  highlights the measures businesses are taking to to CB organisations:  avoid security breaches and ensure compliance.  Consumers trust retailers with a considerable  Thank you for your time and participation. volume of personal and financial data. They expect  We hope you find the report useful. CB organisations to protect their data to the same standard as a bank. When companies breach that trust, the effects can be devastating to the brand. Retailers cannot afford to lose any custom in the current market.  Many organisations are heavily focussed on reducing costs and improving liquidity. Poor quality data generates considerable inefficiencies in processing and impacts on the accuracy of management information.  e a son With data volumes rising by 50% per year*, the data is  Head of UK Security & Privacy there in abundance – but management don't trust it and struggle to derive value from it.

* Why database archiving should be part of your DBMS strategy, quotation fromacommissionedstudcyonductedbyForresterConsultingonbehalfof Clearpace, January 2008.

gePa

Foreword

 1

O Br9 CFre  ochu huqw_ti9284to:e SCB9 4809y veur92

About the survey

2

2

Specific interview topics included:  Governance, structure and investment  Strategy and initiatives  Threats, vulnerabilities and impacts  Incident detection and management  Technologies  Training and awareness    Third parties  Business continuity planning   Data quality   Compliance 

Deloitte undertook a survey in the UK to help CB companies benchmark their security practices against their peers. Data was collected through discussions between Deloitte’s CB security specialists and security management from consumer business companies. This second annual edition of the survey saw a significant increase in responses, with the involvement of some of the UK’s largest retailers and consumer goods businesses. This year’s survey has again crossed borders to include responses from three Swiss businesses. Respondents were typically: Chief Information Security Officers (CISO), Information Security Managers, Chief Security Officers (CSO) or IT Directors. Retailers made up 48% of respondents and consumer goods businesses 35%, with the remaining 17% of surveys completed by businesses operating in the business service sector.

P  7 ega  09:411/027202/

2rvSu 0ey8994B  Cth q9_wi:294uoteOFB 98C ru eorhc/2027/ 21: 19 00egaP  74

Top five threats envisaged in 2009:  Social engineering  Theft or leakage of internal data  Employee misconduct  Virus/worm outbreaks  Weak passwords Top five security initiatives:  Regulatory compliance  Data leakage  Reporting and measurement  Infrastructure improvement  Governance

 Over half of the companies interviewed have experienced project cuts as a result of the economic downturn.  91% of consumer businesses have experienced at least one information security breach in the last 12 months, a 27% increase on last year.  48% of CB companies anticipate that social engineering will be a major threat to security in 2009.  96% of consumer businesses have third parties with access to their customer data.  57% do not carry out periodic security assessments once third parties have been engaged.  74% of companies do not heava defined information security training and awareness programme.  43% of CB companies have a formally defined information security strategy, compared with 20% last year.

Keyfindings

Take the longer term view C onsumer Business Security Survey 2009 3 

3 

e 4 Pag:47   11

10% 4

Formally documented In draft form Intend to have within 12 months Intend to have within 24 months No information security strategy

Thegeneralstateofsecurity

The need for diligent security practice has never been of developing a strategy. Although this is a marked greater than during this time of increased economic improvement since 2007, consumer businesses still uncertainty. The CB Sector has been hit particularly hard, lag considerably behind the Financial Services Industry with slowed growth, decreasing profits and an increasing (FSI) in the formal development of both security strategies number of high-profile insolvencies. The results of the (61% of FSI companies have a formally documented survey show that while relative investment in security is strategy) and governance frameworks (45% in CB, expected to maintain an upwards trend, the immediate compared with 69% in FSI****). effects of the economic downturn are putting pressure on security and technology budgets. The list of the top five security initiatives saw important changes from 2007. Regulatory compliance, governance The impact of the economy on security budgets has the and infrastructure improvement feature in both. potential to negatively affect security and compliance Reporting and measurement was an addition to the top initiatives over the coming year. 55% of respondents five list, perhaps indicating an awareness that managers have experienced project cuts as a direct result of the will have to provide better evidence of the security credit crunch and 30% expect budget cuts in 2009. When function’s value to the business in order to win funding asked about plans to fulfil PCI DScSo*mpliance, 79% of in the current economic climate. The top positioning of respondents processing card payments said that they have regulatory compliance and data leakage highlight the started programmes to do this. With 45% of companies importance consumer businesses place on fulfilling their planning to meet PCI requirements and estimating data security obligations. The inclusion of data leakage spending in excess of £1 million**, any budget and project as one of this year’s top security initiatives is also likely cuts are likely to cause delays in achieving compliance. to be a reflection of continued media focus on data loss and subsequent damages caused. Security strategy also The focus of our 2007 CB security survey*** report remains a high priority, providing an encouraging sign was the tactical (rather than strategic) approach that that consumer businesses understand that security businesses were taking to information security. This year’s programmes must be continually evolved to provide results indicate that businesses are beginning to trend current and effective risk mitigation to prevent security toward a more strategic approach to security with 43% breaches or financial loss. having a formally documented information security strategy, compared to 20% in 2007 (see figure 1). Th * Payment Card Industry Data Security Standard (PCI DSS) e ** Swiss companies responses were given in CHF. The exchange rate used was remaining respondents had security strategies in draft 1 GBP to 2 CHF. form (43%) or intended to have one within the next *** Survey conducted between September and October 2007 and report published in December 2007. This year’s survey was conducted between 24 months (10%), a sign of maturity when compared November 2008 and January 2009. to the 20% of 2007 respondents with no intention **** Findings of the Sixth Annual Deloitte Touche Tohmatsu (DTT) Global Financial Services Industry (GFSI) survey, published February 2009. Figure 1: CB companies with a security strategy in 2007 and 2009 2007 2009

6%

ocBrO CF9 4829e:9002/20/72  eruh 4 _w09y veotquh it8492ruS BC 9

027/ 2e urchro BOFC 98492:etouq 

Take the longer term view C onsumer Business Security Survey 2009 5 

Ayearonandit’sclearthat mostcompaniessurveyed havetakeninitialstepsby identifyingasecurity managerandputtingin placebasicsecurityprotective measures, but they have not reached the level we see in otherindustries.

Mike Maddison, Head of UK Security & Privacy 

ge 5  aP:174 91 2/00 09_withB Survey24998C 

Data on security breaches over the past year indicates that the occurrence of external security breaches is increasing with 91% of respondents having experienced at least one in the past year, compared with 64% in 2007. Internal security breaches were also common, affecting 76% of respondents. Virus outbreaks and employee misconduct were the most frequently experienced breaches, occurring for 35% and 43% of respondents, respectively. Notably, 61% are “not very” or only “somewhat” confident that their network is protected from internal breaches.

Although the credit crunch made the most headlines With phishing/pharming and social engineering attacks in 2008, customer data loss has continued to feature inalready affecting 39% of respondents, businesses thenews.Theriskofcustomerdatalosswillalwaysbesahouldguardcloselytopreventthemdirectlyinvolving top security issue for consumer businesses as they focus their brand name. An increase in reputation-hijacking heavily on developing a brand image and customer designed to abuse customer trust in a brand name for loyalty, both of which can be severely damaged becausefinancial gain has been predicted for 2009. This type of of an incident. In fact, survey results show that 83% ofattack increases potential damage to brand reputations respondents perceive the most significant consequence and should be of particular concern to consumer of a data breach to be loss of reputation (see figure 2).businesses, especially in times of recession where there is already an increased likelihood that customers will switch brand. The occurrence of external t W he h  e c n o  m as in ke g d   1 a 2 b  o m u o t nt p h re s, d  i r c e ti s o p n o s n  d fo e r n  t t s h  r r e a a n t k s e  d o  v s e o r c  ial security breaches is increasing e b e n u m g si p i n l n o e e y s e s e r . e i  n  T g m h , i i  s s t  c h i o s ef  n t a d   u o d c r t r  a  l a e m s a a  k t t a i h c g e  e c   h g o r a f e n  a g c t u e e s  s t t w o t h m h e e r n r e   a c d ts o a  t m t a o p   a a t r n h e d e d ir  with 91% of respondents having w r it e h di  c s t p e y d w i are,viruses/worms e , r  e a n n c d e  s p i h n is  h t i h n e g  / li p s h ts a  r in mi d n ic g ate ed at least one in the experienc t t p h h e at   e c v o ol n u s t u io n m n  e  2 r o  0 f b 0  u 7 s s . e i  c n T u e h r s i e s ty e  s  d  t if h a f r r e e a  t b s. e  ginningtorecognise past year.

Threats, vulnerabilities and impacts

6

6 egaP  74:11  90022//027  rehuocBrFC O84 9:e92uqtoith 09_wvey  Sur8492BC 9

299 48to:e huq 9FC9284urveCB S_wity 09  9002/2P  74:11huocBrO /027  reage 7

Take the longer term view C onsumer Business Security Survey 2009 7 

The perception that social engineering will be the top Figure 2: Most severe consequences of data breaches security threat for 2009 is consistent with security industry predictions that the technique will continue 100% to be developed by hackers. Whilst the agreement between respondent and industry predictions shows 80% an improved ability to look toward the future, survey results still suggest that consumer businesses are often failing to address security issues effectively. For example, 60% employee training and awareness is an important method of protecting against social engineering attacks; however, two-thirds of respondents have not yet begun 40% to develop a training programme. 20% As a direct result of the prominence of security breaches in the media, 73% of consumer businesses and 91% of retailers surveyed have undertaken activities 0% to understand how they process customer data and  how to improve the security around these processes. However, reduced budgets brought on by the recession will not aid security managers in addressing threats over the next 12 months.

83%

4%

22%

26%

Loss of customers Loss of revenue Loss of stakeholder confidence Damage to reputation and brand

ag P8e 11  7 :4

Only 43% of respondents are performing periodic assessments after engagement with external parties. Of all respondents, 39% rely primarily on security clauses within contractual agreements to protect data provided to external parties.

Third parties

8

CFO Broce:29489 0//20290uher  728492ruS BC 9_w09y veotquh it

gaP 9 e

43% 26% 35%

74%

87%

The use of specialised suppliers can be both cost efficientAdditionally, it was found that 62% of respondents and a means to deliver greater value to customers. While do not involve third parties in their business continuity third parties can undoubtedly offer significant benefits, plans. Suppliers are vital to ensuring the uninterrupted the use of an external supplier also introduces a host of operation of consumer businesses, meaning that failing additional security issues, especially where they are given to include them in continuity plans increases vulnerability access to sensitive customer data. to supply chain and service disruptions with the worse case scenario resulting in the collapse of the business. Survey results show that 96% of respondents use third parties that require access to customer information as Now, more than ever, it is important that consumer part of their normal operation. This includes customer businesses start taking third party security seriously. names, addresses, birth dates, health details and other In an economic downturn, consumers tend to spend data of a personal nature. Even when data is in the less, and some choose to trade down on brand quality hands of a supplier, the originating company is still but customers are not willing to compromise on data ultimately responsible, as shown by PCI DSS and * DPA security: businesses need to find  waay to cut costs requirements. They state that businesses should ensure and, as a result, may start to rely more heavily on third that engaged third parties are capable, reliable and have parties. Consumer businesses must not lose sight of sufficient controls in place to maintain the confidentiality the fact that they are ultimately responsible for the and integrity of the data they are processing. security of data collected from their customers. If a third party security breach results in the loss of customer Although the percentage of respondents stating that data, the brand that customers trusted in the first they carry out security assessments before engaging instance will be the one to suffer the financial and third parties (74%) has doubled from last year’s results reputational consequences. (36%), only 43% are performing periodic assessments after e xternal a ies *Payment Card Industry Data Security Standard (PCI DSS) and UK Data Ofallr n e g s a p g o e n m d e e n n t ts  , w  i 3 t 9 h % e relypri p ma r r t ilyo (s n e  e s  e f c i u g r u it re3). Protection Act (DPA) (1998) y clauses within contractual agreements to protect data provided to external parties and, surprisingly, a further 9% of consumer businesses reported having no procedures in place to check third party security at all. Figure 3: Methods used to ensure that third parties provide adequate protection of information Security requirements included in contract Periodic third party security assessments Engage another third party to perform a security audit Third party required to provide a Service Auditors Report Restrict third party access to systems data 4% Other method of assessing 9% third parties No processes or procedures for checking third party security 0% 20% 40% 60% 80% 100%

FC OrBcouher  72/02/2009  11:47 _w09y veur SCB9  98492:etouq hti9284 inusBercuSeseseivmretmusnoCw9Sruiryt0290evyregnolehtekaT