Report: Some Retail Firms Still Don’t Recognize Cyber Security Risks
Nearly 60 percent of retail companies describe their cyber security exposure as “significant,” “serious,” or “critical,” but another 9 percent are not reporting any cyber security exposure at all, according to a report published Wednesday.
According to a study of filings with the Securities and Exchange Commission conducted by risk advisor and insurance broker Willis Group Holdings, almost a tenth of retailers have not reported any cyber risk in financial documents filed with the SEC, which has required such reporting since Oct. 2011. The report describes the non-disclosure as “surprising,” given the high-profile breaches recently discovered at retail chains such as Target, Michaels, and Neiman-Marcus.
Among those that did report cyber exposure, the top three risks cited were privacy/loss of confidential data (74%), reputation risk (66%), and cyber liability (61%). Cyber risk at the hands of outsourced vendors ranked at just 9%, a result Willis also describes as “surprising,” given the level of outsourcing across the sector and retailers’ heavy reliance on third-party technology partners.
Almost half (49%) of retail companies cited the use of technical safeguards as a chief remedy for cyber risk — more than the Fortune 1000 as a whole (43%), the report states. However, 17% of retail companies reported inadequate resources to limit cyberlosses.
Less than one tenth (9%) of the retail sector indicated that they have purchased insurance for cyber exposures.
Chris Keegan, senior vice president for e-risk at Willis North America and co-author of the report, says the retail industry is “slightly behind the curve” in protecting itself against cyber security threats.
“A series of recent high-profile cyber breaches has pointed a government spotlight at the sector, and Willis expects this scrutiny to continue,” Keegan says. “Our advice for retailers is: Don’t wait for the SEC to come knocking on your door.”
Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech’s online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one … View Full Bio
Article source: http://www.darkreading.com/risk/compliance/report-some-retail-firms-still-dont-recognize-cyber-security-risks/d/d-id/1234833?_mc=RSS_DR_EDT