Kaspersky Lab survey of IT professionals worldwide

According to a Kaspersky Lab survey of IT professionals worldwide, 48% of e-commerce/online retail businesses and 41% of financial services organizations have reported losing some type of finance-related information to cybercriminal activities within a 12 month period.

Kaspersky Lab’s survey also surprisingly  found that the e-  commerce/online retailer  business segment is the least likely to deploy  and update specialized anti-fraud measures to protect financial    transactions.

Attitudes toward Technology

The e-commerce/online retail and financial services business sectors both depend on their abilities to receive, process and store sensitive financial information from customers. Through a combination of targeted attacks, application vulnerabilities and other forms of cyberattacks, almost half of businesses in both sectors will lose some of this information over the course of a year. Such a loss can not only damage the reputations of these businesses, which are highly dependent on trust, but can also trigger costly legal penalties and removal/clean-up costs. But while these two segments share these similarities, their attitudes towards security technology are markedly different.

Only 53% of the e-commerce/online retail segment indicated that they “make every effort to keep anti- fraud measures up to date,” which is 10% lower than the overall global average, and the lowest overall of any business segment. Since the entire business model of online merchants is based on online and electronic payment processing, this reluctance to invest in anti-fraud measures seems highly counter- intuitive.

The financial services segment takes a more positive and proactive approach towards securing their financial data. When asked if they “make every effort to keep anti-fraud measures up to date,” 64% of financial services providers agreed, a response rate tied for highest across all segments. This enthusiastic response is the complete opposite of the attitudes in the e-commerce/online retail segment. Additionally, 52% of the financial services segment reported a desire to implement new technologies to protect financial transactions, compared to 46% of the e-commerce/online retail segment

Changes after a Breach

Kaspersky Lab’s survey asked businesses that experienced a serious data loss incident about steps taken afterwards to protect their customers, and despite their differing attitudes, both the e-commerce/ online retail and financial services sectors took similar steps to implement additional protections. The most common measure implemented was “providing secure connections for customer transactions,” which was done by 88% of financial services organizations, and 78% of e-commerce/online retailers. Financial service providers are more focused on providing specialized solutions for mobile devices than e-commerce/online retailers (75% vs. 56%, respectively), which means mobile payment security for online merchants may be a future area of concern.

In general, the least-common step taken by both financial service providers and e-commerce/online retailers following a data breach was to provide free or discounted versions of premium internet security software to their customers. It would appear that both sectors are more willing to invest in securing their own systems, rather than investing in securing their customers’ systems.

Lastly, despite the relatively high adoption rates of specialized fraud protection for endpoints following a data breach – 71% for financial services, and 62% for e-commerce/online retailers – the flip-side of those numbers is noteworthy. These numbers show that approximately one-third of companies in both sectors are still not investing in financial security software, even after financial information is stolen from them in a data breach incident.

Recommendations

Security industry research shows that businesses specializing in collecting and processing customer payment information are being actively targeted by cybercriminals, and this Kaspersky Lab survey shows that these businesses are very likely to lose payment data through a data breach. Instead of reacting to the attack, Kaspersky Lab advises businesses to be proactive in securing their IT networks, as well as securing payment systems with specialized protection.

Kaspersky Endpoint Security for Business helps protect a business network from an onslaught of malware, phishing, and other cyberthreats. Financial institutions need advanced endpoint security across their entire network, including mobile devices and virtual machines as well as PCs, and Kaspersky Endpoint Security for Business can bring protection for all these endpoints to a single administrator console, giving IT managers’ superior visibility and policy control over the security of their network.

Kaspersky Fraud Prevention unites a number of technologies to monitor the “back-end” processing of banks for malicious activity, ensures the protection of customer endpoints, including their mobile devices, and provides an SDK for reinforcing the security of mobile banking applications. This fraud protection platform also uses Kaspersky Lab’s threat intelligence services to increase bank employees’ levels of cyberthreat knowledge and bolster the effectiveness of technologies used to protect financial data.