Purpose of this paper
We examine external DNS management as a known, and under-addressed vulnerability among retail enterprises.
Our observations are:
- The DNS is a principal threat vector, enabling cyber-attackers.
- Compliance standards for external DNS management are inconsistently followed.
- DNS management best practices can mitigate retail sector cyber-risk.
White Paper Contents Overview
The State of Threats and Compliance in Retail
Few sectors are as focused on IT security compliance as retail. It’s a virtual goldmine of sensitive consumer data intersecting with payment authorities, supply chain partners, and other stakeholders.
Retail ranks among the 5 most cyber-attacked sectors
Retail consistently ranks among the top five “most cyber-attacked” sectors with one ranking it the most cyber-attacked sector in 2019.
According to Fortinet, 24% of cyberattacks target retailers. “Given the wealth of payment information retailers have access to, it is no surprise that nearly a quarter, 24%, of all cyberattacks (target) retailers. Retailers often have varying levels of security, leaving them exposed to cyber criminals.”
IT security compliance standards in retail
Despite the many security framework standards followed by retail organizations, they remain a perennial target to cybercriminals, who are regularly succeeding in ransomware scams, data exfiltration, phishing exploits, and more.
We observe two reasons for this: