Research has revealed that the likes of Costco, Walmart and The Home Depot are more at risk to web-based cyberattacks then compared to their EU counterparts, according to findings from Outpost24.
In a year that saw a global pandemic leading to a 30% surge in online shopping and exponential growth in cybersecurity threats for enterprises, Outpost24 analysed the web application attack surface for 20 of the biggest retailers in Europe and the US to evaluate how secure they are with the results released in the 2020 Web Application Security for Retail & E-commerce Report.
Using an average risk exposure score based on Outpost24’s attack surface discovery tool, Scout, the findings revealed that web applications used by US retailers were more at risk, with an aggregated average risk score of 35 out of a maximum score of 42.33, which was higher than their EU counterparts at 31.
On average, the report found US retailers to be running more publicly exposed web applications (3,357) compared to EU retailers, which ran fewer applications (2,799). Yet, despite having a smaller attack surface, EU retailers had a higher percentage of applications using old components that contained vulnerabilities (27%) as opposed to their American rivals (22%). Nonetheless, all retailers had security risks within their web environments that could expose them and their customer data they hold to potential exploitation and compromise.
Nicolas Renard, Security Analyst at Outpost24 comments “criminal hackers are masters of reconnaissance and will go to great lengths to identify weak spots in their target. The rather high-risk exposure score among the top retailers is a worrying trend, as bigger attack surfaces create more opportunity for bad actors to find holes in their security defence and execute potential exploits”.
The list of retailers were chosen based on Deloitte’s Global Powers of Retailing Report 2019 and had their public-facing web security environments analysed against the seven most common attack vectors used by hackers during reconnaissance, to ascertain the risk score, including Security Mechanisms, Page Creations Methods, Degree of Distribution, Authentication, Input Vectors, Active Contents and Cookies (score 1-100 each).
Security Mechanisms was the single biggest attack vector for both EU and US retailers, attaining a risk exposure score of 90.5 and 99 respectively. For retailers using HTTP websites, and not restricting access to adversaries trying to get into unsecured parts of a site without encryption, this will contribute to a higher attack surface score. Active Content, which observed how web applications were running scripts, was the second most dangerous as both US and EU retailers acquired scores of 88 or more. Third highest was Degree of Distribution with all retailers attaining scores higher than 77.9, which is attributed to the high number of product pages commonly found on large ecommerce sites making it difficult to secure everything.
