2016 Cybersecurity Report (for Pizza Only)

Introduction

Published in

piss.io

9 min readJul 11, 2016

As consumers in an increasingly complex hellworld, we must entrust far more companies and individuals with our personal data than our cash-only ancestors did. If you’re like me, you probably swipe your debit or credit card several times a day without really thinking about it and log yourself into websites and services more frequently than you realize. It’s just how we operate now, for better or worse. I’m not smart or weird enough to go totally off the grid, so instead I must cope.

Over the weekend I realized that I had bought pizza twice. For the first one I entered my card online and the second time I swiped my card in-person at a point-of-sale system. In order to avoid thinking about the fact that I was having pizza twice in 2 days, I began thinking about where my personal data was actually going and decided to look into the cybersecurity of pizza.

These are just pizza places. Who cares?

Certainly a pizza place doesn’t have the same kind of target on its back as, well, Target. Or a bank or health insurance provider. But being a less-attractive target doesn’t mean you won’t get yours — CiCi’s Pizza experienced a massive point-of-sale data breach earlier this year, and in Maine, Portland’s local OTTO Pizza inadvertently exposed 900 customers’ information in 2014 — despite being PCI-DSS compliant.

Something often overlooked in cybersecurity reporting is that criminals don’t just target banks, governments and huge businesses — that’s Hollywood. Movies would be pretty boring if some guy was just uploading malware onto POS systems with a flash drive. The reality is, any business using and storing customer data — which is to say, basically all businesses — should be considered at-risk of being targeted. A credit card number taken from a corner pizza place is exactly as valuable as one taken from a well-prepared international retailer or what-have-you, and it’s probably significantly less risky for criminals to collect.

How was this report created?

Web security is far more nuanced than just looking for the padlock before typing in your information. That’s a good general rule, but it’s far from the be-all-end-all. Where I work at UpGuard, we’ve built a security scoring mechanism called CSTAR. (I’m not selling anything, it’s free.) We test every website we know about on the internet continuously for a wide variety of factors and security features. Then we grade it and roll it up into a single value from 0 to 950, like a credit score. It’s all based on objective data — these scores are not our opinions. Higher scorers are better configured and probably better prepared to deal with attacks than those with low scores. (Cool fact: There are other companies doing something similar and charging thousands of dollars per site checked. We give it away for free because we like the internet.)

Now, it is true that several of the websites listed in this report have no online ordering features and aren’t much more than a static pizza menu and phone number. For them, web security may not be as directly pressing, but the state of their web server may be indicative of their overall attention to detail as a business. Most of the security features we check cost nothing and are fairly quick to implement, so if a given company’s revenue hinges on their website in any way there’s really not much of an excuse. In short, if your site is bad: c’mon, man.

I used DMOZ to find national, regional and otherwise notable pizza chains and fed their URLs (around 200) into our CSTAR web scanner. DMOZ is an open, user-edited dictionary of websites. It’s also definitely incomplete so if your favorite pizza place isn’t present, just run a CSTAR scan yourself. I’m not your dad.

This is a simple chart showing the general distribution of scores, followed by the big list. As you can see, it’s not too hot. (Unlike pizza! Get it?)

Data (CSTAR Score, Pizza Place, URL)

Additional Information

I am a reporter or a blogger who writes about security and I want to cite the CSTAR score for a company.

Run one-off scans at https://app.upguard.com/webscan or if you need a list of companies’ CSTAR scores, email me.

I own a website and I want to make my security better.

Take a look at the detailed scan results at https://app.upguard.com/webscan and look at test failures, then fix them. Again, I am not your dad.