……. Technical Director and Security Strategist, Tenable
It is inevitable that where there is money to be made cybercriminals will be lurking ready to capitalise on events. And the holiday season is the perfect hunting ground. Retailers will have spent many months preparing and hoping for a surge in both face-to-face and online spending, enticing consumers with Black Friday and other festive promotions. While shelves and stock rooms may be full to bursting, it’s imperative that the technology required to complete these transactions is also in top form – and that means being secure.
Shopping habits have migrated with many retailers now having to manage both physical and online stores. This opens retailers to new avenues of risk. Online retail has become a favourite target among cybercriminals and is one of the most attacked sectors. According to the National Cyber Security Centre, victims of online shopping fraud in England and Wales lost an average of £775 each during the last festive period.
With 44% of consumers expected to shop exclusively online this festive season, the retail industry needs to be especially cautious of data and organisational breaches. Having access to customer databases means criminals can send phishing emails pretending to be a legitimate business and ask for personal details or include malware that can cause disorder on a customer’s PC.
Ransomware is another significant attack retailers face more often during busy times like Black Friday and the lead up to Christmas. Attackers can cause operations to stop until businesses pay ransoms, threatening an enormous loss of revenue and a drop in customer confidence. According to a 2021 technology report by Beazley, only 32% of retail leaders feel very prepared to manage cyber risk in the UK.
Such attacks can cause serious damage to a company’s reputation, sales and, in the case of public companies, market valuation. They can even lead to lawsuits or sanctions for compliance violations. That’s in addition to the substantial cost of responding to a breach, finding and removing the malware and restoring files, which in the event of a successful ransomware attack or data breach can easily run into millions.
Nor are bricks and mortar retail outlets immune to cyber threats. Point-of-sale systems, in-store mobile devices and the general rise of e-commerce CRM platforms connected to cash registers, loyalty cards and other in-store promotions all present opportunities for cybercriminals.
How retailers can strengthen their cybersecurity measures
At this time of year, the focus for many IT teams is on uptime, performance and availability to optimise retail transactions. However, security teams should direct their energy into designing a risk-based approach to the safety of their company. This involves recognising what systems and assets the business needs to continue to function and ensuring they are continuously patched, monitored and reviewed so that they remain healthy and any potential problem or weakness that could be exploited by an attacker is quickly identified and fixed.
Furthermore, to make sure cybercriminals are not hiding within an organisation’s infrastructure, retailers should conduct a thorough assessment of their back-end systems to identify vulnerable platforms that could be a target for attackers seeking to steal consumer data. Once they have discovered any vulnerabilities or misconfigurations, retailers should work to resolve these issues quickly. Those that fail to take precautionary measures could be putting themselves at risk.
At times of peak activity, retailers will typically enter a ‘freeze’ period when systems are left as they are so as not to cause any periods of inaccessibility for customers. During this time, it’s imperative to have a continuous monitoring posture, looking for signs of abnormal behaviour or suspicious activity. Security teams should remain on standby, ready to take immediate action should a critical vulnerability or attack be identified.
A commonly ignored weakness are e-commerce platforms. Given that retailers have a customer-centric focus, these are generally designed to be user-friendly, and this can cause companies to skip important security measures. For example, two-factor authentication, an effective security mechanism, is underutilised as it can be perceived as a source of friction between the platform and the consumer. In fact, as shoppers become more security-conscious, the addition of security measures, rather than causing friction, could be seen as reassuring and evidence of a brand’s commitment to its customers.
A final recommendation, often underestimated, is to keep an eye on news reports and threat activity, particularly those affecting the competition. If cyber-criminals are targeting another retailer, it’s almost guaranteed that you will be on their radar.
During this vital retailing period, patching systems and using strong authentication can significantly reduce the risk of a cyber-attack. In addition, increased visibility into the network will allow retailers to prioritise threats, reduce cyber risks and ensure they’re able to thrive during the festive season, whilst at the same time keeping customers safe and happy.