Retail cybersecurity in an evolving threat landscape

Issue 3 2021 Information Security

As a result of the Covid-19 pandemic, global online retail sales increased in 2020. According to statistics, consumers spent $861,12 billion online with US retailers in 2020, a 44% year-over-year increase from 2019. However, total retail sales only increased by 7%.

What this shows is that while consumers were spending the same amount of money, they were shopping differently. This change in consumer shopping habits parallels the types of security risks impacting digital retail business. With this in mind, retailers must work to understand how the various technological trends that are designed to keep businesses afloat could also impact the cybersecurity posture of their entire industry.

Courtney Radke.

What cyber threat trends should retailers be aware of?

There are several global trends that could lead to challenges for retailers in the coming year. With consumers likely to continue with more digital approaches to shopping, retailers must look at their industry’s place within the larger cybersecurity threat landscape.

Many retailers have adapted their business to support new cloud-based customer experiences. From releasing mobile apps to enhancing online store experiences, digital transformation became a mission-critical strategy. One example is the investment in contactless transaction technologies as a means to prevent the spread of Covid-19.

According to Fortinet’s Retail Security & Covid-19 Industry Survey 2020 Trend Report, 58% of businesses surveyed indicated that they adopted contactless transactions. While contactless transaction technologies have protected physical health, they have also created new cybersecurity hygiene risks. This is underscored by research from the latest FortiGuard Labs Global Threat Landscape Report, which noted the prevalence of IoT-based IPS detections throughout 2020.

Many contactless payment technologies use IoT to process payments faster and reduce consumer friction. But this can often lead to more issues down the line. For example, when customers choose to pay for an item by tapping their smartwatch screens, they add a new, often insecure, technology at the point of sale, opening a new door for potential cyber threats.

Advanced persistent threats (APT) persevere

As retailers continue to adopt cloud strategies, they increase their digital footprint, expanding their attack surface. However, with the increased complexity of the IT stack comes the struggle to achieve secure access. Retail IT teams often manage large networks across geographically distributed branch locations. This complexity, combined with the data they store, transmit and collect, makes retailers attractive targets for cyber criminals.

The retail industry has always been a fertile ground for collecting personal data. Cardholder data, in particular, provides a rich set of information such as cardholder name, primary account number and CVV. Malicious actors use stolen credentials to gain access to these systems and networks, disguise themselves as authorised users and harvest data.

In the second half of 2020, malicious actors persevered, increasing their APT activity. Also noted in the latest FortiGuard Labs Global Threat Landscape Report is that APT groups sought to gather personal information in bulk. One example of this is the MUMMY SPIDER group, which distributed a new version of their malware through email in the hopes of stealing account credentials and moving laterally across local networks.

An evolving threat landscape

As retailers respond to this new digitally transformed business model, they need to lay the groundwork early on to prevent cyberattacks that can negatively impact reputation and revenue. This defence strategy should involve the following elements.

Begin with a secure SD-WAN. Retailers must mature cloud security more rapidly in an increasingly complex IT stack that includes internal and external-facing applications. Software-defined wide-area network (SD-WAN) solutions can help provide additional flexibility and allow for more rapid architecture changes to support business requirements, but they often complicate (or lack) integrated security.

The challenge this creates is that retailers are either forced to add additional complexity via security bolt-ons and overlays or move forward with multi-cloud connectivity without security. Integrating security into the SD-WAN solution is the key to allow retailers to gain the performance benefits and cost-savings of SD-WAN without sacrificing security.

With Secure SD-WAN on their side, retailers can ensure that security is built into the fabric of their networks. Likewise, as traditional routers no longer provide the necessary visibility into business applications within these complex cloud infrastructures, Secure SD-WAN also solves the issue of network sprawl by prioritising business-critical traffic using high-performance traffic shaping and management profiles.

As retailers add more cloud-based applications, both for their employees and their customers, they need the enhanced network connectivity that SD-WAN provides with built-in security features to deter malicious actors.

Embrace Zero Trust Access: Adopting a Zero Trust Access (ZTA) approach is oftentimes seen as too challenging to implement and is therefore overlooked by businesses looking for ways to bolster their security effectiveness. The Catch-22: it is one of the most critical components to enabling proper cybersecurity controls within the retail space.

ZTA’s fundamental ‘trust no one’ mantra can sound like something from a spy movie. In reality, this approach focuses on controlling user and device identity and access. For retailers, taking a Zero Trust approach includes managing security issues arising from IoT devices.

A retailer-focused ZTA strategy may include implementing micro-segmentation to prevent risks associated with contactless payments and IoT. While the Payment Card Industry Data Security Standard (PCI DSS) requires retailers to segment networks that manage cardholder data, micro-segmentation can enhance security controls and create a more robust security posture that goes beyond PCI DSS compliance.

Retailers should also consider creating zones specifically designed for contactless payment technologies that allow purchase via IoT devices. By segregating the purchases made through these devices, retailers limit malicious actor movement within their networks, mitigating the risks associated with insecure wearables and other IoT devices.

Enforce strong authentication requirements: Preventing credential theft requires securing the ‘human element’. As retailers expand their customer-facing web and mobile application offerings, they need to protect themselves by first protecting their customers.

At a minimum, any web application should be configured with a minimum password length of eight characters, with at least one uppercase letter, one number and one special character. Additionally, retailers should look to require multi-factor authentication and rate-limiting on account login and creation attempts wherever possible and appropriate based on business appetite, to maximise security. Implementation of geography-based filtering is also another function that should be evaluated to track and protect against malicious attempts to access web applications.

Evolving retailer cybersecurity at the speed of business

Retailers are evolving their business models at the speed of the cloud and need their cybersecurity programmes to be equally agile. With more consumers becoming accustomed to online shopping and new digital experiences, many may never shop the same way again. To protect brand reputation and these new revenue streams, retailers must secure their digital transformation strategies from the beginning, rather than considering them to be an afterthought.

Similarly, retailers must adopt new security practices and the technologies that enable them. For every new security measure organisations put into place, cyber criminals are already looking for new ways to exploit it to gain access to sensitive systems, networks and applications. This means that retailers need dynamic and adaptive security solutions to protect their environments from attacks that continue to grow in prevalence and sophistication. Whether from an e-commerce or point-of-sale perspective, the retail industry collects, transmits, processes and stores more digital customer data than ever before. To ensure consistent and secure customer experiences, retailers must take an holistic approach to digital transformation by seeking out technology and platforms that build security into the fabric of connectivity.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

New ransomware using BitLocker to encrypt data
Technews Publishing Information Security Residential Estate (Industry)
Kaspersky has identified ransomware attacks using Microsoft’s BitLocker to attempt encryption of corporate files. It can detect specific Windows versions and enable BitLocker according to those versions.

Create order from chaos
Information Security
The task of managing and interpreting vast amounts of data is akin to finding a needle in a haystack. Cyberthreats are growing in complexity and frequency, demanding sophisticated solutions that not only detect, but also prevent, malicious activities effectively.

Trend Micro launches first security solutions for consumer AI PCs
Information Security News & Events
Trend Micro unveiled its first consumer security solutions tailored to safeguard against emerging threats in the era of AI PCs. Trend will bring these advanced capabilities to consumers in late 2024.

Kaspersky finds 24 vulnerabilities in biometric access systems
Technews Publishing Information Security
Customers urged to update firmware. Kaspersky has identified numerous flaws in the hybrid biometric terminal produced by international manufacturer ZKTeco, allowing a nefarious actor to bypass the verification process and gain unauthorised access.

Responsible AI boosts software security
Information Security
While the prevalence of high-severity security flaws in applications has dropped slightly in recent years, the risks posed by software vulnerabilities remain high, and remediating these vulnerabilities could hinder new application development.

AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.