With retailers being the ideal targets, attackers are finding new ways to breach their online security. Here, security specialist Thales identifies the key target areas and offers some top tips on how retailers can protect themselves from cybersecurity threats.
The way in which we conduct retail transactions is constantly changing. Retail organisations have long been targeted by cyber criminals, attracted to the industry because of its size, large quantities of online and point-of-sale (POS) credit card transactions, as well as millions of POS and IoT devices at remote locations, which can be easy targets due to unpatched vulnerabilities and configuration errors.
Retailers began the century as the prime targets for cyber attackers looking for credit card data. But negative blowback from major breaches in the 2000s, fines imposed by regulators and strict cybersecurity mandates, such as PCI-DSS, helped retailers to dramatically improve cybersecurity and slow down the wave of attacks.
The 2022 Thales Data Threat Report: Retail Edition*, finds that 45% of retail respondents said the volume, severity and/or scope of cyberattacks had increased in the previous 12 months.
Today, unfortunately, retailers are again coming back into the spotlight. Attackers are no longer focusing solely on credit data but target rich amounts of sensitive personal data on retailers’ systems or introduce ransomware for a quick payout that doesn’t even require data exfiltration.
Alarming cybersecurity breach statistics
One of the most alarming findings includes the fact that 33% of retailers have experienced a breach in the previous 12 months. But that is not all: only 48% of retailers have a formal ransomware plan, while 27% indicated a willingness to pay the ransom.
Complexity is another problem. Sixty eight per cent of retail respondents identified their Infrastructure-as-a-Service (IaaS) environments as multi-cloud, and the same percentage (68%) said they have over 25 Software-as-a-Service (SaaS) applications in use, leading to potential issues with the complexities of securing multiple cloud environments.
A visible consequence is that 59% of retailers reported having five or more key management solutions, leading to increased vulnerabilities and cybersecurity challenges.
Treat your cyber threats like your physical ones
Retailers are ideal cyber targets due to their size, highly distributed infrastructures, and large quantities of online and in-store credit card transactions.
The industry is also heavily dependent on high-value, constantly available systems, making them attractive marks for ransomware during the many different retail peaks, when any disruption of their systems can cost millions of dollars per hour.
Despite the above findings, retailers are pretty serious about the security of their businesses. For example, 29% of retailers reported that they have adopted and are actively embracing formal zero-trust strategies, just like any other industry.
In addition, another 53% are either planning or considering the adoption of a zero-trust approach to securing on-premise, cloud, and remote access management.
5 top cybersecurity tips for retailers
So what can retailers do to ensure their cybersecurity practices are robust and resilient enough? The following are some basic tips to ensure retail cyber safety:
1. Assess risk: Retailers should educate themselves on the whereabouts of their data and classify it by risk level to ensure sensitive data is sufficiently protected and encrypted.
2. Automate data security governance: The modern complex Hybrid IT infrastructure requires organisations to enforce granular security policies across multiple systems – and automation is essential to be able to scale protection and meet compliance requirements.
3. Follow Zero Trust principles: Employ ‘least privilege’ access across the highly distributed, high-value data and assets, both on- and off-premise. By following the principle of ‘Never Trust, Always Verify’, employees can only access data they’re authorised to, while verifying their identity to do so.
4. Implement MFA: Add an extra layer of security, such as two-factor or multiple-factor authentication, to ensure only the intended individual can access the network.
5. Roll out cybersecurity training: Human error remains the weakest security link across businesses. Create and maintain a cybersecurity awareness training program for all employees so they can competently and confidently navigate risks.
To find out more, and to learn how Thales can help to improve security for your retail organisation, read the full 2022 Thales Data Threat Report Retail Edition.
For more information, download our eBook here.
*The 2022 Thales Data Threat Report Retail Edition summarises the most important findings gathered from a survey of leaders and practitioners within retail organisations in 17 countries, including grocers, restaurants and foodservice establishments, as well as ‘classic’ retailers.
