As a result of the Covid-19 pandemic, global online retail sales increased in 2020.
By Courtney Radke, chief information security officer: national retail at Fortinet
According to statistics, consumers spent $861,12-billion online with US retailers in 2020, a 44% year-over-year increase from 2019. However, total retail sales only increased by 7%. What this shows is that while consumers were spending the same amount of money, they were shopping differently.
This change in consumer shopping habits parallels the types of security risks impacting digital retail business. With this in mind, retailers must work to understand how the various technological trends that are designed to keep businesses afloat could also impact the cybersecurity posture of their entire industry.
What cyber threat trends should retailers be aware of?
There are several global trends that could lead to challenges for retailers in the coming year. With consumers likely to continue on with more digital approaches to shopping, retailers must look at their industry’s place within the larger cybersecurity threat landscape.
Digitally transformed customer experiences with Internet of Things (IoT) devices
Many retailers have adapted their business to support new cloud-based customer experiences. From releasing mobile apps to enhancing online store experiences, digital transformation became a mission-critical strategy. One example is the investment in contactless transaction technologies as a means to prevent the spread of Covid-19.
According to Fortinet’s “Retail Security & Covid-19 Industry Survey 2020 Trend Report,” 58% of businesses surveyed indicated that they adopted contactless transactions. While contactless transaction technologies have protected physical health, they have also created new cybersecurity hygiene risks. This is underscored by research from the latest FortiGuard Labs Global Threat Landscape Report, which noted the prevalence of IoT-based IPS detections throughout 2020.
Many contactless payment technologies use IoT to process payments faster and reduce consumer friction. But this can often lead to more issues down the line. For example, when customers choose to pay for an item by tapping their smartwatch screens, they add a new, often insecure, technology at the point of sale, opening a new door for potential cyber threats.
Advanced persistent threats (APT) persevere
As retailers continue to adopt cloud strategies, they increase their digital footprint, expanding their attack surface. However, with the increased complexity of the IT stack comes the struggle to achieve secure access. Retail IT teams often manage large networks across geographically distributed branch locations. This complexity, combined with the data they store, transmit, and collect, makes retailers attractive targets for cyber criminals.
The retail industry has always been a fertile ground for collecting personal data. Cardholder data, in particular, provides a rich set of information such as cardholder name, primary account number, and CVV. Malicious actors use stolen credentials to gain access to these systems and networks, disguise themselves as authorised users, and harvest data. In the second half of 2020, malicious actors persevered, increasing their APT activity.
Also noted in the latest FortiGuard Labs Global Threat Landscape Report is that APT groups sought to gather personal information in bulk. One example of this is the MUMMY SPIDER group, which distributed a new version of their malware through email in the hopes of stealing account credentials and moving laterally across local networks.
Cybersecurity strategies for retailers in an evolving threat landscape
As retailers respond to this new digitally-transformed business model, they need to lay the groundwork early on to prevent cyberattacks that can negatively impact reputation and revenue. This defense strategy should involve the following elements.
As retailers respond to this new digitally-transformed business model, they need to lay the groundwork early on to prevent cyberattacks that can negatively impact reputation and revenue. This defense strategy should involve the following elements.
Begin with a secure SD-WAN
Retailers must mature cloud security more rapidly in an increasingly complex IT stack that includes internal and external-facing applications. Software-defined wide-area network (SD-WAN) solutions can help provide additional flexibility and allow for more rapid architecture changes to support business requirements, but they often complicate (or lack) integrated security.
The challenge this creates is that retailers are either forced to add additional complexity via security bolt-ons and overlays or move forward with multi-cloud connectivity without security. Integrating security into the SD-WAN solution is the key to allow retailers to gain the performance benefits and cost-savings of SD-WAN without sacrificing security.
With Secure SD-WAN on their side, retailers can ensure that security is built into the fabric of their networks. Likewise, as traditional routers no longer provide the necessary visibility into business applications within these complex cloud infrastructures, Secure SD-WAN also solves the issue of network sprawl by prioritising business-critical traffic using high-performance traffic shaping and management profiles.
As retailers add more cloud-based applications, both for their employees and their customers, they need the enhanced network connectivity that SD-WAN provides with built-in security features to deter malicious actors.
Embrace Zero Trust access
Adopting a Zero Trust Access (ZTA) approach is oftentimes seen as too challenging to implement and is therefore overlooked by businesses looking for ways to bolster their security effectiveness. The catch 22: it is one of the most critical components to enabling proper cybersecurity controls within the retail space.
ZTA’s fundamental “trust no one” mantra can sound like something from a spy movie. In reality, this approach focuses on controlling user and device identity and access. For retailers, taking a Zero Trust approach includes managing security issues arising from IoT devices.
A retailer-focused ZTA strategy may include implementing micro-segmentation to prevent risks associated with contactless payments and IoT. While the Payment Card Industry Data Security Standard (PCI DSS) requires retailers to segment networks that manage cardholder data, micro-segmentation can enhance security controls and create a more robust security posture that goes beyond PCI DSS compliance.
Retailers should also consider creating zones specifically designed for contactless payment technologies that allow purchase via IoT devices. By segregating the purchases made through these devices, retailers limit malicious actor movement within their networks, mitigating the risks associated with insecure wearables and other IoT devices.
Enforce strong authentication requirements
Preventing credential theft requires securing the “human element.” As retailers expand their customer-facing web and mobile application offerings, they need to protect themselves by first protecting their customers.
At a minimum, any web application should be configured with a minimum password length of 8 characters, with at least one uppercase letter, one number, and one special character.
Additionally, retailers should look to require multi-factor authentication and rate-limiting on account login and creation attempts wherever possible, and appropriate based on business appetite, to maximize security. Implementation of geography-based filtering is also another function that should be evaluated to track and protect against malicious attempts to access web applications.
Evolving retailer cybersecurity at the speed of business
Retailers are evolving their business models at the speed of the cloud and need their cybersecurity programs to be equally agile. With more consumers becoming accustomed to online shopping and new digital experiences, many may never shop the same way again. To protect brand reputation and these new revenue streams, retailers must secure their digital transformation strategies from the beginning, rather than considering them to be an afterthought.
Similarly, retailers must adopt new security practices and the technologies that enable them. For every new security measure organisations put into place, cyber criminals are already looking for new ways to exploit them to gain access to sensitive systems, networks, and applications.
This means that retailers need dynamic and adaptive security solutions to protect their environments from attacks that continue to grow in prevalence and sophistication. Whether from an e-commerce or point-of-sale perspective, the retail industry collects, transmits, processes, and stores more digital customer data than ever before. To ensure consistent and secure customer experiences, retailers must take a holistic approach to digital transformation by seeking out technology and platforms that build security into the fabric of connectivity.