Why Is Retail Cyber Security So Weak?

Retailers are particularly vulnerable to cyber hacks that prey on human error. Research by SecurityScorecard found retail is the worst ranked industry when it comes to defending against social engineering attacks, which involve hackers tricking employees into divulging sensitive information through practices such as vishing or phishing.

The very nature of the retail industry makes it a soft target for organised crime gangs.

“The ecosystem for the underworld is working so hard to maintain and prosper from the various mistakes that us humans make,” says Fouad Khalil, head of compliance at SecurityScorecard.

Julian Burnett, VP of global markets at IBM’s distribution sector, says the attack surface of the retail industry is particularly large because of the people-heavy nature of it.

“There are lots of staff interacting with many customers, exchanging lots of money, and using lots of tech to achieve it, which means you have got a heady cocktail of risk,” says Burnett, a former CIO at House of Fraser and CTO at John Lewis and Sainsbury’s.

Social engineering is a particularly common means of attack within retail because there are so many staff that can be targeted, who are often inexperienced or temporary.

IBM’s ethical hacking group X-Force Red has found younger staff are particularly susceptible to inadvertently giving away data that is commercially sensitive.

Social Media Engineering
Sensitive data is left all over social media, says Burnett. “We see a particularly significant proportion of younger people in the workforce being largely ignorant to the risks they are taking because they have grown up feeling much more trusting and safe in digital contexts.”

Burnett says the type of information they can inadvertently share includes pictures with a security badge in view, or laptops openly displaying sensitive information on the screen.

Hackers can also exploit the customer service-led nature of the retail industry to steal information through social engineering.
Florence Mottay, chief information security officer at Dutch food retailer Ahold Delhaize Europe says ‘vishing’ (voice phishing) is one of the most popular tactics employed by social engineers in the retail world.

“In a vishing attack, social engineers call a company impersonating someone else looking for sensitive information on customers, associates, or digital products,” says Mottay. “Since customer service is key within retail, victims of social engineering might unknowingly aid attackers over the phone while they are under the impression that they are just doing their jobs.”

The large physical footprint many retailers have adds an additional layer of vulnerability to their businesses as well.
Burnett says that during his time working at retailers there were instances of fake engineers arriving in shops, who installed devices into vulnerable ports on equipment.

Internal Threats
A further human weakness that can be exploited is the deliberate selling of commercially sensitive information.
Recent research by Deep Secure has found that a surprisingly large number of employees would be willing to sell off their company’s information. Just £1,000 would be enough to tempt 25% of employees to give away company information, according to the research.

The human vulnerabilities of a retailer’s cybersecurity operation are numerous, but this does not mean they are impossible to guard against.

Chris Pritchard, a consultant at cybersecurity firm Pen Test Partners, says it is difficult to train staff to avoid them falling victim to social engineering-based cybersecurity attacks.

“If an attacker is prepared to take the risk and appear in person, physically to attempt to gain access to an office, or factory then, if done properly, that’s hard to prevent,” says Pritchard. “But as most attackers like the [telephone or email based] spray and pray method because it’s the least risky, it’s easier to prevent.”

Staff training and education should be the first line of defence against social engineering attacks.
“From a best practice perspective I would focus on training as number one,” says Khalil. “Bring into the light the different angles the attackers are taking to steal personal information.”

Education
“Awareness and education go an awfully long way to improving any organisation’s stance in the face of cyber-crime,” says Burnett. “It is about behaviours and recognising risk and learning not to inadvertently share sensitive information that could be put alongside other information that can be used to create a persona for those prepared to launch an attack.”

Mottay says Ahold Delhaize puts every staff member, whether at corporate or store level, through different types of security awareness training to educate them about social engineering attacks and how to spot them.

“Through simulated phishing and social engineering exercises, our users get trained in a fun and constructive way,” says Mottay. “Awareness exercises are just like fire drills; we conduct them on a regular basis on every aspect of information security - and social engineering is part of these exercises.”

Burnett advises retailers take care to ensure educational programmes are effective for those who are only working at the company for short time frames such as seasonal workers at Christmas.

This training could include warning younger staff about the potential dangers of posting pictures of them at work on social media websites. 

It is more difficult to stop disgruntled staff from leaking commercially sensitive information, but systems can still be put in place to try and stop such scenarios.

“I would encourage companies to think about monitoring the output of the company on the many channels we use in big business,” says Burnett.

This could include monitoring who is saying what and keeping an eye on what attachments are being shared via email.

“The level of sophistication in monitoring is improving and increasing all the time,” says Burnett. “Applying a level of analytical insight above and beyond monitoring can help you understand the risk profile of an individual and their propensity to act.”

Unfortunately, there is no such thing as an entirely flawless cybersecurity defence. But there are many things that can be done to minimise risk.

The retail industry is such low hanging fruit for organised crime that it is likely cyber-attacks will only rise further and become ever more sophisticated. Retailers would be wise to do all in their power to ensure they cut out the basic human errors that are opening the door to cyber-attacks.

Essemtial Retail:        Image: Nick Youngson

You Might Also Read:

Banks And Retailers Track How You Type, Swipe And Tap:

« Improving Electric Power-Grid Security
Police Forensic Firm Has Paid Ransom »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Spambrella

Spambrella

Spambrella provides email security with real-time threat protection. 100% SaaS (nothing to install)

URS Certification

URS Certification

United Registrar of Systems (URS Certification) is an independent certification body operating in more than 30 countries within the multinational URS Holdings.

S4x Events

S4x Events

S4x are the most advanced and largest ICS cyber security events in the world.

Adzuna

Adzuna

Adzuna is a search engine for job ads used by over 10 million visitors per month that aims to list every job everywhere, including thousands of vacancies in Cybersecurity.

The Cyber AB

The Cyber AB

The Cyber AB is the official accreditation body of the Cybersecurity Maturity Model Certification (CMMC) Ecosystem.

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

CMMC COE is an IT-AAC sponsored public–private partnership that will be the focal point for entities seeking to achieve Cybersecurity Maturity Model Certification.

Opora

Opora

Opora is the leading cybersecurity provider of adversary behavior analytics “ABA” and preemptive security solutions.

Matrium Technologies

Matrium Technologies

Matrium Technologies has been a leading provider of technology solutions since 1991, with a strong industry background in Network Testing, Network Visibility and Security.

Astrill VPN

Astrill VPN

Astrill VPN is a Seychelles based Virtual Private Network(VPN) Company.

Crayon

Crayon

Crayon is a customer-centric innovation and IT services company. We provide guidance on the best solutions for our clients’ business needs and budget with software, cloud, AI and big data.

Acronis

Acronis

At Acronis, we protect the data, applications, systems and productivity of every organization – safeguarding them against cyberattacks, hardware failures, natural disasters and human errors.

Flare Systems

Flare Systems

Flare proactively detects and remediates exposure across the clear & dark web, providing organizations with the equivalent of an automated cyber reconnaissance team.

StrongBox.Academy

StrongBox.Academy

StrongBox.Academy provides cybersecurity training courses that are tailored to the specific needs and challenges of the industry.

Health Sector Cybersecurity Coordination Center (HC3)

Health Sector Cybersecurity Coordination Center (HC3)

HC3 was created by the US Department of Health and Human Services to aid in the protection of vital, controlled, healthcare-related information.

London AI Safety Research (LASR)

London AI Safety Research (LASR)

London AI Safety Research Labs is a technical AI Safety research programme focussed on reducing the risk of loss of control to advanced AI.

Corvid Cyberdefense

Corvid Cyberdefense

Corvid Cyberdefense provides military-grade cybersecurity as a service for growing organizations and municipalities of all sizes.