This article was originally published as an Expert Panel in Forbes.
How can procurement help defend against cyberthreats?
If there’s one industry that’s embraced digital transformation, it’s retail. From digital payment systems to individual and marketplace e-commerce sites, technology has helped the retail industry bring more convenience, choice and speed to the consumer buying experience.
However, with this growing use of technology comes increased and enhanced cyberthreats—threats that can strike whether buyers are making their purchases online or in a brick-and-mortar store. Below, 19 members of Forbes Technology Council discuss some of the most common cyberthreats retailers are up against right now and how they can defend against them.
1. POS System Attacks
Point-of-sale system attacks pose a significant threat to retailers, as criminals exploit vulnerabilities to gain unauthorized access and steal customer credit card data. Retailers should implement solid access controls with multifactor authentication, regularly patch their systems, segment their networks, monitor events, encrypt personally identifiable information and provide employee security awareness training. – Giri Chodavarapu, Omnicell
2. Vulnerabilities In Supplier Systems
When retailers connect their systems to those of their direct suppliers, they need to have visibility into the entire network of vendors and subcontractors that their suppliers work with. Organizations must address potential open-source security issues coming from fourth- or fifth-line vendors by implementing robust vendor management practices, including due diligence and security assessments. – Anders Lillevik, Focal Point
3. In-Store And Corporate Threats
Retailers face threats both in their store environments, via the installation of card-skimming devices on POS terminals, and against their corporate environment via phishing attacks. In the store environment, regular teller training on suspicious activity, physical lockdown of terminals and periodic physical audits are a necessity. On the backend, a robust information security program is required. – Michael Lines, Open Technology Solutions
4. Widespread Reliance On Open-Source Software
The most pervasive cyberthreat facing retailers is the widespread reliance on open-source software in warehouse management and POS and customer relationship management systems. This exposes retailers to quality issues, cyber vulnerabilities and even cybercriminals. To safeguard their businesses, reputation and customer data, retailers must require vendors to produce software bills of materials to gain insight into their software supply chains. – Brandon Daniels, Exiger
5. Insider Credit Card Theft
The No. 1 threat to retailers is credit card theft by inside employees who have been socially engineered to skim card numbers or provide hackers with the access to do so—both in the store and online. Cultivating a trusted workforce through education and enablement is critical in stopping insiders from being lured into credit card theft. Proactive monitoring for suspicious webpage and file activity also supports insider risk mitigation. – Mohan Koo, DTEX Systems
6. Supply Chain Sabotage
Cyber compromise of the supply chain caused by geopolitical tensions is the biggest cyberthreat facing retailers. Supply chains are now completely digitized, which provides a determined adversary with more opportunity for sabotage. Commerce as we know it will come to a grinding halt if an adversarial nation-state decides to attack any of the layers of software used to move goods from point A to point B. – Gentry Lane, ANOVA Intelligence
7. Data Breaches And Leaks
To improve the user experience for returning customers, many online retailers save clients’ credit card data. But this comes with high risk. I suggest making sure all data is encrypted or considering third-party providers for payments or POS management. Also, regularly assess security rather than doing security testing once, and limit employee access to data—a significant percentage of data leaks are supported by insiders. – Nadya Knysh, a1qa
8. The Variety Of Connected Assets
Retailers are using a variety of connected assets, including smart displays and sensors that track customer paths, to improve customer service and optimize inventory management. These same assets can expose an increasingly expanding attack surface. To stay secure, retailers need to know what assets are on the network and proactively assess the risk introduced by each device to ensure their network is secure. – Yevgeny Dibrov, Armis Security
9. Third-Party Access To Systems
Retailers need to give third-party contractors and partners access to systems for projects and ongoing work. These unmanaged machines represent elevated risk, since retailers don’t have the same level of control over them as they do their own corporate devices. To protect against unmanaged device risk, retailers should control their access with a clientless zero-trust network access solution using isolation technology. – David Canellos, Cradlepoint
10. Ransomware
Retail businesses, which manage millions of customer records with personal and payment information, are a lucrative target for malware and ransomware attacks. The first shield against cyberthreats is strong external defense systems, including firewalls and comprehensive network security. If hackers do get through, access to customer data should be blocked by further security governance, including user authentication and authorization. – Adrian Carr, Stibo Systems
11. Insecure Web Apps And APIs
To safeguard customer data from cybercriminals, retailers must enhance application security for Web apps and the APIs that power them. They need to employ multiple AppSec testing methods, scan regularly and automate flaw detection and resolution to eliminate vulnerabilities in the software development process before criminals can attack. This minimizes breaches and strengthens customer trust. – Chris Wysopal, Veracode
12. Lack Of Employee Cybersecurity Awareness
Education and training on cyberthreats is a must. Retailers should conduct regular cybersecurity awareness training for their employees. This includes teaching them to identify and report suspicious activities, such as phishing attempts or physical tampering with POS terminals. Vigilance and a security-conscious workforce are vital defenses. – Meiran Galis, Scytale
13. E-Commerce Fraud
The hottest retail cyberthreat is e-commerce fraud. With the growth of online shopping, cybercriminals target retailers to exploit vulnerabilities in payment systems, steal customer data and commit fraudulent transactions. To defend against this, retailers can implement several measures, including using multifactor authentication, encrypting sensitive data, monitoring for suspicious activity and educating employees and customers. – Rudy Shoushany, DxTalks
14. E-Skimming
Attackers compromise e-commerce websites to steal customers’ payment card information, a practice known as “e-skimming.” To defend against e-skimming, implement Web application firewalls, conduct regular code audits, adhere to PCI DSS standards, use secure e-commerce platforms, deploy robust endpoint protection and educate customers on safe online practices. – Avani Desai, Schellman
15. Advanced Persistent Threats
Retailers face significant risk from advanced persistent threats in 2023, amplified by e-commerce growth and data-rich operations. Defense strategies should include a cybersecurity culture, zero-trust architecture, proactive threat hunting, AI utilization and stringent third-party risk management. Complacency is not an option; constant vigilance and readiness are crucial. – Yonesy Nunez, Jack Henry
16. Credential Stuffing
In credential stuffing attacks, cybercriminals use previously breached login information to gain unauthorized access to accounts. Retailers can defend against this by enforcing strong password policies, requiring users to utilize unique passwords and implementing additional layers of authentication, such as two-factor authentication, biometric verification or security questions. – Margarita Simonova, ILoveMyQA
17. Formjacking
One of the most common cyberthreats facing retailers is formjacking, a stealthy attack in which hackers implant malicious code into payment forms to steal customers’ sensitive data. To defend against it, retailers must prioritize robust website security, conduct regular code audits, implement strong encryption, continuously monitor suspicious activities and foster a security-centric culture. – Stephen O’Doherty, Gibraltar Solutions
18. Website Cloning
Website cloning is an often-neglected threat, but it’s happening. Bad actors may purchase a similar domain and mirror your site through crawling and dynamic updates, stealing your traffic or the credit card details of inattentive consumers. To detect this, monitor your traffic regularly and check to see if your content and visuals are being used elsewhere. Luckily, some tools can automate this. – Konstantin Klyagin, Redwerk
19. Denial Of Service
One common cyberthreat is denial of service—a retailer website’s becoming unavailable, whether for buying a product or paying for it. Retailers can implement content delivery networks, which distribute website content across multiple locations. This way, content is not solely accessible from a single location, and if one location breaks down after an attack, the entire business does not crash. – AJ Abdallat, Beyond Limits
Check out my website.
