Retail

The retail industry is ripe for cyber attacks ranging from low-hanging phishing scams to sophisticated campaigns. Whether a retailer is brick-and-mortar or online-only, malicious actors are finding new and dangerous ways to swipe sensitive data from businesses each day.

Compliance

One of the most common challenges retailers face is PCI-DSS compliance. Retailers face a growing number of payment processors, payment methods, cloud-based solutions and security vulnerabilities.

Lumifi has helped our retail clients take their compliance to the next level with industry-leading solutions and automated reports.

Common Threats

The retail industry faces attacks to its key business operations including Point-of-Sale (POS) systems, Distributed Denial of Service (DDoS) attacks to websites, and Ransomware.

POS systems are just as vulnerable as other endpoints in an organization, even more so when they are within reach of the public and vendors. While traditional anti-virus software provides an initial layer of protection, retailers must take a multi-layered approach to security.

In the case of the Target breach, a vendor’s legitimate credentials were used to exploit their system. Implementing User and Entity Behavioral Analytics (UEBA) software can monitor authorized credentialed activity, using machine learning to detect abnormal behavior like installation and admin privilege abuse.

DDoS attacks are also a major concern for the retail industry. As more retailers expand their e-commerce operations or go completely online, they face real threats to their business operations and bottom line. According to a 2018 report from International Data Group (IDG), the median downtime caused by a DDoS attack is 7 to 12 hours. Using an estimate from Gartner of $5,600 per minute of downtime, that means the average cost of a DDoS attack is in the $2.3 million to $4 million range.

Unprepared retailers can face millions of dollars of losses if they fail to implement a resilient cybersecurity strategy to not only prevent attacks but actively manage vulnerabilities.

Lastly, the retail industry faces ransomware. This insidious attack can halt business operations indefinitely. Without proper Remote Desktop Protocol (RDP) permissions, network segmenting via VLAN, and reliable backups, retailers face huge losses to their revenue and public image.

Lumifi understands each one of these risks to your industry and has the knowledge and skill to protect your business.

Emerging Threats

As the retail industry continues to evolve, so does the threat landscape. Here are just a few of the emerging threats Lumifi has observed in the industry:

• Dark Web: The Dark Web has become a marketplace for stolen credit card numbers, among other sensitive financial data. Security teams must monitor the dark web for leaked data, including consumer information or organization credentials.
• IoT: As Internet of Things (IoT) devices gain popularity in physical locations such as beacons, retailers are using them to enhance the consumer experience. Protecting these devices and monitoring their activity is essential to thwart sophisticated attacks aimed at IoT devices.
• Gift Cards: Companies looking to cash in on the gift card craze must be aware of gift card hacking, where attackers can use legitimate cards and spend consumers’ money. This scheme has been known for years but continues to prove vulnerable for a number of retailers without security measures in place.
• Refund Fraud: Just like the old days of returning items in the physical store that were stolen, the digital version of this threat can be even more damaging to a retailer. The dark web has provided a market for purchasing fake receipts for companies, allowing scammers to call refund lines and request a refund to an account or card different than the fake receipt. Retailers should be aware and implement security training to combat this growing threat.

Lumifi’s analysts and threat hunters not only look for existing threats, but actively hunt for unknown exploits and notify our clients of vulnerabilities.

Hire the best

Lumifi’s team includes L1-L3 analysts and engineers that range in skill and specialty. From detection to remediation, our team is on-site 24/7/365 to protect your organization.