I wanted to explore the challenges retailers face with their data security, so I turned to expert David Share. David is Director and co-owner of Amazing Support. David agreed to explore the challenges in an article for this blog; his bio is below. Thanks David!
The idea of targeting and scamming retailers is nothing new. Store owners have had to deal with these criminals since the days when they could just reach over the counter and into their cash machines. But with the advancement of technology comes an advancement in crime. More frequently criminals are being less physical in their acts, preferring to do the deed from as far away as possible. Cheque fraud, intercepting bank transfers and email fraud were and are the result of the evolution of this sort of crime. But in 2014, things were taken to a whole new level.
Target, a traditional and popular big box store and eBay, arguably the first and largest online auction site on the planet, both reported massive database breaches in 2014. This changed the mainstream opinion on database security. Sure, people knew someone or a small business that was hacked and had a bit of money pilfered from them, but never had the public seen a hack of this magnitude. To make matters worse it happened to two very large and very public retailers.
Of the two, eBay came away far better from the attack. Unlike Target, eBay had the foresight to store their customer’s financial data on a separate database, so when the hackers managed to get in they were only able to take customer login passwords and personal data. Make no mistake, this was still bad, but compared to Target’s customers who had their credit card and financial information stolen along with their personal information, it wasn’t as bad. The fallout of this event set ablaze the very fabric of trust and security, binding customer and retailer.
At the time, it was difficult for many retailers to comprehend this type of attack. They knew or had heard of something called a DDoS (distributed denial of service), which essentially shuts down operations. But the truth is that only 5% of online attacks are registered as DDoS attacks. That is because the types of criminals behind the Target and eBay like breaches are not interested in stopping the flow of money, they actually want it to keep going and then silently remove money or information when they deem necessary.
So then how exactly did the Target and eBay jobs go down? The answer, malicious code and sustained probing. This was particularly true in the case of retail giant Target where hackers used these strategies to steal the data and financial information of over 40 million customers, marking it as one of the largest breaches in commerce history. In fact, over 50% of all threats to retailers use a combination of these two tactics. The malicious code is first spread over the internet and is then mistakenly downloaded by an employee in an email, as part of a music file or random pop-up. The code then launches a probe whose mission is to lurk in the recesses of company’s system watching and collecting data. Then, when it hits a designated number of files, or reaches a system with the highest privileges, it triggers a massive data dump and the true insidious nature of the program is executed. And just like that, a retailer’s customer, key business information and intellectual property is taken from them, to no doubt be sold on the black market.
The best thing retailers can do is to get ahead of the situation. Think of the worst case scenario and create strategies to prevent the breach and loss of data. Or, better yet, create what is known as a “Red Team”, which is a team of employed hackers that will continuously test and report on the vulnerabilities of a company’s system. The stark reality is that these types of threats are not going away any time soon. Throughout 2015 fast-food chain Wendy’s registered several breaches incurred by malware as an example. However, by implementing sound cybersecurity practices, investing in the right security solutions and IT professionals to implement them, security threats can become manageable and the risks associated with them can be reduced with an increased certainty of recovery.
This article is written by guest author David Share. David has held positions as Operations Director and Head of IT in legal and professional firms for more than 10 years. He is a Director and co-owner of
Amazing Support, a Microsoft Silver accredited and specialist Managed IT Support and IT Services company. David sits on the UK Council for Child Internet Safety (UKCCIS) and is also a professional member of The Chartered Institute for IT (BCS). He actively helps SME businesses receive better Managed IT Support in the London and Hertfordshire areas. David is married with a son and you will often see him riding his bicycle in and around the Hertfordshire towns! He regularly participates in charity bike rides for the British Heart Foundation.