This article is brought to you by PDI, a NACS Hunter Club and Global Supplier Council member.
With everything else retailers are navigating right now, why should cybersecurity rise to the top of their priority list?
Retailers spend a lot of their time worried about increased market competition—and rightly so. However, few things can impact their business faster or more severely than a cyberattack.
Threat actors recognize that retailers are focused on business operations and are just trying to remain competitive in this challenging economic environment. Cybercriminals are more than willing to take advantage of that distraction to exploit weakened defenses or obvious vulnerabilities.
Most retailers simply don’t have the resources and expertise required to adequately protect their business, but that can leave them exposed as “easy targets.” That’s one of the reasons we’ve seen ransomware threats skyrocket since early 2020.
Another issue for retailers is that some of the attack groups, especially the criminals focusing on the energy sector, are state-sponsored. Attacks within petroleum retail have also escalated over the past few years, and those threats are increasingly sophisticated as the attackers leverage advanced technologies such as machine learning and artificial intelligence to gain points of entry into IT systems.
What are some simple first steps retailers can take to protect themselves?
The entire concept of defending against attacks can feel really complex. That’s why you have to start with getting business leaders to buy into the need for cybersecurity. You need to prioritize resources and budget, and you need a holistic strategy—all of which are table stakes before you even start implementing specific cybersecurity tools and processes.
At a practical level, you need to employ sophisticated defenses such as vulnerability scans to identify what IT systems and devices are vulnerable. One of the best and easiest things you can do is ensure that all your software is up to date in terms of patch management. Using multi-factor authentication (MFA) for email and other logon credentials is a relatively simple step that can have a major impact on cybersecurity.
It’s no longer hyperbole to state that cybersecurity can literally make sure you still have a business to operate.
Ongoing security awareness training for all employees is also important. From a part-time employee clicking on a phishing email or IT staff inadvertently making a software configuration error, approximately 95% of data breaches are the result of human error.
If retailers don’t have the right security expertise or in-house IT staff to deploy these technologies—or they’re just not comfortable taking on the management burden—they can always find a trusted service provider. There are all levels of support and services available, so it’s really a matter of knowing where you have security gaps and working with the right partner to close those gaps.
What’s the benefit of hiring a security service PROVIDER?
It’s no longer hyperbole to state that cybersecurity can literally make sure you still have a business to operate. A ransomware attack can be catastrophic to retail operations, so retailers should view it with the same mindset as they do any other business risk. Yet many retailers are often of the mindset that security tools are expensive and complex, and that they don’t have time to spare from their business operations to implement a cybersecurity program.
In reality, cybersecurity shouldn’t really be any different than how retailers handle all the other aspects of their business. For example, if a retailer needs work to be done on some underground fuel tanks, they rely on experts who understand how to prevent risk in that environment. When protecting their locations from ransomware and other security threats, retailers should do the same. In other words, if you don’t have the skills to fix a problem yourself, go find
a reputable expert to help you.
A trusted partner with expertise within specific retail markets can make tool deployment and monitoring seamless throughout the retail environment. That, in turn, frees up retailers to focus on running their core business.
What factors should go into hiring an outside partner?
Deploying cybersecurity defenses, including 24/7/365 monitoring for suspicious activity, can be both time-consuming and expensive if you’re not careful in how you go about it. When choosing a cybersecurity partner, retailers should validate that the recommended technology meets their needs for true detection and response capabilities with round-the-clock coverage for monitoring.
Attackers prefer to launch ransomware and other malware attacks during off hours, when it’s presumed that they will go unnoticed until it’s too late. Unless you have continuous coverage, it’s more a question of when, not if, your business will get hit. That’s why it’s also important to have a vendor that’s aligned with your business strategy so you can work together to not only prevent threats but detect them and respond to them in real time if necessary. Building that foundational level of trust is critical to stopping any threats well before they can negatively impact your business.