Retail companies face a landscape filled with growing and increasingly complex threats. And the financial impact of these breaches is soaring.
There are obvious financial incentives for attacking retailers because they typically don’t spend as much on security as financial institutions or government organizations, so they’ve become easy targets in recent years. According to Gartner, retailers spend about four percent of their IT budgets on cybersecurity, while financial services and health organizations spend 5.5% and 5.6% respectively. This is critical as the number of shoppers on Black Friday and throughout the holiday season continues to grow through different omnichannel opportunities. We have to be concerned and diligent because:
- Financial organizations spent as much as $2,500 per employee on cybersecurity in 2014, while retailers only spent about $400 per employee.
- AppRiver Global Security Report shows that 10 of the top 20 data breaches in 2015 were retailers.
- According to research conducted by the Ponemon Institute in partnership with IBM, the average cost for each lost or stolen record has also increased. According to the study, the cost per record increased by more than 9%, from $136 per record in 2013, to $145 per record in 2014; and those numbers are still higher in the U.S., where the average cost for each lost or stolen record is $201.
In today’s era of cyber threats and data attacks, it is more important than ever for retailers to focus on a proven security architecture. It is not enough to be compliant and look at firewalls and IPS. Retailers must look at a security threat continuum that looks at before, during, and after the attack.
Here are some of the reasons retailers need to focus on a comprehensive security architecture:
- Maintain Compliance (PCI, HIPPA, etc….), but remember compliance standards are the minimum bar. You have to do more.
- Customer Information Protection – Being a good steward of customer data.
- Brand and Reputation Protection
- Protection of Financial Data and Corporate Assets
- The cost of a breach cleanup can far out way the cost of addressing security on the front end.
- The level of intelligence and the volume of threats are rapidly increasing
- There are more “rogue devices” near your network than ever before. Each customer has a device that could possibly be compromised and the retailer must protect itself and its customers from threats.
- Retail will be breached. How quickly you detect, stop, and address is critical.
Seven steps to reduce your cybersecurity attack surface:
- Assume your employees will click on anything. Put in a strong secure email gateway so end users don’t have the opportunity to click email spam. Make sure this email gateway passes on its findings to your security infrastructure.
- Know what your key intellectual property is, where it’s located, and design your security around it through authentication, policies, segmentation, and zoning.
- Use authentication, endpoint, network, and gateway controls that share findings and provide an orchestrated reduction in attack surface.
- Implement a solid supply chain and vendor management system.
- Promote education training awareness that makes your employees smarter.
- Using ACLs, virtualization, or TrustSec reduces the number of locations where PCI data is touched so that the rest of your headquarters, data center, and store infrastructure don’t have to be audited.
- Install a strong web security gateway to stop users from clicking on poison well sites. Again, make sure the gateway passes along it findings to your security infrastructure.
Cisco can help deliver a secure and environment for your customers.
Thanks for the article, Ron. I work as a contact center consultant and I can tell you that, with omnichannel, IT is no longer the only area concerned with security these days. More than ever before, security is a top-of-mind consideration across all business areas. These days, I share most security-related articles, like this one, across a few of my social networks.