Security Wise: Cyber-Security: Be prepared for the 2022 Holiday Shopping Season

21 Nov 2022

Jewellery retailers have had little choice but to accept digital transformation, especially through the Covid-19 pandemic. As consumers expect greater convenience when browsing for precious items and buying online, interactions between retailers and their customers have had to change.

Transformation is exciting and big data, robotics and AI all have a role to play in modern retailing, but it also brings risks around data security. The more consumer data that is stored because of our increasingly connected ways of selling, the more appealing the prospect of hacking to cyber criminals, and the more avenues they have to explore.

Every year, sources report the next holiday shopping season will be the most challenging for retailers, yet every year, most retailers end up having better-than-expected sales. Will this year be any different? The annual arrival of the holiday shopping season, including peaks such as Black Friday and Cyber Monday also bring an increase in retail-focused cyberattacks.

Retailers should be prepared

Cyber-criminals love the holidays. People are distracted, businesses of all sizes are beyond hyper-focused on sales, and cyber-security teams can be over-extended or fatigued. There really is no better time for threat actors to launch an attack.

We regularly cover many areas of cyber-security on the SecurityWise articles, as with frequent cyber-attacks affecting multiple organisations, it’s clear no one is immune from the risks of cyber-crime. It’s vital that organisations have cyberattack response plans in place to ensure quick recovery from potential breaches. Additionally, employers should review their IT systems to ensure adequate security precautions are in place.

Recent Notable Cyber-attacks

On 6th September, Intercontinental Hotels Group (IHG)—the owner of Holiday Inn—confirmed it had fallen victim to a cyber-attack. In a statement, IHG said it was investigating “unauthorised access” to several technology systems after the UK-based company’s booking channels were disrupted, preventing many customers from booking accommodation online.

Transport company Go-Ahead—which runs almost a quarter of London’s buses, confirmed a cyber-breach had affected software that schedules bus drivers and services. The NHS experienced a major outage following a cyber-attack in August on a third-party vendor. With software offline, doctors had to resort to recording medical notes on pen and paper. It may take several months for the NHS to recover from this attack.

Do you know where to start?

• Security awareness training – Educating workers to spot the tell-tale signs of cybercriminals trying to steal their credentials.
• Automated email security solutions – Deploying technology that automatically scans email content to identify and block malicious threats to worker inboxes.
• Email incident response plans – Implementing plans that rely on AI-powered automation tools to analyse, triage, and prioritize potential threats when an email incident occurs so it can be further investigated by security teams.
• Recovery and remediation – Planning in advance for when an attack is successful by deploying integrated archiving and data recover capabilities that deliver fast and easy email inbox restoration.
• Brand protection solutions - Blocking and taking down malicious domains impersonating your organization, limiting the use of stolen data, and protecting customers, partners and employees from scams that illegally use your domains.

Phishing attacks

The NCSC removes large numbers of UK-based phishing websites from the internet. Cyber-criminals use these sites to trick users into unknowingly revealing their personal information. This technique has consistently become more sophisticated and destructive over time. Use these tips to reduce your organisation’s phishing risks:

• Train employees on how to detect and report any signs of phishing (e.g., emails from unknown senders, suspicious links, or unsecure web addresses)
• Conduct routine software updates
• Install anti-malware and virus protection on all organisational devices

Beware of International threats

Of the numerous cyber-incidents that the NCSC has recently handled, a significant portion of attacks came from hostile
nations—including Russia, China, Iran, and North Korea. To mitigate your organisation’s international cyber-threats:

• Ensure compliance with all GDPR requirements regarding international data operations
• Communicate with your local authority if you suspect an international cyber-threat

Payment card fraud

The NCSC also detected over one million instances of suspected payment card fraud this past year. If your company utilises e-commerce, this is a top concern. Implement this guidance to limit your risk of payment card fraud:

• Make sure your organisation’s website has the proper controls to prevent hackers from infiltrating your payment system.
• Choose a trusted payment processor for all online transactions

More than anything, you need robust cyber-insurance to protect against these evolving cyber risks. Talk to your insurance broker for advice!

Visit SecurityWise

Source: SecurityWise