Everybody shops online or in supermarkets and shops. The digital transformation has aided and simplified how we shop. But every change comes with a drawback, too. So, in the case of the retail industry, the drawback is the drastic rise in hackers targeting them over the last few years. So, what is the state of cybersecurity in the retail domain?
The short answer to the question is this stat from IBM. It says that the retail industry is now top 5 most targeted by cyberattackers in 2023.
Let’s dig deeper into the current state of cybersecurity in the retail industry, the key challenges, and the best practices retail security teams can follow to mitigate risks and safeguard their enterprise networks.
10 Must-Know Stats about Cybersecurity in Retail
- Data Breach Costs: In 2023, the average cost of a data breach for retailers hit $3.76 million, according to IBM’s latest report. That’s a hefty price tag for any business, covering everything from recovery efforts to lost customer trust.
- Ransomware Attacks: Over 70% of retail businesses have experienced ransomware attacks in the past year, with nearly 60% paying the ransom.
- Customer Personal Info Targeted: Around 58% of retail data breaches involve customer personally identifiable information (PII), such as credit card numbers and personal details.
- Phishing as a Key Attack Vector: 39% of cyberattacks in the retail sector begin with phishing emails or social engineering attacks.
- Rise in DDoS Attacks: The frequency of DDoS (Distributed Denial-of-Service) attacks on retail sites increased by 32% in 2023 compared to the previous year.
- Bot Traffic on Retail Websites: Retailers report that 40-50% of their web traffic now comes from automated bots, with a significant portion engaging in malicious activities.
- POS Malware Threats: POS (Point of Sale) malware is a constant threat, with reports indicating a 20% rise in such attacks over the last two years.
- Third-Party Vulnerabilities: About 45% of retail data breaches occur due to vulnerabilities in third-party vendor software or supply chain risks.
- Increased Spending on Cybersecurity: Retailers have increased their cybersecurity budgets by 18% in 2023, focusing on threat detection, automation, and employee training.
- Compliance with GDPR and CCPA: 70% of global retailers now prioritize compliance with data privacy regulations like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
The State of Retail Industry in Cybersecurity
When it comes to digital transformation, retailers around the world don’t really have a choice. Either they must incorporate new technologies or bear the potential loss in profits and business.
As a result, the implementation of newer technologies like payment systems and the latest digital infrastructure is rushed, and to save costs, corners are cut. Especially in the case of securing the said digital infrastructure itself!
So, cybersecurity in the retail sector is often put in the backseat, and the numbers reflect the same. Hackers are targeting the customer data and personal payment info the retail industry works with, and the sector is crumbling under the pressure.
Key Challenges Faced by The Retail Industry in Cybersecurity
The state of cybersecurity in the retail industry is quite clear. But what are the actual problems and challenges faced by the retail industry?
- Rise in Risks and Attacks over Recent Times:
As mentioned previously, the retail industry has seen a drastic rise in cyberattacks over recent years. A key reason for this rise is a similar rise in the security risks around the world too. Cyberattacks are also targeting retailers during peak shopping seasons to maximize the chance of getting data as well. - Malware:
Not limited to the retail industry, malware is a common problem around the world. POS systems, data storage infrastructure, and workstations in the retail domain are increasingly being targeted by malware. - Social Engineering & Phishing:
As the old saying goes, the human is the weakest link in cybersecurity. The point is re-emphasized every day with hackers trying to trick employees and end-users into giving their sensitive info. This trickery includes impersonating customers or customer services and asking for payments or passwords, too! - Rise in Bots:
A fairly new challenge in the industry, bots have exponentially risen over the last few years. They scrape sensitive data, overload retail websites, modify queues, and more, and negatively affect your website’s performance. - DDOS (Distributed Denial-of-Services) Attacks:
In recent times, hackers are not just trying to steal data and leverage it for ransom. Retail websites are being overloaded, enterprises are losing potential revenue, and customers are getting frustrated, too.
Solving the Challenges Faced by the Retail Industry
Now that we have clear picture of the challenges faced by the retail industry, how do you actually solve and combat these problems?
There are 2 key pillars that we can lean on to drastically improve retail cybersecurity and potentially help remove the industry from the top 5 most cyberattacked domains!
- Integrated Vulnerability Management Approach:
A reason not talked about much but a key contributor to the rise in attacks is the lack of effective vulnerability management. Traditional vulnerability management is slow, broken, needs high manual efforts, and is pretty ineffective.
So, an integrated vulnerability management approach that unifies risk detection assessment, prioritization, and remediation will mitigate risks better, reduce your attack surface more, and prevent cyberattacks, - Leveraging Risk Compliance:
Three letters. PCI. PCI compliance is a treasure trove of regulatory guidelines that is a must for anyone handling payment transactions. When properly implemented, it is an excellent baseline foundation for your enterprise cybersecurity and will drastically improve your ability to combat threats.
But not limited to PCI, there are numerous compliance policies we must lean on to give us a solid foundation and boost cybersecurity efficacy as well.
Best Practices for Retail Security Professionals
- Regular Vulnerability Assessment: Most security teams are still scanning for risks every month, quarter, or semi-annually. The time duration between scans is an open window for hackers to actually exploit your network! So it is critical to regularly assess your network with vulnerability scanners and stay on top of the risks in your network.
- Integration & Automation: Automation is a big technological boon for us IT, and security admins can leverage it significantly in vulnerability management. Further, another way to improve vulnerability management efficacy is by integrating the different steps of the vulnerability management process and eliminating multiple tools needed as well.
- Holistic Visibility: A well-known statement is “You can’t protect what you can’t see.” And it’s a true statement more relevant than ever. Having visibility on hidden assets in your network will ensure the risks within them are also brought to light, and you’ll be able to remediate them!
- Cybersecurity Training for Employees: An often overlooked factor in cybersecurity, training your employees to recognize phishing attempts, educate them on password policies and more is exceptionally effective in minimizing the potential risks in your network.
Conclusion
The retail industry has undergone a drastic transformation over the past few years, but the sector is severely unprepared for the attention of hackers and threat actors.
Leveraging compliance and following best practices will enhance cybersecurity in retail, but proactive vulnerability management is the silver bullet that’ll aid security teams in the retail industry to combat and prevent cyberattacks and safeguard the data.
Leverage the cutting edge of proactive vulnerability management with SanerNow Continuous Vulnerability & Exposure Management.
