With more Americans expected to do their holiday shopping online during the COVID-19 pandemic, US agencies and cybersecurity leaders are urging all consumers to be on alert for holiday shopping scams and cyber threats, which historically spike during the holiday season. Here, we talk to Michael Rezek, Vice President of Business Development and Cybersecurity Strategy at Accedian, about the technologies retailers need to adopt to ensure a smooth holiday shopping season, how to see the warning signs for bad actors, how to proactively manage them and what to do to prevent them in the first place.
Security magazine: What is your title and background?
Rezek: I am the Vice President of Business Development and Cybersecurity Strategy at Accedian, where I’m responsible for conceptualizing and incubating the cybersecurity product. I have 30 years of industry experience, 10 as an engineer and 20 on the business and strategy side. Prior to joining Accedian, I spent 15 years at Cisco; overall, I have been selling security for over 20 years.
Security magazine: What should retailers be concerned about during this holiday? Are the threat levels higher due to COVID-19, as more people will shop online?
Rezek: Cybercriminals always target entities with large amounts of sensitive data, and I have to believe that 2020 will be the busiest season we’ve ever seen for online shopping. This means bad actors will be on high alert, looking to quietly steal data unnoticed from overactive company networks and apps. Furthermore, the concern about a malware attack on point of sale (POS) systems and the fact that the average time to detect a breach is over six months should have every retailer on high alert this holiday shopping season – especially considering the steep financial repercussions and negative impact to a company’s reputation that follows a data breach.
Security magazine: Nearly one in five U.S. consumers (18%) have been victims of a retail cyberattack, according to Morphisec data. Findings also show that over half of consumers (51%) say their trust in a retailer’s cyber defenses influences if they shop with them. How can retailers build up consumer trust?
Rezek: As the old adage goes, actions speak louder than words. Meaning, to build consumer trust, retailers need to adopt technologies that can safeguard their data and keep bad actors at bay. It’s no longer optional for enterprises managing consumer information – it’s crucial. And there’s nothing wrong with admitting as a business that you’ve taken these precautions, and that there are investments being made in cybersecurity solutions and processes to protect shoppers and improve the customer, engagement, experience, and privacy. Transparency is key throughout the entire cybersecurity conversation, from migrating from reactive to proactive performance monitoring, which requires technology that provides integrated visibility into network connectivity and application performance, to sharing key learnings from the successes and challenges of adopting network performance monitoring solutions.
Security magazine: What are the technologies retailers need to adopt to ensure a smooth holiday shopping season?
Rezek: To ensure a smooth holiday shopping season, retailers need to adopt two key technologies: network and end point based threat detection platforms that detect advanced persistent threats (APT), and malware within endpoint security or network traffic analysis. The savvy retailer will ensure these can scale to meet the demands of busy shopping periods, and that the combination of the two work seamlessly together. A comprehensive cyber strategy is always best; gone are the days of trying to just throw a tool in the environment and hoping for the best. Smaller retailers should also consider managed security services such as managed defense and response MDR as good options, as well.
Security magazine: What are some cybersecurity best practices they can implement/put in place?
Rezek: It certainly starts with training & teaching employees – especially during the holidays when many of them are temporary hires, and may not have been previously briefed on corporate cyber security practices. Teaching them to recognize and not click on phishing links or going to websites that look strange is a good place to start.
Secondly, leveraging cybersecurity threat detection tools or services is almost a must today. For all organizations it may make sense to take advantage of some of the services such as penetration testing and vulnerability assessment services to ensure they’re fully equipped with the knowledge and tools to protect against potential threats.
Also, one can’t underestimate the possibility for internal attacks, and make sure that employees are all aware and “on alert” for potential breaches to occur in-house. This could look like an employee sticking a USB drive into a computer and accessing information that is not relevant to their job, or one employee looking over the shoulder of another while they’re logging in.
It’s a great time of year to make sure your anti-virus software is up-to-date and ensure your critical asset and sensitive data is under surveillance with a network traffic analysis tool and an endpoint solution.
Bottom line, even the best cybersecurity organizations get breached; what matters the most is how you respond. The more rapidly you can detect a breach and the more comprehensively you can identify exactly what information was exploited, whether it is files or database queries, the more power you’ll have in a Ransomware negotiation (which is a real thing!). The ability to protect your reputation, brand, and revenue will be impacted greatly by having a rich forensic data warehouse that can be rapidly and easily analyzed.
Source: https://www.securitymagazine.com/articles/94106-minutes-with-michael-rezek—ensuring-holiday-cyber-readiness
