November and December can be particularly stressful for retail organizations—and not just because of the holiday madness. As the volume of transactions ramps up during the holiday season, IT teams must be on high alert for threats buried in a sea of routine activity. But given the exponential growth of ecommerce, they also need to stave off cyber threats. So, retailers need security programs that can detect and prevent increasingly sophisticated attacks from innovative and determined cybercriminals.
A 2013 breach involving Target, which cost the retailer approximately $221 million to resolve, is often cited as an example of what can go wrong when a retailer’s defenses fail.
Unfortunately, that high-profile breach was far from the last. A breach of Neiman Marcus involving 4.6 million customers that began in May 2020 and was reported in September 2021 is one among many more recent examples that show that retailers continue to present an enticing target for threat actors.
The Challenges of Retail Cybersecurity
Why do bad actors attack retail organizations? The answer shouldn’t be a surprise. Verizon’s 2021 Data Breach Investigations Report found that of 165 breaches with confirmed data exposure in the retail sector, 99 percent of the attacks involved a financial motive. Attackers focused on payment data, personal data, and credentials— all of which can be leveraged for financial crimes. Exposure of such data also attracts attention from state, federal, and international regulators and may lead to large fines.
Ransomware is one of the preferred tactics to breach a retail organization’s defense. A Sophos report found a third of retailers who had data locked up by ransomware chose to pony up, paying an average ransom of $147,811 to regain control of their data. And that’s not the only cost retailers may experience in the aftermath of a ransomware attack. The total loss, which includes downtime and opportunity costs, as well as people, device, and network costs, averaged $1.97 million.
Staff Shortages, Burnouts, and Other Challenges
According to research conducted by CyberRisk Alliance in collaboration with Arctic Wolf, retailers face a variety of challenges related to cybersecurity. One of the main obstacles for improving their organization’s security posture in the next six months is IT staff overload and burnout, a challenge cited by 69 percent of respondents from retail organizations.
When consumers flock online to purchase gifts in the fourth quarter, retail IT teams get even more overloaded. They often find themselves drowning in alerts—and it doesn’t help there’s a labor shortage that continues to impact security teams across all industries. That lack of seasoned professionals to review all these alerts means that many of them go unanalyzed.
The numbers tell the story. 59 percent of respondents in the retail sector believe that the current shortage of skilled workers is affecting their organization. And 61 percent report that they receive too many cybersecurity alerts to know which ones deserve their focus.
There’s also a limited amount of money available for cybersecurity purposes to help prevent cyberattacks—73 percent of respondents say a lack of budget/funding is as a primary challenge for improving their organization’s security posture in the next six months.
Staff Turnover and Spikes Complicate Retail Cybersecurity
So, how can your company ensure a safe and secure holiday season? The first step is to acknowledge that the biggest problem may not be made of ones and zeros but of flesh and bone.
Retailers experience significantly more “people” challenges compared to other key industries, CyberRisk Alliance found. There are many reasons for this, including the influx of staff to meet the holiday demand. For example, Target plans to hire 100,000 seasonal workers to handle the 2021 holiday traffic. Amazon plans to hire 150,000 to cope with the seasonal volume. Such hiring spikes are typical across the entire retail sector.
To complicate the security challenges facing retailers, the National Retail Foundation reported that retail employee turnover in 2021 exceeded 60 percent up through July, resulting in 230 million days of lost productivity and $19 billion in costs. Unsurprisingly, nearly two out of three respondents in the retail sector believe their organization has a high IT security staff turnover.
Given the influx of seasonal hires coupled with a revolving door of employees leaving, 71 percent of respondents from retail organizations say ineffective or lack of employee training/education is the main challenge for improving their organization’s security posture in the next six months.
Regardless of an employee’s tenure, all are potential targets of an attacker who hopes to breach a company’s defense. Whether an employee opens and engages with an email laden with malware or discloses their login credentials to a caller masquerading as an IT employee, the potential for criminals to take advantage of their lack of security knowledge is an ever-present threat.
Protecting Retail Organizations Against Cybercrime
An effective security awareness program can help retail employees recognize and respond appropriately to suspicious emails or phone calls. It can also serve as an extension of the security department by uncovering and reporting issues with the potential to compromise the company’s defenses. Security awareness training also makes it easier for retailers to comply with increasingly complex and demanding regulatory requirements.
Just as importantly, a security awareness program developed and administered by a suitably qualified third party allows your security staff to focus on more involved and demanding issues that require a real-time response.
Take a tour of Arctic Wolf’s Managed Security Awareness training program and find out how our program can enhance your retail company’s security culture. And check out our State of Global Security Operations guide for more insider information and insight into today’s security operations.
