Recent research by PwC on their client base revealed that cyber attacks on their retail clients had increased by over 30%, demonstrating that the retail and ecommerce industry is of interest to cyber criminals.
The main threat is around the theft of customer data, which retailers hold huge volumes of. If you consider how much data you input to successfully order something online, then consider if that’s data you would like cyber criminals to have.
A popular type of cyber-attack on both the retail industry and food and beverage industry is point-of-sale (POS) cyber-attacks. A technology market research company found that point-of-sale breaches are among the most common methods of attack for these industries.
POS attacks take place when malicious malware is installed on systems used to conduct financial transactions. The malware is designed to steal customer payment data, particularly credit card data from checkout systems.
A global fast-food chain revealed that their payment card systems were breached. Cyber criminals had installed POS malware to many of their restaurants over a period of two weeks and the information harvested included cardholder names, card numbers and expiration dates.
It’s not just restaurants who have a history of these type of attacks, other attacks include retailers Target who recorded the theft
in the region of 40 million customers debit and credit card records.
So why are Point-of-Sale attacks so valuable to cyber criminals and how can I use mine more safely?
Naturally, they offer a significant payload for cyber criminals due to the volume of transactions that retail and food and beverage industries make every day. Imagine if they were able to collect every payment a shop or restaurant made in one day? In a criminal's mind, the sheer volume of payment card information that runs through a POS system equals a big pay day.
Due to the simplicities of point-of-sale technology, cyber criminals can easily design malware that runs on common operating systems such as Windows, Linux or Unix. If this system is used across multiple devices, that’s multiple devices collecting transactions that will ultimately benefit the cyber criminals. It’s critical that you ensure you are always installing the latest updates for systems and software like this, this is the best way to try and keep cyber criminals out of your systems and software.
Managing multiple POS systems remotely or from one single location can make it easier for cyber criminals to successfully attack a businesses whole POS network. Hackers can push out malware to each POS locations if they gain access to your management portal. Therefore businesses with chains such as retail or restaurants are often targeted with POS attacks.
The security risks posed by third party vendors are believed to account for up to 76% of POS attacks. Often, POS software is outsourced to a third party for convenience or because it’s seen as a safer option. Should your third-party supplier fall victim to a phishing attack, that could have a direct impact on your business so it’s important that vendor selection criteria exists.
Ensure POS software is installed and implemented sufficiently by individuals who have the knowledge to configure security beyond out-of-the-box defaults.
Strong network security is key when it comes POS systems, they are processing payments and personal data so having networks with weak or default login credentials can present an easy opportunity to gain access to your POS system.
Visa’s guidelines for adequate POS network security include:
o Access governance
o Separating internet access from the POS with a firewall.
o Policy-based management to prevent unauthorized device access.
o Use of strong credentials on all devices and applications on the network.
o Isolation of POS applications using network segregation.
o Enabling the strongest possible data encryption.
o Disabling SSID broadcast.
o Disconnection or monitoring of network ports.
Interested in more receiving guidance like this?
If your business is in either the retail or food & beverage industry, then we are here for you.
Businesses in the West Midlands can sign up for a free membership online and receive a welcome pack full of practical resources and tools that will help you identify your risks and vulnerabilities and the steps you can take to increase your levels of protection. Through your membership, you will also get regular updates on new threats, designed to help you stay safer.
Take a look on our website www.wmcrc.co.uk/membership