Why Securing Your Retail Network Has Never Been More Important

By Jack Chan | 29 Jul 2016

How secure is your retail network? Jack Chan, Security Strategist at Fortinet, discusses the very real threats to network security and the solutions available.

Beyond driving sales, managing inventory and guiding employees, corporate managers in the retail industry must also pay close attention to their IT networks, especially regarding security and reliability. Omnichannel retail organisations with bricks-and-mortar stores and e-commerce sites are stretching budgets across all sectors of the business, including IT teams. But it’s short-sighted to view IT networks as a place for cost cutting.

Retail is one of the most targeted industries by cyber criminals, who often target vulnerabilities at the store level, exploiting cracks in the point-of-sale system, Wi-Fi networks and other places. Denial of Service (DoS) attacks can cause a significant impact, bringing systems down during peak shopping periods. While maintaining critical network security is crucial, it doesn’t have to break the budget.

According to a 2016 survey by PwC of 800 Australian CEOs 78 percent see more threats now than three years ago, and of those, 82 percent believe threats will be of a cyber nature.

Fortinet 1

Retail threat assessment categories

Within retail networks, Fortinet has observed that a large portion of network traffic is web-related, meaning protecting retail networks from online threats like phishing, drive-by downloads, and malicious websites is crucial.

Source: Fortinet Fortiguard Labs

Source: Fortinet Fortiguard Labs

The retail IT approach

Many retailers start their approach to IT security with a central system at the head office and data centre, and then add different types of security deployments in-store. While initially a simple plug-in solution for each individual location can work for some chains, over time they prove to be unscaleable and particularly ill-suited to meet today’s complicated threats.

Challenges for retail IT

New retail networks must be able to accomplish a variety of functions and services above and beyond their primary functions of network access and performance. They need to address multiple threats, including finding malware attacks, viruses and even analysing user behaviour to distinguish between legitimate use and nefarious activity. These standards must be met while supporting the Payment Card Industry Data Security Standard (PCI-DSS), along with other industry or government compliance regulations.

Innovative services

Recent data breaches revealing information on millions of retail customers have been widely publicised, with many of those breaches resulting from exploitation of in-store vulnerabilities. Your retail network should provide customers with an in-store experience that offers an array of innovative services, such as secure Wi-Fi access, loyalty programmes and advanced payment options. A quality network security solution allows retailers to securely offer innovative and advanced onsite services to their customers, from kiosk to superstore.

Scalable and deployable

Managing a network across a retail chain, with its individual outlets spread across a geographic area, can be a challenge for IT engineers and managers. It requires a wide-ranging approach to security that can be increasingly complex. A network data breach or a disruption of IT services can have serious consequences to a retailer’s bottom line. Losing data can have consequences that go beyond lost sales, and strike directly at the heart of an organisation’s reputation. An implemented solution should facilitate a scalable framework that is easy to deploy throughout a distributed network and can be managed centrally.

Unified threat management

Management of hundreds of in-store networks is not only cumbersome, but also opens the network to greater threats, as it requires more monitoring and assessment of vulnerabilities and remediation. Additionally, a vast network of individual devices provides more points of failure over a network, making any one of them a potential target for attack. A threat management security service can assist an organisation seeking to secure a network with potentially hundreds of outlets, rather than traditional or stand-alone security options.

Point-of-sale and inventory control

A next generation security system can offer security solutions that cover a range of critical applications, including point-of-sale systems and inventory control systems. For example, organisations can leverage security solution providers to ensure retail customers’ in-store networks stay protected. The comprehensive, integrated in-store security solution reduces risks that come with wireless LAN networks, most commonly represented by Wi-Fi. These security appliances also balance the traffic from multiple broadband connections, ensuring that the stores and remote servers maintain robust connectivity.

Cyber threat assessment

A good first step to understanding and minimising your risks is to perform a cyber threat assessment to review your preparedness for cyber threats and security risks. Conducting such an assessment can help you better understand:

  • Security and threat prevention– to determine which application vulnerabilities are attacking your network, which malware/botnets were detected, and which devices are at risk. Used for firewall assessment and security breach probability.
  • User productivity– to determine which peer-to-peer, social media, instant messaging, and other apps are running. Used for application visibility control.
  • Network utilisation and performance– to determine throughput, session and bandwidth usage requirements during peak hours. Used for network utilisation and monitoring tests for performance optimisation.

    More information about Fortinet’s Cyber Threat Assessment Program (CTAP) details can be found here.

0 Comment

Leave a Reply

Your email address will not be published. Required fields are marked *