The growing importance of network security for retail brand protection

Information technology is playing an ever-increasing role in the retail sector, and having effective security in place has never been more important when it comes to brand protection. Security incidents can have a big hit on a retailer's reputation, causing customers reduce their spend or shift allegiance to a competitor.

Potential cyber security incidents are many and varied. For example, not having proper security in place on a store Wi-Fi network could lead to the personal details of customers being stolen by a criminal. If a cyber attack results in the store point of sale (POS) system failing or slowing down it could lead to long checkout lines and missed sales. A breach could stop customers using payment cards and so delay or abandon transactions.

To avoid these scenarios, retailers must have in place a comprehensive strategy to ensure their networks and infrastructures are secure at all times. The future of their brand depends on it.

PCI compliance

One of the most important components of any security strategy is the attainment of Payment Card Industry Data Security Standards (PCI DSS) compliance to allow the acceptance of credit card payments. To achieve this, a retailer needs to be able to demonstrate it has the systems and processes in place to ensure customer transactional data is handled securely at all times.

Attaining and maintaining PCI compliance can be challenging. By their very nature, retailer IT infrastructures are constantly changing and it can be difficult to ensure security measures that have worked in the past will continue to work when additional equipment or software is added. There can also be challenges around ensuring all staff are aware of the procedures that must be followed for compliance to be met.

The key steps for ensuring full PCI compliance include:

• Focus on system access: Make a point of changing the default passwords on all devices within the infrastructure and use multi-factor authentication to increase security.
• Monitor your network: Deploy discovery and visibility tools that can reveal what is happening on your network and alert you to suspicious activity. You should also ensure that any new IT projects undergo a security review before going live.
• Make compliance a regular activity: Run frequent compliance audits to ensure adherence to prescribed standards. Also, stay aware of any changes made to PCI compliance regulations that will require additional security measures. 

Wi-Fi security

Another key area of focus when it comes to security is Wi-Fi networks. Many retailers offer free Wi-Fi hotspots for customers to encourage them to stay longer in stores and hopefully increase their spend. During the past few years, having such a network in place has evolved from being a novelty or luxury to something that is expected by customers.

Some retailers also use Wi-Fi networks to provide access to core systems for employees. Other use the networks to connect in-store mobile POS stations during times of peak shopper demand.

Wi-Fi  is particularly attractive to cyber criminals as it offers a range of options for attacks. A hacker can spoof a retailer's network SSID and trick customers into connecting to a rogue access point. Once this happens, the hacker can harvest personal details or even insert malware onto devices being used.

If a hacker manages to compromise a retailer's legitimate Wi-Fi network, they can monitor traffic, disrupt transactions and even launch a denial of service attack which could disrupt or stop retail activity.

To prevent these scenarios, retailers need to put in place tools that effectively secure their Wi-Fi networks. The tools should be able to identify any rogue access points that might have been established and allow only legitimate users to gain access to the retailer's network. The tools must also be able to distinguish between rogue access points and legitimate ones such as those being operated by nearby retailers.

Key security steps

Faced with an ever-evolving threat landscape, retailers must be constantly aware of the measures needed to ensure a secure IT environment is maintained. Some of the key steps that should be followed include:

• Segment the network: If an attacker manages to gain access to one part of a retailer's network, their ability to move to other areas needs to be constrained. For example if they gain access to the POS system this should not allow them to get into core financial applications or data stores. Segmenting the network to prevent unauthorised movement from one area to another is an important step.
• Deploy  visibility tools: It is important to be aware of everything that is going on within the network at all times. Deploy effective monitoring tools that will alert the IT team if there is suspicious activity or unusual flows of data. Steps can then be taken to stop potential attacks before they cause disruption.
• Use multi-factor authentication:  Consider using tokens or push notifications to mobile phones as an additional layer of security for those accessing the network. This is significantly more secure than passwords alone and can reduce the potential for successful attacks.
• Educate your staff: Staff awareness of security issues and processes is a vital part of any strategy. Undertake regular training to ensure all understand what is expected of them.

By taking a comprehensive approach to security, retailers can be confident they are well placed to withstand potential cyber attacks or recover quickly should one occur. A secure network will deliver consistent levels of customer service and reduce the change of a brand-damaging incident.