Although Black Friday is officially the weekend after Thanksgiving in America – this year falling on 24th November – the sales now begin weeks before the event, often extending throughout the whole month. As Robert Sugrue, Cyber Security Product Director, Six Degrees, reflects, “Black Friday, Cyber Monday and the whole ‘Thanksgiving give-aways’ are not what they used to be! Nevertheless, our suppliers of goods and services continue to ply us with once in a lifetime, too good to be true offers, as our minds turn to buying Christmas gifts and saving a few quid at the same time!”
Each year the Black Friday sales grow in popularity, and Cyber Monday is now a key part of the sales weekend, with retailers taking advantage of the billions of online shoppers across the world. But, this growth of popularity has sparked the interest of cybercriminals, who are also out to exploit the vast number of people online trying to bag a bargain. Chris Rogers, Technology Evangelist at Zerto, a Hewlett Packard Enterprise company, warns that as “Cyber Monday is well known for being one of the last chances for retailers to hit profits before the end of the year”, it is possible that “some retailers may have already been exploited, with ransomware lying dormant until it can do maximum damage – for example early morning on Cyber Monday. By holding off, the impact of the hacker’s attack doubles: a retailer’s entire operation has been shut down on the most profitable day of the year, all while being held to ransom.”
The impact of such an attack can be devastating for retailers – in terms of downtime, reputation and financial damage. The average recovery time after an attack is 22 days, in which time companies can lose a significant amount of revenue. Randeep Gill, Principal Security Strategist at Exabeam, references a recent study which has”demonstrated that the average cost of a data breach in 2023 is $4.45 million, a 15% growth over 3 years, and retail is rife for adversaries.”
It is so important for retailers to be prepared to protect customers’ data during the busy weekend. Whilst their priorities will likely be on fulfilling orders and minimising delivery time, cybersecurity should be top of the agenda during the festive period. We spoke to cybersecurity experts to gain advice and insights on the best methods for retailers to achieve this.
Technology to add to the shopping trolley
A crucial first step in being able to protect systems and customers’ data is to understand your environment and the threat landscape. How can you protect it if you don’t know what you’re protecting it from? Yet, concerningly, “Gartner reports that few organisations today have an accurate picture of their own threat landscape,” reveals Brett Candon, VP International at Cyware.
He recommends gathering threat intelligence as a starting point because it “helps enterprises get ahead of attacks, but it isn’t easy to segregate, correlate, and prioritise the huge volumes of available threat data to create a ‘single source of truth.’”
He continues that a good cybersecurity strategy is made up of more than one approach: “Adding threat intelligence, however, isn’t enough. We must connect the dots. This next-generation approach to cybersecurity – often referred to as cyber fusion – unifies all security functions such as threat intelligence, security automation, threat response, security orchestration, incident response, and others into a single connected platform which detects, manages, and responds to threats in an integrated and collaborative manner.”
Zero trust is a key approach to integrate into a good cybersecurity strategy, especially as “identity is still the number one challenge when it comes to internal breaches where networks are compromised,” shares Stuart Hodkinson, VP EMEA at PlainID. “Therefore, retailers must adopt a “Zero Trust” approach, which means trusting no one – not even known users or devices – until they have been verified and validated. Zero Trust provides that layer of defence that is unrivalled when it comes to defending internal systems.”
Another critical method to protect customer data is to “have robust data loss prevention strategies in place,” advises Chris Denbigh-White, Chief Security Officer at NextDLP. “These measures not only protect against external threats but also mitigate risks from internal ones, whether malicious or negligent. Ensuring that sensitive customer data is safeguarded is not just a matter of regulatory compliance, but a critical aspect of maintaining consumer trust and preserving the integrity of the business. Implementing advanced security protocols and continuous monitoring systems is not just advisable; it’s imperative in today’s digital age.”
But should these steps fail and the worst does happen, “retailers need to ensure the organisation can recover fast from a cybersecurity event and get back to business as usual,” urges Zerto’s Chris Rogers. “Once you’ve been compromised, prevention is no longer a viable protection strategy. By implementing tools that deliver disaster recovery and continuous data protection (CDP), retailers will be able to get things up and running quickly when something goes wrong, limiting downtime and restoring operations in a matter of seconds or minutes, rather than days or weeks – something that is especially vital on the biggest E-commerce day of the year!”
With the boom of AI in the past year, it has also widely impacted the cybersecurity industry and provides a great opportunity for retailers to integrate it into security strategy. Exabeam’s Randeep Gill shares one use case for Machine Learning AI: “It can be leveraged to help understand the nuances of any business and then prioritise risk through behavioural modelling. A multi-layered strategy should be employed throughout the year – using behavioural analytics to establish normal behaviour for all users and assets in an organisation. This will help businesses to better understand anomalies in their diverse environments that could be indicative of a breach.”
Using these tools to protect systems and, subsequently, customer’s data will set retailers up for a successful Black Friday. But, cybercriminals aren’t like Santa Claus – they don’t only appear for the festive season – so cybersecurity should be high up on the list year round.