Industry Professional

Retail Under Fire

What makes enterprise-level merchants vulnerable to cyberattacks?

A recent data security report, published by Thales, revealed that 62 percent of all retailers worldwide have experienced a data breach within the past year. This alarming report provides evidence that retailers are prime targets for cyberattacks, and hackers have shifted the focus to exploit any system housing sensitive customer information that is not properly protected regardless of a company’s size.

While it can be almost impossible to predict how cyberattacks will evolve, understanding current cyber trends and vulnerabilities can greatly help retailers to swiftly improve their cybersecurity posture and significantly reduce risk. Read on to learn about the top three threats affecting the retail industry today and what can be done to neutralize or eliminate risk altogether.

Cloud and IoT

Over the past few years, many enterprise retailers have adopted technologies to streamline outdated business processes and greatly improve the customer experience. While popular technologies like cloud-based applications and other connected devices can certainly help an organization evolve towards a more convenient, customer-centric purchasing model, but it can also create additional data security vulnerabilities where traditional security tactics are no longer effective.

To mitigate the risk of exposing data in clear text throughout a growing system, it is important to take time and understand the overall data flow for sensitive information, such as how information enters the environment, what networks it traverses (data in transit), which applications or people handle the data and how data is being stored (data at rest). Once the information flow is understood endto- end, a multi-level security strategy can be identified to protect it.

A sound multi-level security strategy is made of three components:

A diagnosis. Identifying the data protection challenges and clearly understanding how it can affect a business.

A guiding policy. Defining what must be done at from a high-level to counter act the identified data security challenge.

Coherent actions. These are the objectives and assigned resources dedicated to executing the objectives within the guiding policy to achieve the strategy.

What is the best approach to a multi-level security strategy for sensitive data? Most industry experts agree, it is an approach using a combination of data tokenization, Point-to-Point Encryption (P2PE), standard data encryption, proactive data flow analysis (what worked previously might not work today), continuous training for handling sensitive data and proactive vulnerability monitoring and patching.

Using tokenization alone won’t keep a hacker from breaching a system, but can drastically reduce a data breach impact. Tokenization works by replaces sensitive data, like credit card numbers, with a valueless token useless to a criminal seeking to steal credit card information.

When combining data tokenization with P2PE, a solution that protects sensitive data with encryption the moment it’s captured throughout the full lifecycle, an enterprise can prevent the use of sensitive data for fraudulent activity in the event that a retailers system or network is breached.

PoS Malware

Point-of-Sale (PoS) malware is designed to extract credit or debit card data from a retailers POS environment and then send it back to a command-and-control (C&C) server run by hackers. In recent months, there have been a number of POS attacks around the globe that convinced users to open malicious documents that automatically download malware locally. This malware is then spread across the enterprise’s network to take over POS systems and other applications.

Keeping software up-to-date and restricting internet access are great first steps in protecting POS systems, but ultimately devaluing sensitive data and implementing a solid multi-level security strategy remains the best defense against cybersecurity threats for the enterprise.


EMV Chip and PIN adoption has grown significantly over the past year; shockingly not all retailers have adopted the two security tactics. According to experts, the uneven rollout has not gone unnoticed by hackers. There is available data (reports, videos online) for creative ways used by hackers to implement skimming devices at selfcheckout lines. These hacking methods are being executed using organized methods.

Effective data security requires a proactive and practical multilevel security strategy. Implementing P2PE/EMV technology for credit card transactions eliminates the impact associated with device skimming. Hackers are very creative and will continue to evolve their methods to expose and steal valuable information for maximum disruption or profit. The more vigilant and proactive businesses remain about data security, the better they will be at identifying these threats and mitigating attacks.

This article originally appeared in the November 2017 issue of Security Today.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • ResponderLink


    Shooter Detection Systems (SDS), an company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3