Cyber data resilience in retail: how to improve risk management processes

Where users are tricked into divulging sensitive information or passwords. Phishing is the most common form, where malicious links or files are opened by customers or staff which look like they are from a reputable source. Social engineering can lead to ransomware and other attacks.

IoT devices enhance supply chain optimisation, inventory management, delivery, operations and customer feedback collection, but if IoT device security is poor or not updated, this is an attractive and new access point for hackers to retailer systems and data.

Hackers can potentially access sensitive data on NFC payment terminals if a connection is not secure. Compromised POS systems can lead to card skimming, theft of payment data and unauthorised access to the retail network.

Excessive user traffic, user error, weak passwords, staff negligence.

Internet transmissions are interceptable where encryption is not adopted, facilitating cyberattacks.

Where a cybercriminal gains access to a network (often via phishing) and infects with malware, including ransomware, encrypting a system's data, unlockable without the decryption key. This can result in system downtime, a data breach, and other contractual and regulatory issues.

These can include incorrectly applied software updates, SQL injection, IRL redirection to untrusted websites, infected software.

Unchecked supply chains pose cyber risk. Retailers rely on service providers, contractors and business partners, especially cloud service providers, POS system providers and third-party apps for online sales. Any security vulnerability at a third-party source threatens the safety of data transfers. Additional risk arises here as third-party vendor attacks can be harder to detect as they are not direct on the retailer.

Human mistakes are a leading factor in cybersecurity breaches. Retailers should ensure workforce training is regular and up to date. It should cover learning about the range of cyber incidents that can arise and include steps to limit human error and technological issues. Employees at all levels of the company should know how to spot a phishing attack or malware. Do your suppliers do the same?

Minimum security standards should be set for suppliers. See NCSC Supply chain security guidance. Third-party partners and suppliers should complete questionnaires about their data and cyber hygiene.

Results will enable retailers to align with other businesses that practice the same (high) level of cyber resilience, reducing the risk of an entire supply chain becoming affected by a cyberattack. Outcomes should also facilitate identification of clear vulnerabilities which need addressing according to the level of risk posed.

Include contractual rights to carry out penetration testing, requirements for maintained accreditations, commitments to security measures, obligations to maintain disaster recovery and business continuity plans and rights to carry out audits on any business in the supply chain to test resilience to a cyber incident.

If systems are integrated with those of suppliers (via a portal or order system), analysis of vulnerability is required. How integrated are supplier systems to the primary infrastructure? How easy is it to disconnect if necessary? How often are systems checked for vulnerabilities? Is there a back-up plan if those systems go down? An entity is only as strong as its weakest link.

Actively carry out regular security audits and GDPR compliance audits internally, and of supply chains.

Prepare, test, update and become familiar with your cyber incident response plan. Depending on how reliant or closely connected you are to your supply chain, you should consider including suppliers in your incident response plan as well as any tabletop exercises designed to test it.

Take advantage of 'peace time' to build resilience by identifying and understanding how you will work with key suppliers to keep operations going and reduce downtime in the event of a cyber incident. See How to deal with a cyber incident.

Prepare and integrate the business continuity and disaster recovery plan with suppliers' plans, and regularly test.

A cyber incident results in significant trade disruption for retailers. In addition to any actual losses, there will be substantial time cost impact for management in terms of dealing with the data breach (with time critical regulatory reporting requirements); ransomware payment handling (see our article for comment on ransom payments); updating ICT security at speed; and in addressing reputational impact fast.

Any incident is also likely to undermine consumer confidence (especially where consumer data is involved) and may impact brand loyalty and lead to reduce sales.