he problem is mirrored overseas, where several top

retailers and hundreds of banks have been victims of digital theft. Millions of consumers were violated and losses amounting to more than $2 billion were counted in the US last year alone.

Retailers make a particularly attractive target for hackers and thieves. They are vulnerable because merchants handle lots of sensitive data, they are highly distributed (that is, lots of open doors) and, in the words of bank robber Willie Sutton, “That’s where the money is”. Not just actual money – limitless fortunes can be made with stolen identities now.

For individual corporate victims, the toll includes actual losses, investigation and reporting costs, insurance and banking fees, regulatory and security compliance and, of course, liability lawsuits.

Clearly, the best way to respond to a data breach is not to have one. That means doing everything possible to prevent hackers from breaking and entering. Retailers can do so by adhering to the following key practices:

Know your vulnerabilities. Every organisation has actual and potential vulnerabilities. Some are obvious, others less so. While retailers will never know them all, they can anticipate and manage them better with continuous and collaborative vulnerability assessments to help measure exposure. Remember, hackers assume that each retailer is compliant with whatever regulations apply to its business. They don’t have a checklist, they have a mission. The retailer must have one too.

Validate, validate, validate.Never assume that something has been done or fixed. Demand proof. In the case of a major clothing retailer in the US, the testers assumed the wireless network was disabled. It wasn’t, and the rest is history. Moral of the story: make sure to confirm the status of everything on every network. This includes computers and devices management doesn’t think are operational or that were never turned off or formally decommissioned. Far too often, hardware isn’t updated with the latest security measures because nobody believed the devices were

part of the network. So validate all assumptions. Then do so again.

Know the partner network. Each retailer will know its own network, but that network isn’t the only thing on a retailer’s network. There are point-of-sale terminals, suppliers, administrators, HR managers and thousands of others hanging on to the network from the outside. Know who they are and what their security looks like. All the time. An attack on a large discount retailer occurred because a vendor had legitimate access to the network for billing and invoicing. That company’s vulnerability ultimately impacted the retailer. It is not enough to have a contract requiring partners to secure things on their end, the security of all partners must be tested too.

Always keep an eye on the back door. One of the most common network breaches occurs with default passwords or hardware configurations, frequently at the point-of-sale terminal. To counter this, every single POS terminal must have its defaults removed, and this must be checked frequently. If they are rebooted or reset, the defaults may have to be removed again. The same is true for every wireless router and connection. Since attacks are happening higher up the chain, a retailer must validate its entire supply chain to prevent malware insertion and insist that all its vendors do the same.

Know your vendors. This includes not just hardware and software suppliers, but also lawyers and accountants, HR and recruiters, architects and engineers, consultants and third parties, cloud providers, business and technology service providers and consultants. Any of these can introduce a vulnerability

into a retailer’s network. So make sure they are trained and agree to your policies and data procedures. Then work up their supply chains, since their own vendors can introduce vulnerabilities into a network.

Prepare an IOT strategy. You think it’s bad now? Just wait. Once the internet of things (IOT) is fully realised, there will be exponentially more data exposure, vulnerable handlers and open doors – billions of them, by way of all the new connected devices. Don’t be too afraid of this technology. Develop a strategy that makes these IP-aware and addressable devices work for you, instead of against you.

Learn to say ‘yes’. When confronted with new technology and its associated liability, many companies are too quick to say no. The lawyers say no, the regulators say ‘no’, the CIO and IT directors all say no: no USB. No wi-fi. No cloud. No IOT. No RFID. No iPay. That’s the wrong answer. If a retailer prohibits useful technology, its people will just move to simpler, often less secure workarounds. So at least say ‘maybe’, although ‘yes’ is better. Then secure whatever is deemed useful instead of fearing it.

Make this a chief executive concern. Preventing data theft isn’t a security issue, nor is it a technology, legal or compliance issue. It’s a company-wide concern, fundamental to the very core of retail. Security is not something to simply bolt on, it is integral to every business decision. Thus, security is a CEO and board of directors’ issue. It enables and empowers every aspect of a company. With so much at stake, it deserves a seat at the top table, as well as a top budget and the ear of the CEO.

T

Eight ways retailers can avoid digital theft

Alan FanarofANZ Practice Head for Retail and Consumer Goods Alan Fanarof is the ANZ Practice Head for Retail and Consumer Goods at consulting and IT major Cognizant. He has more than 30 years of practical domain experience across retail and allied industries, including hands-on experience in C-level and business roles across some of Australia’s key retailers, delivering large business transformation projects. In his current role, he provides strategic services to Australian blue-chip customers.

According to the Australian Retailers Association, retail theft forms part of the largest crime category in Australia, costing the retail sector more than $7.5 billion each year.

About CognizantCognizant (NASDAQ: CTSH) is a leading provider of information technology, consulting, and business process outsourcing services, dedicated to helping the world’s leading companies to build stronger businesses. With more than 75 development and delivery centres worldwide and approximately 199,700 employees as of September 30, 2014, Cognizant is ranked among the top-performing and fastest-growing companies in the world. Visit us online at www.cognizant.com or follow us on Twitter: Cognizant.

S EPTEMBER 7 , 2 0 1 5 53

B U S I N E S S – I N F O R M AT I O N T E C H N O L O G Y

53.indd 53 25/08/15 3:51 PM