Cybersecurity requires collaboration within the retail industry

by Julia Pott

The growing cyber threat affects many industries, but due to multiple touchpoints between retailers and their customers, retail security breaches quickly have a direct impact. American companies have – by necessity – made great progress here in the last decade, explains Christian Beckner, vice president of retail technology and cybersecurity at the National Retail Federation and executive director for the NRF Center for Digital Risk & Innovation. Christian gives us his perspective on what retailers have learned about cyber security, focusing on the role of ransomware attacks and Internet of Things.

Christian, when did the NRF start focusing on cybersecurity and how did this come about?

Christian Beckner: In 2013 and 2014, several major US retailers had significant cybersecurity incidents. That prompted NRF to form a group within its membership focused on cybersecurity.

We have a council called the IT Security Council, which comprises about 150 companies, typically mid-sized or larger. Their Chief Information Security Officers (CISOs) or equivalent roles, along with their teams, come together to share best practices, collaborate on benchmarking, and work on various initiatives.

Additionally, we engage in policy discussions on cybersecurity and collaborate closely with the Retail and Hospitality ISAC (Information Sharing and Analysis Center). This group facilitates the sharing of specific threat information among members, enabling them to adjust their defenses accordingly.

So, openness and collaboration are important when it comes to cyber security?

Beckner: Yes, at least in a closed setting. In a public discussion, you don't always want to talk about vulnerabilities. But in a confidential meeting, companies can ask questions like, "We're facing this issue. What should we do?" and have a dialogue to exchange information and solutions.

How aware is the U.S. retail industry of cybersecurity and how prepared are American retailers in terms of cyber resilience?

Beckner: For medium to large retailers, cybersecurity is definitely not in its early stages anymore. Many have significantly expanded their teams. Some of the largest retailers have cybersecurity teams of over 500 people. Even mid-sized companies, such as apparel stores with around 500 locations, may have teams of 50 people dedicated to cybersecurity. Cybersecurity teams are often still part of higher-level IT departments, but there has been a lot of growth and maturity in this area in the past.

The challenge lies with small retailers, those with just one store or restaurant. They don't have the same resources but can still fall victim to cyberattacks. We try to help these smaller businesses by providing access to free or low-cost resources.

How have cyber threats evolved in recent years? Are there specific threats that have become more pressing for retailers?

Beckner: A few years ago, many threats involved the compromise of credit card and financial data. Thanks to improved security measures, like encrypting credit card data and securing point of sale systems, these threats have diminished.

Today, ransomware is one of the most significant threats, impacting all industries, including retail. Another concern are third-party cyber threats where vulnerabilities in partners, suppliers or vendors affect retailers because they have access to the retailer’s information or are managing sensitive data. We've seen a number of incidents where one company’s vulnerability affected hundreds of businesses.

How critical is maintaining consumer trust for retailers?

Beckner: It's the primary reason why retailers invest so much in cybersecurity. Until recently, there were no federal regulations for cybersecurity in U.S. retail. Now, the Securities and Exchange Commission (SEC) has introduced regulations for publicly traded companies. Before this, cybersecurity efforts were largely driven by consumer trust, state laws on reporting data breaches and industry standards like PCI-DSS.

What role does IoT (Internet of Things) play in retail cybersecurity?

Beckner: Retail stores nowadays are highly tech-driven, with POS systems, networked cameras, touch screens, RFID price tags, and mobile devices for inventory operations. These technologies increase the potential attack surface. Cyber incidents in supply chains or logistics can also disrupt stock availability and e-commerce orders.

What should retailers prioritize if they're just starting with cybersecurity?

Beckner: Start with basics like multi-factor authentication, the capabilities to detect potential intrusion and employee training to recognize phishing. AI has made phishing attacks much more convincing, plus many incidents start with phishing e-mails, so awareness and training are critical.

Another important step is to have a person in charge of cybersecurity who has the ability to go directly to the CEO to make the case for issues of cyber resilience. The challenge is that cybersecurity – in contrast to other investments – doesn’t increase the revenue of a retail company. That’s why a cyber security department should have their own budget and authority to weigh in on strategic corporate decisions like new technologies or providers.