Tag Archives: Hacking

I awoke to a typically hectic Monday morning and I was well into my normal morning routine until I opened up an email from Zappos letting me know that I am one of the 24 million customers whose information has been hacked. Insert groan, eye roll and banging head against my desk here.

I work in Tech, I know that having my personal information online is a risk, but like most people, buying online is something that I still do.  I know that I’m  putting myself at risk, but being aware of this risk doesn’t really prepare you for the punch in the gut feeling you get once you receive that notice that your information has been breached.

But enough about my sob story, what does this mean for retailers like Zappos — a lot. Retail organizations like Zappos who experience a breach, now face the uphill battle of rebuilding customer confidence in their brand and website.  Zappos is relatively large retailer, and with the online retail giant Amazon.com as its parent company, one would think that they’d be a difficult site to hack into, but it just goes to prove that no one is safe, not even retail giants.

Looking at the way Zappos handled the leak of information shows that they had well thought out breach strategy in place. They stored user passwords and credit card data in separate databases, they were very timely in letting users know about the breach and what steps they needed to take. But, all of this is like having a cleanup crew on standby, how do retailers prevent the mess to begin with?

The most fundamental of security for retailers to follow are PCI regulations; unfortunately most retail organizations don’t. In fact, a whopping 67% of retail organizations that require PCI compliance aren’t in full compliance. But even if a company followed the PCI requirements, they are the bare minimum of security measures that can be easily hacked and reversed engineered. Retailers need to more than the bare minimum.

Retailers also need to stop seeing traditional defenses such as antiviruses and firewalls as effective as they once were. They need to consider new approaches and technology to help with security. New technologies that are considered more effective include: vulnerability assessments, effective and timely patch management, secure browsing, and security management platforms.

Retailers need to get their security solutions together, and stop trying to piecemeal tools and comply with the bare minimum of requirements because they just don’t cut it. Get a plan together for a solid security strategy; pick up a few tips and tricks for building your PCI security strategy.