Securing Infrastructure, Protecting Consumer Privacy & Preventing Breaches
3 Core Cybersecurity Priorities for Retailers and How to Address Them

Security expert Richard Purizaca offers advice on securing infrastructure, protecting consumer privacy and preventing breaches.

Cybercriminals have been increasing their attacks on retail businesses. That’s why 70 percent of industry CISOs say they expect their budgets to increase for the third year in a row in 2023, according to the Retail & Hospitality ISAC.

We spoke to Richard Purizaca, a senior field security solution architect with CDW who specializes in cybersecurity, about the challenges faced by modern retailers. He said that shrewd retailers understand that there are three core priorities they must confront when it comes to cybersecurity and offered guidance on how they should address each one.

BIZTECH: Can you talk a bit about the three core security issues that retailers must address?

PURIZACA: Yes, let’s take each one at a time. Retailers’ No. 1 priority must be to secure retail infrastructure communications. Retailers need to have a solid understanding of all the assets that exist within their network infrastructure. This requires having clear visibility of those assets to make sure they are monitoring them properly.

BIZTECH: What's the second core issue?

PURIZACA: The next thing is that retailers must ensure they’re keeping consumer data private, so they have to handle consumer data properly. For credit card information or any type of consumer information, they need to have the proper security and encryption levels in place to make sure that line of communication is secure. Any retailer who manages consumer traffic and consumer data should have these security guardrails in place.

BIZTECH: That brings us to the third core issue: preventing network breaches. How do these security measures enable that?

PURIZACA: Preventing network breaches means monitoring employees and having an extra layer of visibility. You start with a solid fundamental security program, with monitoring and other tools. You also have a firewall, intrusion detection, URL filtering, endpoint protection and identity and access management. A lot of these tools work together to establish the proper security posture for businesses to avoid any type of network breaches, or at least to lessen the risk in terms of them being exposed to a network hack. biztechmagazine.com


DOJ's Cybercrime Crackdown Continues
Justice Department Targets 13 Websites Linked to DDoS-for-Hire

Ten of the domains targeted today were "reincarnations" of services seized in December 2022.

On May 8, the Justice Department announced a court-authorized seizure of 13 Internet domains linked to stressor or booter platforms, more formally known as DDoS-for-hire services.

This is the third wave of US law enforcement action against these kinds of services that allow users to pay for distributed denial-of-service attacks (DDoS), which overload targeted machines with an onslaught of information and disrupt operations, including accessing the Internet. Not only this, but DDoS attacks can "completely sever Internet connections for other customers serviced by the same Internet service provider." Thousands of users pay for these services to launch millions of attacks against countless organizations, including schools, universities, government websites, and financial institutions, the Justice Department said in the release.

In December 2022, nearly 50 booter services were targeted and seized by US law enforcement and 10 of the 13 that were targeted today are "reincarnations of services that were seized" during the sweep in December. As the Justice Department cracks down on operators, they stress that investigations into these services will continue.

"Victims who are attacked by such services, or those providing Internet services to the victims, often have to 'overprovision,' that is, pay for increased Internet bandwidth in order to absorb the attacks, or subscribe to DDoS protection services, or purchase specialized hardware designed to mitigate the effects of DDoS attacks," stated the affidavit supporting the seizure warrants. "The prices of such overprovision or DDoS protection services are usually significantly more expensive than the cost of a given booter service." darkreading.com


DOJ Disarms Malware Network
FBI Disarms Russian FSB 'Snake' Malware Network

Operation "Medusa" disabled Turla's Snake malware with an FBI-created tool called Perseus.

The US Department of Justice announced it has pulled off a joint operation code-named Medusa that decimated a long-standing malware operation run by the Federal Security Service of the Russian Federation (FSB).

For nearly 20 years, threat group Turla, operating inside the FSB's notorious Center 16, used Snake malware to steal secrets from North Atlantic Treaty Organization (NATO)-member governments, according to an announcement from the US Attorney's Office in the Eastern District of New York.

Following compromise of target government systems, Turla would exfiltrate sensitive data through a network of compromised machines spread throughout the US and beyond to make detection harder, the DoJ said.

The FBI developed a tool named Perseus, which was able to successfully command components of the Snake malware to overwrite itself on compromised systems, the DoJ added. darkreading.com


New Ransomware Operation Targets 'Large Commercial Entities'
New Cactus ransomware encrypts itself to evade antivirus
A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of “large commercial entities.”

The Cactus ransomware operation has been active since at least March and is looking for big payouts from its victims. While the new threat actor adopted the usual tactics seen in ransomware attacks - file encryption and data theft - it added its own touch to avoid detection.

Researchers at Kroll corporate investigation and risk consulting firm believe that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances.

Extensive details about the Cactus operation, the victims they target, and if the hackers keep their word and provide a reliable decryptor if paid, are not available at this time.

What is clear is that the hackers' incursions so far likely leveraged vulnerabilities in the Fortinet VPN appliance and follow the standard double-extortion approach by stealing data before encrypting it.

Applying the latest software updates from the vendor, monitoring the network for large data exfiltration tasks, and responding quickly should protect from the final and most damaging stages of a ransomware attack. bleepingcomputer.com


Microsoft Patches 2 Zero-Day Vulnerabilities

To enable ethical hackers, a law reform is needed

In Case You Missed It

Retail Council of Canada embarks on new cybercrime awareness venture

The Retail Council of Canada (RCC) recently launched a new cybercrime prevention campaign to provide educational resources for retailers and their employees, from frontline workers to IT security professionals.

The Retail CyberSecure initiative, which kicked off at the beginning of this year, was made possible through the support of the Ontario Ministry of the Solicitor General and includes partnerships with the RCMP and the Ontario Provincial Police, among other organizations.

The program, which will continue to roll out throughout the year, comprises a series of six webinars along with downloadable guides and e-learning training modules. The resources are offered for free to achieve maximum impact, said Rui Rodrigues, the RCC's executive advisor for loss prevention and risk management.

The issue of cybercrime has become more acute for retailers, he said, as threats continue to ramp up. The pandemic also saw retailers become more reliant on online storefronts when in-store shopping was curtailed or temporarily restricted.

"Over the last few years, we've heard more and more from retail organizations about cyber," said Rodrigues. "You can't escape it."

The CyberSecure initiative is "really focused on ways we could educate, provide awareness and share best practices," added Rodrigues, "and doing it through various mediums."

Three of the six planned webinars are currently available on the RCC Retail CyberSecure resource website, focused on awareness training and current cyberthreats. Webinars on threat action plans, defensive procedures, ransomware training and brute force attacks will follow in the coming months.

Battle on two fronts

In some ways, loss prevention specialists are waging a battle on two fronts: the threat of shoplifting in brick-and-mortar retail locations and the ever-present spectre of cybercrime in the digital realm.

In both cases, education and awareness are key, said Rodrigues, along with collaboration with government and likeminded organizations to get the word out. canadiansecuritymag.com

Click here to learn more about the
RCC Retail CyberSecure program
 

Albuquerque, NM: ‘Operation Sticky Fingers’ Nearly three dozen people arrested in APD retail crime operation
Albuquerque Police says a recent retail crime operation lead to the recovery of thousands of dollars in merchandise and the arrest of nearly three dozen suspects. The department highlighted the results of the work at a news conference Tuesday while also promising more operations targeting the problem throughout the summer.

Calling it “Operation Sticky Fingers,” APD says teams of officers arrested 31 offenders, cleared 29 warrants and recovered nearly $7,000 in stolen merchandise in the recent sting. The operation took place the first week of May at several big box stores in the Coronado and Cottonwood shopping areas. “We’re going out, we’re interfacing directly with the stores and their loss prevention and their employees, and creating zero tolerance zones for any kind of theft that’s occurring inside those businesses while we’re there,” said APD Acting Commander Kyle Hartsock, who oversees the department’s Investigative Enhancement Division. “It’s one thing that we all know someone’s stealing, but we also wanted to better track how they’re getting to these businesses.”

Of the 31 people arrested in the recent operation, APD says 29 of those individuals were either using city buses or walking on foot to and from the target businesses. Hartsock qualified some of the suspects behavior as “very bold and brazen thefts with no real fear of enforcement.” The highest alleged theft was at a Kohl’s. APD arrested Wayne Toya, who was accused of walking out with $691.46 in merchandise. APD say Toya was compliant with police after being confronted.  krqe.com


Port St Lucie, FL: Shoplifters Caught, $15K in Stolen Merchandise Recovered
27-year-old Asia Philmore and 26-year-old Jacquilla Morris, both of South Florida, have been arrested on shoplifting charges after Port St. Lucie Police (PSLPD) recovered over $15,000 of medicine, beauty products and toiletries in the suspect’s stolen rental vehicle PSLPD Officers responded to a reported retail theft at the Walgreens on SW Prima Vista Blvd in Port St. Lucie where the pair were apprehended "in the store while still in the act," according to a release from PSLPD. The suspects had already filled up their tote bags once with stolen merchandise, and they had returned to the store for more when they were caught inside. They merchandise recovered had been stolen from multiple Walgreens and CVS locations throughout the Treasure Coast. Philmore and Morris were jailed on two counts of felony grand theft and two counts of felony retail theft.  wqcs.org


Smithfield, NC: Update: 3 sought after thefts from designer handbag store at North Carolina outlet shops
Police in Johnston County say they are looking for three women who stole items from a store in the Carolina Premium Outlets in the last week. Three photos were released of women who the Smithfield Police Department said were involved in the thefts at 1227 Outlet Center Drive in Smithfield on Monday, May 1. The women entered the Michael Kors Outlet Store and later walked out — without paying — with various “totes and other merchandise,” police said in a news release. Michael Kors describes its stores as selling “jet set luxury: designer handbags, watches, shoes, clothing.”  myfox8.com


Washington, DC: Suspects caught on camera smashing store window, stealing sunglasses; Same store hit in April for $140,000
Detectives with the Metropolitan Police Department have released surveillance video in hopes of identifying the suspects of an overnight robbery in Southwest D.C. On Friday, surveillance video shows suspects smash the window of an eyeglass store located in the 600 block of Water Street, Southwest at 3:50 a.m. Once inside the store, the suspects took property before fleeing the scene in a vehicle. The suspects and their vehicle were captured by a nearby surveillance camera. wusa9.com 


Lafayette, LA: Woman accused of ‘distraction-style’ theft at southside stores
Lafayette Police and Crime Stoppers are asking the community for help identifying a woman they say is linked to multiple cases of “distraction-style’ theft at stores on Lafayette’s southside. Police said the women, in her mid 20’s, distracts shoppers in the store by sparking up a conversation while a man reaches into the shopper’s cart and steals the wallet from the purse. The couple then leaves the store immediately, police said, and max out the victim’s credit and debit cards at local Walmart’s and Sam’s Club buying thousands of dollars’ worth of prepaid cards.  klfy.com