Cyber-Thieves Targeting Smaller RetailersBy Evan Schuman | Posted 2006-10-02 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
As large e-commerce sites pour millions of dollars into security and enterprise-league hardened POS systems, cyber-crooks have been giving more attention to much smaller and less well-protected merchants.As the established large e-commerce sites pour millions of dollars into security and enterprise-league hardened point-of-sale systems, cyber-crooks have been giving more attention to much smaller and less well-protected merchants.
Those smaller merchants can't even necessarily protect themselves by opting to not have a Web site, as the thieves are grabbing credit card information as it's transmitted over the Internet to POS servers.
"In general, the smaller retailers, whether they're operating e-commerce sites or physical stores, don't have the resources to think about security," said Gartner Group retail security analyst Avivah Litan.
The goal of the thieves is typically not to use the data to create bogus credit cards as much as it is to collect a large number of numbers and authentication codes and to sell that collection of data to support fraudulent e-commerce purchases or to purchase stored-value cards and use those to make brick-and-mortar purchases.
Gartner's Litan said some global cyber-crooks have gotten fairly sophisticated in selecting their victims. "I was told by a forensics analyst that there are some thieves in Vietnam who have figured out which point-of-sale cash registers are vulnerable," she said. "They go to the manufacturer's Web site, find out who the big customers are, and they may even find out small customers. They then go attack those terminals. They may not even know how vulnerable they are. For example, they may not have an e-commerce site, but they may use a terminal program that the vendor maintains through an Internet protocol."
This trend has started to impact consumer e-commerce purchasing habits, as consumers tell surveys that they are much more comfortable buying from larger e-commerce because they feel safer doing so. The dream of every large retail marketing execwho initially feared those startups undercutting their priceis being realized.
Not that the feds aren't doing as good a job as could be expected against cyber-crime, with a recent major Secret Service probe a good example of the kinds of techniques today's law enforcement agent is using.
Much of the problem, though, resides with software vendors pushing POS options for smaller retailers. Greg Buzek, president of the IHL Consulting Group, estimates that there are some 2,000 POS vendors pushing products for the small-retail market, which is a dramatically larger number than that service the world's largest retail chains' POS needs.
In Buzek's opinion, the biggest cause of the security weakness for smaller retailers "is bad software."
Another belief is that smaller retailers do not always rigidly abide by accepted security rules, such as the PCI rules forbidding the retention of key credit card information. Many retailers disobey that rule so that they can more easily handle product returns, where the customer will want the credit applied to the credit card that was used, he said.
But many smaller retailers also don't fully understand what their POS software can and cannot do, which is what the cyber-thieves are counting on.
Also at fault are security auditors and consultants who tell smaller sitesafter an auditthat they're safe when they're not.
Buzek and Litan discussed the small retailer security situation with analysts from Forrester, the Lakewest Group and the Retail Systems Alert Group recently during a Web audiocast.
Retail Center Editor Evan Schuman can be reached at Evan_Schuman@ziffdavis.com.
Check out eWEEK.com's for the latest news, views and analysis on technology's impact on retail.