IoT is transforming the retail sector from driving purchase decisions of customers through actionable insights, improving supply chain output with connected edge devices, and delivering an exceptional shopper experience on the store floor. IoT offers retailers opportunities for the growth of an ecosystem that connects the physical and digital world. The number of retail connected devices including security cameras, kiosks, and sensors, has grown exponentially. As per a recent Gartner report, there are around 5.8 billion connected objects worldwide in 2020. In the retail segment, there are 440 million connected endpoints.

IoT offers retailers openings in the areas including customer experience, the supply chain, and new channels and revenue streams. Amongst many things, IoT innovations made possible a world where retailers turn out robotic sales assistants, RFID tags for monitoring goods, use smart sensors, and inventory management using smart shelves.

Due to the interconnectivity of this wide range of smart devices, the retail industry domain is facing various issues related to security and privacy. Networking and sensing capabilities in any physical device are making them prone to the latest cyber-attacks and the privacy of users is at stake. For instance, take an example of Amazon’s checkout free store, huge measures of client information, their card data, item inclinations, and even what they resemble should be gathered and put away by IoT sensors. A break of that information can potentially affect both Amazon and its clients.

Let us explore challenges that an advanced retailer should know about and the potential arrangements to cope up with it.

Security Vulnerabilities of Retail IoT

The security vulnerabilities of retail IoT can be broadly divided into two classes; edge connected device challenges and software security challenges. The edge connected device threats arise due to the ubiquitous and heterogeneous nature of IoT devices, while the software security threats are related to the functionalities and the principles that should be enforced to attain a secure network. Edge connected device vulnerabilities are typically related to wireless technologies, Bluetooth technologies while software security challenges require the ability to ensure security by integrity, authentication, end-to-end security, confidentiality, etc.

POS Security Vulnerabilities

The reason why POS systems have a major threat is that of the unencrypted data. These systems gather info for hundreds of transactions every single day, creating it a veritable gold mine for attackers. These systems are additionally exposed to malware on account of the actual nature of what they are utilized for.

Through the complete payment, process data is exposed several times, making it vulnerable to new and advanced threats. For instance, American retailer, Target experienced POS breaches where 41 million customer payment card and contact information for more than 60 million Target customers were affected.

Securing POS system from cyberattacks

With regular vulnerability scanning, implementing security patches and encrypting end-to-end POS data, retailers can identify devices on the network and enforce policies to secure the system.

Cloud based Applications Threats

Cloud-connected kiosks, endless aisles, digital signage have become additional targets and a potential platform for cyber hackers to attack. System integrity, availability, and confidentiality are the three principal forms of threats.

A recent example is of the Avanti Markets, a self-service food vending company within America that suffers a furtive attack whereby the payment card details and even biometric data gathered from users at kiosks could have jeopardized.

How to secure Cloud based Applications Threats

Retailers must embrace the idea of continuous monitoring of the network for any suspicious activity. Protecting cloud infrastructure with SSL/TLS at every stage of the retailer’s cloud journey is important in the event of cloud application threats. With that the proper access controls for configuration and device identity using Trusted Platform Module are important.

Retailers can also incorporate centralize visibility and access control over different cloud conditions by deploying cloud access security and cloud workload protection applications.

Web Application Attacks

In this domain, threats are targeted on various IoT based web applications. These attacks arise due to insecure applications, mobile, or desktop based. Depending on the type of attack, attackers attempt to gain access to sensitive customer information databases or injecting malicious code to trick users out of sensitive information. The majority of the cyber-threats targeting retailers are web application attacks. For instance:

• Cross-site scripting (XSS) attacks.
• Command injection.
• Cookie poisoning.

Security Resolution for web application attacks

Usage of a Wireless Intrusion Prevention System (WIPS), web security software testing, mobile application security testing, and use of advanced security on gateways and firewalls are some simple measures that can help to make strong network security. With the help of security tastings, retailers can identify internal threats based upon user and entity behavior analytics (UEBA) and the use of false targets planned to tempt attackers.

DDoS Attacks

A DDoS vulnerability is an attempt to make online services inaccessible by overwhelming it with traffic from different sources. Attackers form networks of infected PCs, (‘botnets’), by spreading malicious software threats through websites messages, emails, and social media.

As per Verizon’s Data Breach Investigations Report (DBIR), DDoS vulnerabilities are the most well-known type of attack inside the retail business. With the expanding number of retailers sending IoT items to modernize a wide scope of tasks, from vehicle tracking to inventory management, the dangers of such threats have fundamentally gone up.

Improper use of IoT protocols may lead to communication based threats. (DDoS) is a potential threat, which may affect data and information security in the retail industry.

Managing DDoS Attacks

Implementing application layer security testing and Zed Attack Proxy help retailers to combat a potential DDoS attack by providing high accessibility and business continuity. Another choice is to set up a cloud-based anti-DDoS solution so that any type of malicious traffic can be diverted.

More Threats in the Digital Retail Environment

• Bluetooth-enabled barcode scanners: Cyber-attackers can hack these devices through Bluetooth-related vulnerabilities to modify the pricing of items or perform a large attack for customer information.
• Printers connected to Wi-Fi: Open hotspot printer can enable hackers to circumvent web access control and gain access to your data.
• Production-line sensors: Automated controls and smart sensors in warehouses can be compromised causing the delay in delivery.

Conclusion

It is necessary for organizations to consistently check the IT infrastructure for malware, vulnerabilities, viruses, and misconfigurations at both the system and application level. Other than these techniques, retailers must ensure that proper access controls for configuration and device identity using the trusted platform module. With cyber criminals adopting more updated approaches, the retailer must concentrate on the above perspectives to meet the cybersecurity problems. The precise potential of IoT occurs only when it is secure.

eInfochips enables the IoT revolution by giving cybersecurity services. We help clients in the evaluation, and improvement of their IoT device security with threat modelling, security design implementation, and vulnerability management. The retail industry may simply be starting with IoT, but with eInfochips’ Cyber Security Solution, you can remain secure and protected at the same time.

For more information please contact us today.