As the pervasive shadow of Covid-19 recedes and slowly becomes a memory, many of the technologies and protocols we developed during that time remain. Global eCommerce retail sales have always experienced an annual incline. However, these figures have been boosted as more consumers have adopted online shopping and abandoned traditional brick-and-mortar stores.
With more shoppers online, cybercriminals are sure to become bolder and more opportunistic too. While consumers must practice proper cyber hygiene and protect themselves on the internet, eCommerce store owners are also responsible for ensuring that shoppers’ private information stays safe.
But how? What steps should you take to protect your customers during the holiday shopping season? This guide will share six cybersecurity tips you can implement starting now.
Why Is Cybersecurity Crucial for the Shopping Season?
A 2021 Verizon report revealed that 46% of all cyber breaches impacted small businesses. Due to the high cost of a breach in the form of fines and damage to their reputation, many of these businesses are now facing bankruptcy.
However, the most alarming statistic is that over a quarter of small businesses collecting credit card information have subpar cybersecurity or no security at all. With cyberattacks forecasted to spike during this holiday shopping season, eCommerce store owners must pay attention to their cybersecurity measures as much as they do to their marketing campaigns. But what should you look out for?
Most Common Cyberattacks Affecting eCommerce Businesses
The most popular exploits today include:
- Account takeover (ATO): Cybercriminals use stolen usernames and passwords to take over accounts. For eCommerce stores and businesses, this could be employee or administrative credentials to log into servers or client machines. Once the bad actor breaches the company’s network, they can gain access to the databases where confidential customer information is kept. They can then steal this information, sell it to the highest bidder or use it for nefarious purposes.
- Gift card and wallet fraud: There are numerous ways cybercriminals and fraudsters can initiate these types of exploits. They can hack into a company’s gift card database and scrape card and activation numbers. Alternatively, they can tamper with physical gift cards or attempt to use gift card number generators. Your business must be mindful of this potential entry point.
- Inventory exhaustion: Some online stores remove the item from the available inventory when customers add it to their shopping cart. This reserves the item for them, so it’s still available when they finally check out. Cybercriminals can use bots to initiate a hoarding attack. A bot will constantly add items to a shopping cart to create the illusion that it is out of stock. This denies the sale of the item for petty purposes or so that the bad actor can purchase it themselves when they can afford to.
- Bandwidth choking (DDoS attacks): Distributed denial-of-service (DDoS) attacks are one of the oldest tricks in the book. This is where a bad actor floods a website or web service with network traffic to overload and crash it, although it can happen to small online stores too.
- Content scraping: Cyberattackers may use bots to extract or copy all of your website’s content that they can use maliciously. For instance, they can duplicate your website and divert organic traffic from it, then use your website’s clone to steal information from your customers.
Cybersecurity Tips To Protect Your eCommerce Customers
So how can you protect your company and customers from the above attacks this coming holiday season?
1. Enforce Strong, Unique User Passwords
Many eCommerce stores require users to create accounts before they can make purchases. A 2021 GoodFirms survey found that 30% of breaches could be traced back to weak password policies and practices. Generally, the less complex a password is, the more susceptible it is to brute-force attacks. Your business must enforce strong password policies both internally (employees and administrators) and externally (customer profiles).
Here are a few characteristics of a strong password:
- Unique and different from your other login credentials
- Uses a mixture of uppercase and lowercase letters, symbols, and numbers
- At least eight characters long
- Does not contain any personal information, such as dates of birth or names of relatives/pets
Using strong passwords is one of the most important cybersecurity tips, and it’s critical that your business enforces this policy. It is also recommended that users (both your customers and employees) utilize a password manager.
2. Establish Cybersecurity Policies
Good cybersecurity awareness can thwart most exploits initiated by bad actors. Being able to identify fraudulent links and other phishing exploits is more valuable than trying to find a software solution that addresses all your cybersecurity concerns.
You and your employees must be updated on the latest cybersecurity practices and protocols. Consider hiring an expert who can walk you through the best practices. Your cybersecurity policies should be informed by the data privacy rules and regulations of the territories your business operates in. For instance, if you’re operating in the EU, you must be educated on the GDPR. If you’re operating within California, you should understand the rules of the California Consumer Privacy Act.
Any business that deals with payment information and credit cards must ensure that it is PCI-DSS compliant. The official PCI security standards council site has a list of guidelines to help companies keep confidential customer data as safe as possible.
3. Implement Additional Authentication
Concepts such as two-factor and multi-factor authentication have become extremely popular in recent years. Multi-factor authentication means implementing an additional form of authentication in addition to your user credentials. For example, after entering a username and password, you may choose to verify the login attempt through an email link or one-time code sent to a user’s phone.
4. Only Store Customer Data That You Need
Guidelines and regulations such as the GDPR don’t specify a time limit for how long you can keep a customer’s personal information. However, it’s important that you only store data that you need to provide services to the customer for as long as you need it.
It’s also important that you segment databases and data according to their importance. Credit card and payment information should be kept separate from general customer information and your business information. All data must be placed in secure encrypted databases.
5. Employ a DDoS Mitigation Solution
DDoS and other bot-related attacks can be mitigated through the right solution. However, you should first ensure that you have a disaster recovery site in place. If your attacker manages to shut your site down, you can roll the traffic over to a recovery site. Of course, this doesn’t always work, especially if the attack is DNS based.
Alternatively, you can purchase a dedicated server to prevent DDoS and bot attacks. Sometimes, your ISP or cloud provider may offer integrated DDoS protection. Do not hesitate to add this feature to the list of services. While bot-mitigating solutions such as CAPTCHA have been shown to decrease conversion rates, they’ve been proven to be somewhat effective against spam and bot attacks.
That said, cybercriminals have begun using more sophisticated tactics, such as machine learning to circumvent CAPTCHA checks. With cloud-based platforms and integrated memory systems being the driving force of machine learning adoption, more cybercriminals will have access to these tools.
As such, it’s important to implement a multi-channel mitigation solution. For instance, your mitigation solution should be able to detect any suspicious traffic coming from a visitor’s IP address. It should also be able to track any questionable customer activity, such as adding items to carts but not checking out.
6. Conduct Regular Software Audits
Your business should be employing all the necessary software tools to facilitate proper cybersecurity, including anti-malware solutions, firewalls, user account management tools, etc. You can hire a zero trust expert to help determine what software will suit your network infrastructure the best.
You also need to monitor your software stack and ensure that your operating systems, productivity/business software and cybersecurity software are all updated to the latest versions. This process can be made easier with cloud panels and workload automation software.
Conclusion
Many of the cybersecurity tips listed in this guide should be implemented regardless of the upcoming holiday shopping season. Nevertheless, your website and servers must be able to handle the usage influxes and traffic spikes that will be brought on by the holiday shopping season. One of the best ways to ensure holiday sales are not interrupted is to have multiple recovery sites to mitigate any downtime.
Next, your company must ensure that it’s up to date on the latest cybersecurity and network protection developments. You can only protect your customers if you protect yourself first.
