E-merchants: Secure your online sales from cybersecurity threats during Christmas and beyond

The Christmas shopping season is in full swing. This year, online retailers pushed the boundaries with "Black November" in the hopes of improving their online sales, thanks to the uncertainty around in-store shopping due to COVID-19, leading many customers to make their purchases from the safety of their own homes.

As a result, e-commerce merchants have witnessed a significant uptick in users and devices connecting to websites than in recent years.

Good Cybersecurity is Crucial for Christmas Success

The good news for e-tailers is that overall sales are expected to grow this season, which is critical as many businesses rely heavily on festive shopping to meet their yearly revenue targets. This has added importance in a year when many e-commerce businesses have faced unprecedented disruption. However, one thing is clear. Online sales will take center stage. Recent survey results indicate that the majority of consumers (60 percent) plan to make purchases online this year.

However, just as online sales are at the forefront, so should cybersecurity. Retailers aren’t the only ones looking to capitalize on the increase in online spending. The shopping season offers hackers an opportunity to profit as well. We’ve already seen a huge uptick in cyber-threats due to COVID-19. Now, online Christmas shopping provides cyber-criminals with additional motivation to launch their attacks using some of the below tactics:

Phishing -- Phishing and its variants, including spearfishing and whaling, are email-based attacks that leverage social engineering techniques to fool recipients into providing sensitive information to the attacker. While spear-fishing and whaling attacks are more targeted than phishing, all three forms attempt to get the victim to read the email, click on a link, possibly open an attachment, and ultimately disclose valuable personal or corporate information.

Ransomware -- Ransomware attacks seek to extort money from victims by encrypting access to files or entire systems until they pay the attacker a ransom, have become increasingly popular in recent years. Much of this has to do with the potential to make large sums of money from the ransoms. Another reason for the rise in ransomware attacks is the availability of ransomware-as-a-service (RaaS) kits, which are inexpensive to purchase on the black market, making it easy for novice hackers to launch their own attacks. Phishing emails are the top threat vector to distribute ransomware.

Distributed Denial of Service (DDoS) -- DDoS attacks are designed to stop a computer, server, website, or service from operating by flooding it with internet traffic generated by an army of bots called a botnet. The tremendous growth in Internet of Things (IoT) devices, many of which are not properly secured, has made it easier for attackers to take control of more devices and create botnets. DDoS attacks can be especially damaging to e-commerce businesses during the Christmas season if customers can’t access their websites to make purchases.

Malware -- Malware attacks take many forms including viruses, worms, spam, spyware, and more. Some malware threats such as spam are more of an annoyance, while others such as viruses and worms can spread across a network infecting systems and negatively impacting their performance and user productivity. Similarly, spyware can slow down systems. However, it can also be used to report sensitive information such as passwords back to the hacker.

Injections -- Injection attacks such as cross-site scripting and SQL injections are used to exploit vulnerabilities in web applications by injecting malicious code into a program, which then interprets the code and changes the program’s execution. In other words, it gets the application to do something unintended such as alter the behavior of a website or expose confidential data like login credentials to the attacker. E-commerce businesses hit with an injection attack could find their customers redirected to a fake site which illegally harvests customer information.

The Consequences of Poor Cybersecurity

While these attacks occur year-round, they reach new heights during in the run-up to the Christmas shopping periods. As a result, cybersecurity takes on added importance. If e-commerce merchants are not prepared to stop malware, DDoS attacks, and other threats, the consequences of a successful attack could be the difference between surviving and ceasing trading. Here’s what businesses could be facing:

Lost Revenue -- Any downtime to a web server that prevents customers from making a purchase is damaging to online sales and can potentially have a severe impact, especially for smaller organizations.

Data Theft -- The increase in online shopping during the Christmas and the succeeding sales period is a lure for cybercriminals to launch attacks aimed at stealing corporate and customer data. Phishing emails claiming to have information on fake shopping receipts, shipping status, and customer surveys are very popular in the run-up to Christmas.

Disruption of Services -- DDoS and ransomware attacks can target services that we deem essential. E-commerce sites, public utilities, and schools are just a few examples of their victims. Shutting down access to a service, even for a short period time, can have major financial and social impacts.

Damaged Reputation -- Damage can extend beyond short-term financial losses and data theft. Consumer confidence and brand reputation can quickly erode when consumers have a poor online experience. Customers aren’t shy about using social media to express their displeasure.

Reduced Productivity -- It’s not just customers who feel the impact of a successful attack. If employees can’t access the applications they need to do their jobs, expect to see a drop in productivity with an accompanying rise in undesirable workarounds.

Steps to Take for Christmas and Beyond

Cybersecurity isn’t just something to think about during Christmas. It’s an everyday concern. Fortunately, there are some things that organizations can do to keep applications, networks, and the business safe from threats, especially during peak online shopping periods.

First, look for a solution that provides DDoS detection and mitigation to ensure services are continually available to legitimate users. Hackers have learned how to weaponize IoT devices to launch complex multi-vector and volumetric attacks, capable of bringing down application servers and entire networks.

Second, protect web-based applications with web application firewall (WAF) technology. Outdated applications are especially vulnerable to attacks. A WAF will secure them from hackers looking to exploit HTTP and web application-based flaws.

Third, find solutions that meet current and future platform needs. Organizations may not have transitioned to the cloud yet, but they’ll likely have some cloud-based apps. They must be sure their solution is ready when the company is ready, whether it is moving to a hybrid cloud or multi-cloud infrastructure. And finally, continue to educate employees on the need for good cyber hygiene. According to a 2019 IBM study, 95 percent of cybersecurity breaches are caused by human error.

With this shift to online a potentially permanent one, e-commerce merchants should expect these sustained levels of activity going forward, not only during Christmas. Therefore, it’s imperative that e-commerce businesses secure applications, servers, and networks from cyber threats at all times.

Anthony Webb is EMEA Vice President, A10 Networks