No Rest for the Phish

Bitdefender breaks down the threats a small retailer faces, suggesting remedies for each one. These include awareness and education, good password hygiene, and adopting whatever technology you can afford. The attacks can roughly be categorized under:

• Phishing—64% of these attacks originate with phishing emails. However, phishing links abound also in push notifications, messaging, social media, and more. Ascertain the sender’s identity and, instead of blindly clicking, copy and paste the link manually, checking the URL to make sure it makes sense and is what it purports to be before clicking enter. Unfortunately, there’s not much more one can do here besides staff, supplier, and client education. If using a mobile device, install novoShield on your iPhones and those of your suppliers and employees to prevent phishing pages from opening on Safari.

• Spam—An offshoot of the above, since it often contains a phishing link. With personal details, such as emails and more being sold for pennies on the dark web, you can be sure that you’re on someone’s mailing list somewhere, and that the mailing list has been accessed by countless others. This is a numbers game: spammers send out mountains of emails in hopes of a bite. The pile that accrues in your mailbox can only be partially mitigated by filters, since, here too, we have a game of catchup between spammers and filter makers. Try not to be overwhelmed.

• Credit card fraud—The culprit for over $24B loss each year, most identity theft is aimed at stealing credit card information. Here, you have to pray that your bank’s API is secure and well-maintained. Again, we can do the bare minimum and make sure we don’t provide personal or account details to a phishing page. Never enter your bank’s site through a link. Never provide your details to a retailer, shipper or any other member of the supply chain except directly through their site, which you access manually.

• Malware, DDoS (Distributed Denial of Service) attacks & Ransomware—Since these embed themselves in a system, only a professional can identify and mitigate such attacks. How the malware enters the system is a different story, especially since most small businesses using cloud infrastructures may find that their service provider is the guilty party in enabling the attack. Once again, prevention is half the remedy, so choose your provider carefully, and make sure your data is backed up in an independent location against theft. More importantly, don’t be the intruder’s gateway by providing your access data nto a phishing site.

Again, unfortunately, institutional response is lacking, since national institutions have been slow in the uptake against a threat that is global in both attack surface and instigator source. Regulators cannot even agree upon a definition of ‘cybercrime’, and international cooperation is in its infancy against an enemy that is spread far and wide. Small-time operators in undeveloped countries, themselves thirsty for tax income regardless of the contributor’s profession, are often employed by crime syndicates in a third country or even by rogue states. However, some countries do present viable solutions from which one may take instruction.