Helpful resources and basic building blocks for cybersecurity

by Julia Pott

Cyber security is not just about EDR, MFA, VPN and similar technologies. Michael Linke has decades of experience in the retail sector, first as Head of IT at Globetrotter and then as Chief Information Security Officer at parent company Fenix Outdoor AB. And he warns: “Employee awareness is one of the fundamental building blocks of cyber security.”

In addition to his experiences with cybersecurity in the retail sector, which he shared in our interview, Michael Linke also provides 15 practical tips on cybersecurity. With these essential building blocks, from strategy to software development, retailers should lay the foundations for their company's cyber resilience.

1. “Even in small companies, you should appoint a person to be head of cybersecurity. This doesn't have to be a full-time position, but there should be one person who has an overview and coordinates the processes. Only then can you set priorities and start with the most important and simplest security measures, such as the password policy. You can use external service providers for many cyber security processes, but an internal specialist knows the retail company's business processes.”

2. “If larger companies have a Chief Security Information Officer (CISO), he or she should not report to the CIO, but ideally to the CEO or the management board. This is because the introduction of new technologies and the security of new technologies should be given equal priority and should not be played off against each other. Therefore, there should also be a separate cybersecurity budget that does not compete with the IT budget.”

3. “I advise retailers not to approach the topic of cybersecurity based on gut feeling alone, but to develop a cybersecurity strategy. This first involves analyzing the current situation. Here you can use various frameworks that help you to systematically check areas such as employee awareness, access management or end device security. You can then draw up a plan: We are currently at 20% for employee training, we want to reach 50% next year and 80% the year after. This allows you to develop a strategy and you can then use this as the basis for your resource and budget planning.”

4. “Employee awareness is one of the fundamental building blocks of cyber security. Without security awareness training, you are leaving your employees wide open to attack. Teach your employees to recognize even well-made phishing emails. And repeatedly carry out simulated phishing tests so that your staff learn how to react correctly. This is the only way to create a real understanding of the dangers. I recommend two strategies for motivation: there are gamification approaches where, for example, departments compete against each other to combine the whole thing with fun. It also helps to repeatedly emphasize how helpful what you have learned is in your private life.”

5. “Employee sensitization also includes the topic of shadow IT, i.e. software, apps, online services or cloud services that are purchased by employees without the knowledge of the cybersecurity team. Your workforce must understand that such products must be checked and approved by the cybersecurity department beforehand.”

6. “Retailers should set up a reporting center for cyber security incidents, a security ticketing system. It must become normal for employees to recognize and report strange events and emails. You should make this reporting process as simple as possible. These tickets must be processed and answered promptly. Feedback to employees is important to motivate them that the effort is worthwhile.”

7. “Retail companies must be prepared in the event that a cyber attack is successful. Set up a Cyber Emergency Response Team (CERT) that is informed in the event of an emergency. In addition to the cybersecurity team, this also includes people from the IT department or external service providers. Even before a cyber security incident occurs, it must be clear who will be involved and through which channels communication will take place. I recommend holding regular cybersecurity meetings with these stakeholders so that everyone is up to date on the threat situation and the security status of individual areas.”

8. “A good password policy is important! This means long passwords or passphrases with special characters and numbers. Passwords should only be changed if there is a suspicion that they have been compromised.”

9.“Use password managers. If you do not use password managers, you will end up reusing simple passwords. If one account is then cracked, all accounts are at risk.”

10. “And finally, multi-factor authentication (MFA) should be used in retail companies without exception, even at departmental and management level. If you use MFA, spied credentials alone are not enough to log into accounts.”

11. “Another important point is monitoring. Systems such as firewalls, servers and operating systems write event log files. These entries must be evaluated automatically, and there are now AI-supported programs that recognize seemingly random events as a threat scenario. This can also be outsourced to service providers, so-called 24/7 SOCs (Security Operation Centers). An active part of monitoring is penetration testing, which helps you find vulnerabilities in networks, such as old servers for which you no longer receive security updates. Only if you know about these points of attack can you do something about them.”

12. “Patch management is also crucial: retailers should ensure that they can update services – especially if they are accessible to the public or customer-facing – within 24 hours of a security update being released by the manufacturer. Known vulnerabilities are quickly detected by bots. In some cases, this information must be actively obtained from appropriate sources. This also applies to the operating systems of networked devices such as cameras, sensors or customer terminals.”

13. “Endpoint Detection and Response today consists of intelligent software that detects malware based on the behavior of applications. If applications unexpectedly encrypt data or scan networks, the EDR program identifies them and renders them harmless immediately.”

14. “Network segmentation divides networks into separate segments, making unauthorized access and the spread of malware more difficult. For example, if a retailer separates its IoT network from its IT network, hacking a camera does not directly mean access to all computers.”

15. “When retailers plan their own IT projects, they should call in security expertise. When developing software and apps such as checkout or webshop systems, the focus is often on functionality. This can lead to major security gaps. The integration of security into software development is known as DevSecOps (Development, Security and Operations): If cyber security still has to be built in after development, this becomes complex and expensive.”