Why retail companies should protect themselves against cyberattacks – and how

by Julia Pott

Retail companies today work with many digital processes and highly sensitive data along the entire supply chain. This makes them particularly vulnerable to cyber threats. This is one of the reasons why cyber security expert Michael Linke, who has decades of experience in the retail sector, urgently advises retailers to build cyber resilience. In this interview, he tells us what he himself has learned as a CISO and what cybersecurity trends he is observing.

Mr. Linke, why is it essential for companies and retailers to address the issue of cybersecurity?

Michael Linke: It may be a hackneyed phrase, but it's true: it's not a question of whether your company will be attacked, but when. Or to put it even more pointedly: Your company has already been attacked, you just don't know it!

Because as an attacker, I don't need to be an expert in hacking these days. Everything I need is available on the Darknet. For example, there are web stores where you can buy access to company networks via Trojans; as soon as you pay, the Trojan becomes active. Phishing emails are offered there as a service, as are online store accounts from which you can order goods on account. Cyber criminals are still associated with the cliché image of the young IT nerd in a hoodie playing video games in his parents' basement and practising hacking on the side. But these criminal enterprises are highly organized – with departments for development, marketing, finance and customer support – and earn enormous sums of money, which makes them very dangerous.

How well prepared is the German retail landscape for these threats when it comes to cyber security?

Linke: From my own experience, I would say that many companies are not well positioned in terms of cybersecurity, they tend to treat the topic rather neglectfully. Often, someone from the IT department or an IT service provider takes over on the side. However, there is no one who is officially responsible, has the necessary qualifications or has a real overview. The BSI also confirms that small and medium-sized enterprises in particular are often poorly positioned.

In my experience, one of the reasons for this is that companies consider themselves too small or too unimportant to be attractive to attackers. But these companies fail to recognize how cyber attacks work today: Attackers are not specifically looking for large, valuable companies or data, but for vulnerabilities in general.

Another decisive factor is that cybersecurity is not part of the retailer's core business, which means that business processes such as purchasing, sales and financial transactions take priority. Cybersecurity is often seen as an additional cost without a direct return on security investment. However, it is a way of preparing for an increasingly probable emergency.

In addition, important systems such as web stores, ERP systems, cash register systems or payment terminals are generally not designed to be redundant. This means that an attack can paralyze the entire business.

And finally, there are many evolved IT landscapes in the retail sector, with companies often operating a mix of old legacy systems and newer cloud services. Securing this diversity is a real challenge.

What advice would you give to SME retail companies that have a smaller budget for cyber security or hardly any existing structures?

Linke: The first step must be to appoint someone internally as the person responsible. After that, I would advise you to consult an expert. It is worth investing in a one-off professional consultation to review the most important security aspects. This allows you to identify weak points, develop a strategy and create a prioritised list. As a business owner, it is crucial to be informed in order to make informed decisions. Don't be discouraged: even if you can't make big leaps with your resources, start with small steps, for example with a secure password policy and a password manager.

Are there specific threats that the retail sector in particular is facing?

Linke: There are many areas of attack in the retail sector because retailers are present on multiple platforms.

The software for online shops should be constantly tested and updated, as the focus is often on the functionality and user experience of the online shop. However, it is important that the online shop is secure, otherwise an item costing €1,000 could suddenly only cost €10 as a result of an attack. Developers sometimes overlook such details.

Physical shops are networked with their checkout and ERP systems. There is increasing online real-time communication between online shops, shops and warehouses, for example to ensure product availability. This offers opportunities for attack.

And nowadays, the Internet of Things is of course an essential topic in connected stores, whether it's cameras, sensors, screens, access control systems or intelligent systems for building and energy management. Anything with an IP address can be a potential point of attack.

Added to this is communication in the supply chain, which involves many parties such as manufacturers, suppliers and delivery companies. As a retailer, I only have limited influence over the IT security measures that these supply chain partners take. Without an assessment, I cannot find out how secure their systems or customer data are.

What trends do you expect to see in cyber security over the next few years? And what role will AI play in this?

Linke: Artificial intelligence is definitely a game changer in the field of cybersecurity. On the one hand, AI supports attackers, for example in optimising phishing emails so that they are optimally formulated and designed. On the other hand, AI also improves attack detection.

Blockchain is another keyword: blockchain technology is still mainly used by cryptocurrencies. However, it is becoming increasingly important that data cannot be falsified.

And finally, we are seeing rapid development in the area of access management and authentication. Conventional methods with user names and passwords are very vulnerable. The use of passkeys and biometric data is a step forward. There are also new methods that make it almost impossible to spy on access data because the data is useless on unauthorised devices. There are also password managers that work without a master password but with smartphone authentication. And finally, a zero-trust architecture offers more security: until now, users who were in the network, i.e. behind the firewall, were classified as trustworthy. With the Zero Trust Security model, every access attempt must first be authorised.

What lessons can you pass on from your time at Globetrotter and Fenix Outdoor AB?

Linke: I was responsible for IT as CIO at Globetrotter for a long time and was already involved with cybersecurity back then. When Fenix Outdoor took over the company, I was appointed CISO.

As it soon turned out, it was very important that everything to do with IT and cyber security passed through my desk. To give just one example: Phones from a Chinese manufacturer were purchased for some branches in the USA. However, I was aware that these devices were transmitting data to China, i.e. enabling espionage, so the phones had to be replaced immediately. This also applies to the installation of software or the use of cloud services: without prior security checks, this creates major security risks.

In any case, a cybersecurity policy that is enforced throughout the company and regular employee education – so-called security awareness training – are essential in order to create an awareness of threats and the necessary security processes.

In general, I can say that support from the management is extremely important in order to obtain the necessary resources and be able to implement measures. Senior management must understand that these investments in cyber security are worthwhile, because: How much does it cost in comparison if the web shop is down for a day or entire areas of the company are shut down for a week because a hacker attack was successful?