The steadily increasing frequency of data breach occurrences in 2014 has been both astounding and worrisome. From Target and Neiman Marcus to Michaels, Chick-fil-A, and Home Depot, fraudsters are leaving no stone unturned, causing the millions of customers unlucky enough to use infected point of sale (POS) machines at these retailers to worry about whether their sensitive information has fallen into the wrong hands.
While retail IT organizations are keenly aware of the problem, they are often not so clear on the solution. Granted, though fraud-prevention solutions such as chip-and-PIN can help reduce the possibility that a customer’s stolen information is useable to a hacker, this is not a failsafe approach and will not prevent an attack in the first place. The vast majority of brick-and-mortar retail attacks are the result of malware being installed on POS terminals, relaying customer data directly to hackers upon a scan. That said, the real problem lies in the endpoint (POS), and once a particularly malicious malware, such as Backoff, takes hold, it is able to proliferate across other POS endpoints on the same network, creating one giant collection facility for hackers that provides customer credit and debit information.
Free Cyber Security Training! Join the revolution today!
The situation may sound dire, but there are approaches that retail IT teams can take to protect both their, and their customers’ sensitive data assets. For example, because malware infects the POS machines and then proliferates to other machines on the same network, implementing a next-generation network security solution capable of continuous monitoring and automatic remediation can help stop an attack before it gains a foothold in a retailer’s system.
One important thing to note here is that many legacy network access control (NAC) solutions aren’t continuously monitoring for endpoint changes, especially after the endpoint successfully connects to the network. The continuous monitoring piece is an imperative, as it allows IT to spot a change to an endpoint as it occurs, which is in contrast to periodic scans conducted at specific times that may miss a critical endpoint breach until it is too late to contain. Therefore, a strong security solution capable of continuous monitoring combined with a set of strong security policies to automate remediation allows for the immediate isolation of an offending POS machine from the rest of the network. This allows IT to take all necessary steps to eliminate the malware once removed from the mix.
Next-generation NAC solutions are one place to start looking at solving these issues.
By Sandeep Kumar, Principal Solution Marketing Manager, ForeScout
Bio: Sandeep Kumar is principal solution marketing manager, ForeScout, with 20 years of experience in IT security and enterprise products and services. He has previously held senior positions in product marketing, product management and engineering at several enterprise technology companies including Symantec. He holds an MS and bachelor’s degree in computer science. More than 1,800 of the largest enterprises and government organizations in more than 62 countries use ForeScout’s next-gen network access control for continuous monitoring and mitigation of network threats. The company, located in Campbell, Calif., is a leader in Gartner’s network access control Magic Quadrant.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.