Total Security Advisor
Practical Security Tips, News & Advice.
Updated: Nov 21, 2022
For the retail, hospitality, and travel community, the holiday season is the most intense time of year for persistent threats. From the beginning of October through the end of December, attempted cyberattacks expand in both scale and magnitude to match the rise in consumer traffic.
To help provide cybersecurity professionals in consumer-facing businesses with information on the holiday threat landscape, the Retail & Hospitality ISAC has developed a 2022 Holiday Season Threat Trends Summary report, which compares data from previous holiday seasons with information member companies and our Associate Member partner, Flashpoint, are currently seeing so far this year.
Here are some of the key findings from that report:
Fraud Is a Top Concern this Holiday Season
Phishing and Credential Harvesting Are on the Rise
Credential harvesting is among the most prevalent and long-term consistent attack trends reported by the RH-ISAC community, frequently rating as the most common threat on a weekly basis. In 2021, credential harvesting indicators made up 17% of the IOCs shared during the holiday season, up from 13% in 2020. RH-ISAC analysts expect credential harvesting to remain a top threat this year as well, with members reporting an increase in targeted phishing attempts, including phishing messages from individuals posing as company executives.
Cyber threat intelligence platform Flashpoint has conducted research as well, confirming this trend, identifying phishing as the most popular hacking service advertised within illicit communities this year. These phishing services can come in the form of bespoke scam pages, SMS phishing (smishing), and emails with malicious attachments. Traditionally, during the holiday shopping season, these phishing messages have taken the form of fake coupons or discount codes.
Ransomware Remains a Threat for the Retail Industry
Financially motivated actors target retailers for ransomware attacks during the holidays knowing the impact that operational downtime could have on a retailer’s profitability during the most lucrative time of year. During last year’s holiday shopping season, between October and January, Flashpoint identified a total of 20 leaks originating from retail organizations.
Based on this trend, it is likely that retailers will experience an increased threat of ransomware attacks during the upcoming holiday season as well. Ransomware gangs and affiliates will be targeting retailers assuming that their victims will be more apt to pay a ransom to minimize downtime and to keep their names off leak sites. The impact of ransomware attacks could negatively affect overall profitability, whether it be due to operational downtime or a damaged brand reputation.
Already in 2022, U.S.-based retail entities are the most heavily targeted industry, based on Flashpoint reporting of advertisements for data and access within illicit communities.
Access to Threat Intelligence Feeds Provide a Competitive Advantage
When it comes to hardening their defenses against these attacks, the retail and hospitality industry reported multiple tools and practices that provided a competitive advantage. Most frequently mentioned was access to threat intelligence, whether through CTI feeds, the dark web, or other threat intel sources. Members of the RH-ISAC community highlighted their access to community resources and sharing platforms, as well as their access to RH-ISAC threat intelligence, as competitive advantages in their holiday season prep.
Suzie Squier is the president of the Retail & Hospitality ISAC (RH-ISAC). She has been connected to the ISAC since its inception and is responsible for the overall management and growth of the organization. Prior to joining the RH-ISAC, Squier was executive vice president of member services for the Retail Industry Leaders Association. She is a graduate of the University of Maryland.
Download this free report to learn seven steps to protect your facility from workplace violence.
This report is sponsored by the Total Security Summit, an event specifically organized for VPs, Directors, and Managers of Security who are directly concerned with their facility’s security and safety operations.
The Security Industry Association (SIA) announced a major milestone in its SIA OSDP Verified initiative – that over 100 device models have been named OSDP Verified through the comprehensive program, which validates device conformance to the SIA Open Supervised Device Protocol (OSDP) standard. SIA OSDP standard is an access control communications protocol standard maintained by SIA to improve interoperability, add […]
GXO Logistics, Inc., the world’s largest pure-play contract logistics provider, announced that it has deployed advanced air and ground security robotics at one of its major distribution centers in Clayton, Ind., and plans to significantly increase deployment of automated security systems across other sites within the next year. This would be the largest air and […]
The Security Industry Association (SIA) is pleased to announce the first members of its Utilities Advisory Board Steering Committee. SIA created the Utilities Advisory Board to offer insight and education to security practitioners, members of the security industry and other stakeholders about emerging security trends, regulatory compliance issues, and recommended practices for protecting utility infrastructure. The steering committee members, […]
SILVER SPRING, Md. – The Security Industry Association (SIA) has named Alice DiSanto the 2022 recipient of the SIA Committee Chair of the Year Award, which recognizes individuals for excellence in leading SIA committees and advancing member objectives. SIA will present DiSanto with the award at The Advance, SIA’s annual membership meeting, which will be held March 22 during […]
ISC West, in collaboration with premier sponsor Security Industry Association (SIA), continues to experience steady growth for the upcoming event, and will be taking place just less than two months away on March 22-25, 2022 at the Venetian Expo in Las Vegas (SIA Education@ISC: March 22-24 | Exhibit Hall: March 23-25). After initial reports of […]
Our world is full of threats both external and internal. This whitepaper encourages looking at life safety and security measures on your campus from another perspective. Most facilities have addressed access control and the securing of main doors, but those should be measures of last resort. There are steps you can take — some that you may not have considered — to mitigate the threat before it arrives at your front door.
The 2019 Total Security Salary Guide is here to help physical and technical security employers and employees understand where they stand in today’s security job market. This Salary Guide includes not only salary and wage data from 2017 to 2018, but also certification information as it applies to 20 benchmarked exempt and nonexempt security positions.
A proliferation of cameras has resulted in an overwhelming amount of video available to security operators, analysts and investigators. Technology that used to be prohibitively priced, is now cheap and readily accessible.
Learn how to protect your people, assets and physical spaces better with AI-powered solutions that deliver whole-building security.
