Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

11/19/2018
11:30 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

7 Holiday Security Tips for Retailers

It's the most wonderful time of the year - and hackers are ready to pounce. Here's how to prevent them from wreaking holiday havoc.
3 of 8

2. Don't Get Fooled by a Decoy Attack
Retailers should learn from the 2011 attack on Sony, when its PlayStation network was hit with a distributed denial-of-service (DDoS) attack, Sophos' Wisniewski advises. In response, Sony focused the bulk of its resources on the DDoS attack while the hackers gained access to the personal details of millions of customers. Also, keep in mind that hackers will prey on retailers during the holidays, knowing they could be working with skeletal staffs. Retailers shouldn't scrimp on tech staff during this period: They might need one part of their team to focus on a DDoS while the other looks into whether a broader breach has occurred.
Image Source: Pixabay

2. Don't Get Fooled by a Decoy Attack

Retailers should learn from the 2011 attack on Sony, when its PlayStation network was hit with a distributed denial-of-service (DDoS) attack, Sophos' Wisniewski advises. In response, Sony focused the bulk of its resources on the DDoS attack while the hackers gained access to the personal details of millions of customers. Also, keep in mind that hackers will prey on retailers during the holidays, knowing they could be working with skeletal staffs. Retailers shouldn't scrimp on tech staff during this period: They might need one part of their team to focus on a DDoS while the other looks into whether a broader breach has occurred.

Image Source: Pixabay

3 of 8
Comment  | 
Print  | 
Comments
Threaded  |  Newest First  |  Oldest First
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
12/22/2018 | 12:53:41 AM
Brand versus no brand
I don't know why people would go to a website that wasn't guaranteed to be a legitimate one, even over the holiday periods. I mean, I can get cheap China knock-offs, but if things are already on sale at a reputable branded place, that's what getting a good deal is about right?
PaulChau
50%
50%
PaulChau,
User Rank: Strategist
12/27/2018 | 9:14:02 AM
Security lax
It is important to note that if we have not been hit before by online attacks, that does not mean that we will never get hit. It is important to still implement these security tips and guidelines if we want our business to prevail even after the holidays. It might just be too late if we think that we are safe and there is no lax in our systems.
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
CVE-2021-32553
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
CVE-2021-32554
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.