Cyber Defense eMagazine January 2021 Edition

However, just as online sales are at the forefront, so should cybersecurity. Retailers aren’t the only ones
looking to capitalise on the increase in online spending. Shopping seasons offer hackers an opportunity
to profit as well. We’ve already seen a huge uptick in cyber-threats due to COVID-19. Now, online
shopping provides cyber-criminals with additional motivation to launch their attacks using some of the
below tactics:
Phishing – Phishing and its variants, including spear-fishing and whaling, are email-based attacks that
leverage social engineering techniques to fool recipients into providing sensitive information to the
attacker. While spear-fishing and whaling attacks are more targeted than phishing, all three forms attempt
to get the victim to read the email, click on a link, possibly open an attachment, and ultimately disclose
valuable personal or corporate information.
Ransomware – Ransomware attacks seek to extort money from victims by encrypting access to files or
entire systems until they pay the attacker a ransom, have become increasingly popular in recent years.
Much of this has to do with the potential to make large sums of money from the ransoms. Another reason
for the rise in ransomware attacks is the availability of ransomware-as-a-service (RaaS) kits, which are
inexpensive to purchase on the black market, making it easy for novice hackers to launch their own
attacks. Phishing emails are the top threat vector to distribute ransomware.
Distributed Denial of Service (DDoS) – DDoS attacks are designed to stop a computer, server, website,
or service from operating by flooding it with internet traffic generated by an army of bots called a botnet.
The tremendous growth in Internet of Things (IoT) devices, many of which are not properly secured, has
made it easier for attackers to take control of more devices and create botnets. DDoS attacks can be
especially damaging to e-commerce businesses if customers can’t access their websites to make
purchases.
Malware – Malware attacks take many forms including viruses, worms, spam, spyware, and more. Some
malware threats such as spam are more of an annoyance, while others such as viruses and worms can
spread across a network infecting systems and negatively impacting their performance and user
productivity. Similarly, spyware can slow down systems. However, it can also be used to report sensitive
information such as passwords back to the hacker.
Injections – Injection attacks such as cross-site scripting and SQL injections are used to exploit
vulnerabilities in web applications by injecting malicious code into a program, which then interprets the
code and changes the program’s execution. In other words, it gets the application to do something
unintended such as alter the behavior of a website or expose confidential data like login credentials to
the attacker. E-commerce businesses hit with an injection attack could find their customers redirected to
a fake site which illegally harvests customer information.
The Consequences of Poor Cybersecurity
If e-commerce merchants are not prepared to stop malware, DDoS attacks, and other threats, the
consequences of a successful attack could be the difference between surviving and ceasing trading.
Here’s what businesses could be facing:
Lost Revenue – Any downtime to a web server that prevents customers from making a purchase is
damaging to online sales and can potentially have a severe impact, especially for smaller organisations.
Data Theft – The increase in online shopping during sales periods is a lure for cybercriminals to launch
attacks aimed at stealing corporate and customer data. Phishing emails claiming to have information on
fake shopping receipts, shipping status, and customer surveys are very popular in the run-up to
Christmas.
Disruption of Services – DDoS and ransomware attacks can target services that we deem essential.
E-commerce sites, public utilities, and schools are just a few examples of their victims. Shutting down
access to a service, even for a short period time, can have major financial and social impacts.
Cyber Defense eMagazine – January 2021 Edition 74
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.