Retailer Holiday Cybersecurity – Lynn Marks, Imperva

This is Textron tv. Well, I have a great pleasure of talking with Lynn Marks. Lynn has been on with us before.

TA and Lynn is a senior product manager with Imperva. Good to be chatting with you again. Thanks for having me.

Well, very timely topic. You know, the, uh, it seems like, uh, summer, uh, vacations just happened and now we're talking holidays, right? It just landed so quickly this year.

I'm not quite sure. I guess it happens every year, but, you know, poof. November's here December, we'll be honest, before we know it.

Um, you know, that always brings a lot of, to certain industries, certain segments, especially retail, both online, in person, you know, brick and mortar or combinations above, you know, delivery of, you know, inventory or delivery of, of goods and services to customers. I have to imagine all of that's on your radar, radar, big time with you and your customers. Definitely the end of year is, I mean, a big time for many different organizations, and especially like you mentioned, the retail industry where they oftentimes do have, let's say, limited edition, uh, releases for products or maybe some bigger on sales or just fun deals for the, the holiday season.

So that's definitely something that, um, we've been talking about with our customers and also have some great, uh, data and insights to share with you. All. Good.

Love to hear it and love to hear sort of, you know, the kinds of attacks, things people are doing, the tax surfaces they're going after. You know, those things continue to evolve and change, and the old stuff's still there. Probably automated attacks are still happening.

What are some of the kind of new areas or new trends that we need to be thinking about? Yeah, so one type of attack that is definitely talked about in the past, but is becoming even more and more prevalent is account takeover attacks. Um, so most retailers have some kind of login, uh, functionality, and there's a lot of good, uh, information hidden behind that, whether it's credit card information or maybe gift cards, other things like that.

And we actually saw that last year, uh, ATO attacks increased overall by 155%. And that's really crazy because ATO attacks account takeover were already the number one type of bot attacks that, uh, organizations and especially retailers experience. So to see such a large jump in that, um, shows even more how valuable the login page is and all of the information behind it and why it's so important to protect it as well.

Um, in addition, um, we've also seen that advanced bots are taking up a larger and larger chunk of the bot attack surface. Uh, so the more advanced bots are the ones that are going to be, uh, trying more closely to go and mimic human behavior, evade any, uh, detections you might have from your WAF or maybe from existing bot management solutions. Uh, we saw that for retailers, actually 50% of bots hitting them were advanced.

Um, and this is really important trend for retailers to be aware of because for the simple bots, traditional security tools are a really great way to be able to catch them. So even for simple bots, a WAF would be able to catch them. But as they do become more and more advanced, you do need a solution that is more, uh, purpose-built for those kinds of attacks, um, as they are becoming more complex and persistent.

If the techno, if you're not keeping up with the technology, it's easy to get a false sentence of security, no pun intended. Um, you know, thinking that, you know, what you're using is identifying people, you know, real person versus automated, but those techniques change all the time. And their ability to masquerade or evade detection also change.

So you've gotta be up, up on kind of the latest techniques. It's, uh, the, the way you did it last year may not be the way you do it this year. Definitely, definitely.

Um, you know, a trend that has definitely been becoming more popular, especially in the retail space is, uh, the buy now pay later, uh, businesses. Mm-hmm. You know, you can buy a product now and, uh, pay in increments.

And this is something that we've definitely seen, uh, malicious actors taking more and more advantage of because they can pretty much, let's say you take over an account and then do buy now, pay later, get the product, and never actually have to deal with the bill. Mm-Hmm. Um, so especially for organizations that do have an offering like that as part of their retail service, they really should pay even more close attention both to customers as they're logging in, but also validating when they are going to check out and using the buy now pay later functionality.

It delays detection by the customer, right? They don't notice it's happened until that first payment shows up in their inbox or credit card, whatever it might be. Definitely delaying that, delaying that.

I'm curious about, um, there's a whole category of business logic attacks that we're talking a lot more now, and love to get your perspective on that too. Definitely. So for anyone who's not as familiar with the term, the business logic, it really outlines, uh, like the user flow that the user would take throughout the application to achieve their, uh, goal.

So let's say for a typical retailer, it would be, let's say I log in, I find the product, I add it to my cart, and then I check out. So like those four steps are like the business logic. Um, and that is an extremely important point for especially retailers, but really all organizations to be able to identify.

Um, you really want to be able to have a good understanding for where, whether it's, uh, web, uh, your web applications or like actual paths or your APIs, especially if they are public facing, um, which ones of them are part of the business logic flow, and making sure that you have a good understanding for, let's say, what the typical rate for them is, what's the typical behavior and having, uh, protection on them to ensure that attackers aren't going to take advantage of them. Um, for example, for um, retailers, a common type of automated attack is a scalping attack. So that is when the, the attackers are trying to, uh, buy all of the inventory, all the oftentimes like limited inventory for themselves, uh, being very greedy.

And, um, what we've seen with that is that, uh, one specific retailer, uh, during Black Friday last year, they actually had 9 million requests in 15 minutes. Um, so of course this is a really huge attack on their specific, uh, endpoint. But also you have to imagine not only from the actual inventory perspective, is this negatively impacting the organization, but also from an infrastructure perspective.

Because when you're having such a large amount of, uh, requests hitting your servers and all of your infrastructure, you also have to be concerned about potential, uh, brownouts or even potentially the site going down. And there's nothing worse, um, than a customer trying to go and buy something, especially to buy something nice for their loved ones in the holiday, and then they realize that they're not able to go and buy the product. Uh, if it is a product that's available on a competitor site, they might just go and quickly exit the site that's not working and then hop on a competitor's site to finish their transaction.

And oftentimes those are deals too, you know, once you're on the site to present you with other products and things to buy. But if that's not available anymore, someone's, I guess another way of cornering the market, right? Buying up all the inventory or stealing inventory in that case.

Interesting. Um, you know, you have a good point too about, um, you mentioned, uh, sort of application layer and APIs so much more of our applications are API based and exposed, right? And maybe they're going through gateways or other technologies to help protect them, but that that's yet another bigger and growing attack surface that we have to be concerned about.

Definitely. Um, for organizations, what we've noticed is oftentimes they might end up having a blind spot to all of the different APIs that they actually have, um, and of course, shadow APIs as well. Mm-Hmm.

Um, so really the first step for them is to discover all of the APIs, um, you know, all of the attack vector that they have, and then, uh, make sure that they have sufficient protection on all those APIs. Uh, we keep on seeing that this is becoming a more, uh, prevalent attack vector. Um, like we saw that, uh, increasingly more and more of the traffic, uh, bot traffic that's hitting retailers is through APIs.

So like last year we actually saw that it rose to 41% of all traffic on retailers are actually through the APIs. Very interesting. Um, there's also this category of client side attacks.

Tell us a little bit more about that. Yes. Um, so that's a, a newer type of attack that maybe security professionals, um, might not be quite as familiar with.

So I mean, there are many different types of client site attacks. Uh, of course cross site scripting, which I'm sure most security professionals are very aware of, and many types of client site attacks, uh, let's say a traditional WAF might already be able to handle. Uh, but more recently we've seen a newer type of client site attack, which is called, uh, major card attack in the news.

Um, but really what they're doing is, uh, undesired data exfiltration from the client side. So the way that this works is, uh, an attacker would either inject malicious JavaScript directly into your page, or they could even compromise a third party JavaScript that you have on your page. Um, and when a customer enters in information onto a form, so this could be, you know, the login form, the credit card form, any other sensitive information that they might be entering, the data not only gets sent to the right place to, you know, the company's server, but it also gets sent to the attacker's server as well.

So you can really think of this as, um, a long term, uh, attack that record by record. The attacker is getting more and more data about the customers. Um, now this is definitely becoming a lot more prevalent, um, and especially because the number of JavaScript, um, and resources in general that are prevalent on the client side is continuing to rise.

Um, so like, uh, we've looked at some numbers and for retailers, uh, they actually have the number one amount, um, of resources on their websites. It's around 400 resources loading on their websites. Uh, this is a crazy number and of course, also, um, a crazy number of assets to try to keep track of.

Um, and all of those resources, whether they're JavaScript or there are other types of resources like images as well, can be compromised through these major card attacks. Um, really the best way to think about this is, uh, this is like a combination of like a data breach happening on the client side, and then also like a, uh, supply chain attack as well where you not only have to make sure that your own, uh, client site is protected, but any other JavaScript, uh, and any other partners that you may be working with. You think about, you mentioned 400, it's hard to fathom that, but I, you know, I probably could create a list of a hundred plus pretty easy between CRMs and purchasing system loyalty programs, location information, you know, data lookups, all kinds of, you know, inventory, all kinds of applications and services that we built into our apps.

And we have so much more processing power, you know, on our smartphones, we don't really realize how much is really executing there. So a whole nother interesting attack surface. Um, I'm, I'm curious, are, are there different kinds of measures that we should be thinking about taking as these kinds of new attacks occur?

Um, you know, oftentimes there's the technology solution. There's also kind of how we think about our security and those, the zero day, um, you know, zero trust, there's different approaches. Uh, is there some things that we might consider about how we're approaching security that should change?

Definitely. So since we last talked about the client set attacks, I'll, I'll start by touching on that. So the most important thing, um, and we have realized this unfortunately, is that many security teams actually have a blind spot to the makeup of their client side.

Um, and maybe they're, uh, familiar, let's say with their first party, um, you know, JavaScript, but they might not be familiar with all the third party that could be being added by development teams or marketing teams or anyone else who's, who's working on the website. So you really want to make sure that you have some kind of tool in place that's going to be able to bring you visibility and up to date visibility so that, uh, let's say if your marketing team does bring any additional ones in there, or, uh, something unfortunately does get compromised, uh, the security team can be alerted on this as soon, um, as it happens, and then they can go and mitigate that attack and actually remove it from their client side. Um, so I would say definitely start looking into solutions like that.

0, uh, which is going to go live in March, 2025, they've actually added a couple requirements in there specifically against MA card attacks. So even if you're not necessarily thinking about it for this, uh, retail, um, uh, year, you know, end of end of the year holiday season, you should definitely start thinking about having some solution in place so that, um, you'll not only have a secure protection, but also be able to keep maintaining PCI compliance. Um, and Everyone take your eyes off of the regulatory front, right?

Because that's constantly, I mean, it's changing how increasing in change and pace of that. Exactly. Definitely.

0 changes might, uh, be a shock to them. So definitely I would recommend that you already start looking into a tool like that. Um, so that, uh, if you do have many different websites where you're processing payment information, you can get them all up and running for once the audits do start in 2025, um, you know, some other things that I've mentioned, um, make sure you have a good process in, uh, within your team to have good visibility, not only for the client side, but really across all of the assets that you need to be protecting.

So like I mentioned the business logic earlier, you really want to make sure that you have identified through all your different, uh, web applications, also mobile applications of course, and then your APIs, which ones of them have sensitive information behind them, or which ones of them are attackers most likely to take advantage of. Um, and making sure you start understanding what their typical behavior is, like I mentioned earlier, and really having specific, uh, and, uh, highly tuned detections and mitigations in place for each one of them so that you can protect your customers throughout the entire user flow, and of course, protect your applications as well. Um, some other things that you might want to do, uh, I know that we are always talking about this, but make sure you have good, uh, credential hygiene.

Um, so, you know, make sure that your customers need to, um, rotate their, their passwords every once in a while, or if you do find out that their credentials have been, uh, leaked, let's say available in a leak database, definitely I would recommend going and resetting the password for them and having them create a new one. That's really one of the best ways that you, uh, that you can actually prevent ATO attacks. Um, making sure that passwords aren't reused across the different, uh, websites.

And if one of them does get leaked, you wanna make sure that your website doesn't end up having the negative repercussion because of that. Um, and then really the last things as we are coming into the holiday season, I would say, um, for your internal teams, make sure you're continuing to stress test your infrastructure. Um, DDoS attacks are becoming even larger and larger.

We've seen some really large record breaking ones over the last month or two. So making sure that you are testing them not only against, you know, attacks, but also making sure that you are ready for the legitimate holiday, um, season. Um, and all of the, the legitimate users that will come on there.

And of course, educate your internal teams on phishing attacks. Um, as holiday, as the holidays come up, attackers are going to try to do phishing attacks, uh, using like spam emails more and more to try to get access to your infrastructure from the inside. So making sure that they are well educated on the signs of a phishing attack would be another great way to ensure that all, uh, sides of your application are secure and you really have a secure perimeter.

Yeah. Speaking of phishing attacks, you know, ai, generative AI is kind of on the lips of everybody's talking about it, right? And as that improves, you know, that's, uh, potentially another tool or will be, or is already a tool for, you know, for, uh, spamming, for phishing attacks and, uh, become more difficult to really recognize as it's not created by a person, but by ai.

Definitely. That's a really great point. I'm sure that unfortunately we'll be seeing more humans, uh, falling prey to these types of attacks as, as AI becomes being used more and more.

Absolutely. Well, we're, we're, uh, where can folks kind of keep up with what's happening with Imperva, maybe on this topic as well as others? 'cause you know, when you need that information, you need it asap, right?

So, uh, might they visit the website or is there any particular areas you might wanna point out? Yeah, definitely visit our website. We have lots of great assets on there.

We actually just released a really great, uh, report about, uh, the e-commerce industry. Um, so really very relevant to this conversation. Uh, we talk about all the different attacks that they might encounter, the negative repercussions, and also some additional tips that security professionals might want to take in order to protect their websites, uh, during the holiday season.

Fantastic. Glen, it is always fun talking to you. Thanks for coming by and very timely information just in time for the holidays and let's hope everybody has a safe, uh, holiday, whether it's business, personal travel, all of the above, especially the cyber world that we all work in and live in.

Perfect. Thank you so much for having me. You bet.