With all of the PCI and data breach talk these days, its easy for retailers of all sizes to be on edge. Although its undeniable that merchants of all sizes need to protect themselves, different issues threaten Wal-Mart and Phils Bait Shop.
Larger retailers can be seen as the better targets in the Willy Sutton School of Thought (when asked why he robbed banks, the legendary holdup man is said to have replied, “Thats where the money is”). But smaller merchants can be attractive for the opposite reason, namely that they are likely to have less sophisticated defenses.
The term “cyberthief” today actually describes bad guys in three very distinct groups:
The Professional Cyberthief, typified by the Eastern European folk. They do this for a living, have top-notch equipment and a healthy number of people. They want soft targets and big ones. For these folks, stealing 100,000 data-packages is worthless because they know how many will be nullified quickly. They want to grab tens of millions of packages at a time so they can still end up with a healthy number of usable ones. Hence, they only go after the biggest of the retailers. Mom-and-pops have virtually nothing to fear from these folk.
The amateur cyberthief, typified by the suburban teenage male. Although theyll enjoy the money, theyre in it for the thrill, for the sport of it. So they want hard targets. The bigger the challenge, the more the fun.
This is why smart retail CIOs never want to discuss their own security, even in vague terms. If they say they have some holes to fix, its blood-in-the-water to the Eastern Euro sharks. If they instead say theyre airtight, its the red cape for the suburban teenage bull. Choose your poison.
These amateurs typically target high-profile places (Pentagon, Wal-Mart, Disney, Google, etc.) because they want the publicity. Sometimes, though, these HREF hoodlums will target a very local retailer that is well-known in their group. Mom-and-pops generally have nothing to fear from these folks, unless its a popular hangout. Then it can become a target.
The professional thief, who is not (or at least was not) a cyberthief. This is your crowbar set that often does old-fashioned shoplifting and burglaries.
A good recent example was a gang that physically attacked POS keypads with the Stop and Shop grocery chain.
The crowbar crew are more worried about security guards and surveillance cameras and usually work in teams, primarily to block or distract. Mom-and-pop retailers have much to fear from these folk. The Wal-Marts of the world have better surveillance systems and are not the crowbar sets top choice, but theyll go there if its especially convenient.
The problem with the threat confusion is that security vendors like to group these folk together because thats easier to sell. To paraphrase the hammer-nail cliché, when all you have to sell are high-end deadbolts, youd better make people think theyre being overrun by crooked locksmiths. The only problem: There are a lot of folk out there with sledgehammers looking for a wall.
Retail Center Editor Evan Schuman has tracked high-tech issues since 1987, has been opinionated long before that and doesnt plan to stop any time soon. He can be reached at Evan_Schuman@ziffdavis.com.
To read earlier retail technology opinion columns from Evan Schuman, please click here.
