CSO Summit: Securing the retail application

Last month I presented a talk about the security risks faced by the retail industry at the Microsoft Chief Security Officer Summit in Redmond. This was a gathering of several hundred CSOs from major Microsoft customers to share their experience around security in their organizations and to help them understand our strategy around security.

My talk was based upon interactions and research my team has done with several large organizations in the retail vertical. I've come up with a couple of very plausible real world scenarios that can allow a technical risk to transcend the enterprise IT boundary and impact the core business processes.

Scenario 1:Stealing credit card info from Point of Sales systems in-store

Ease of exploitability: medium.

Impact is critical.

Attacker steals credit card data from Point of Sales (POS) system that talks to retail application client and web service across the web. This system does financial applications over the Internet.

In most cases enterprises expect the attack surface to be communication going over the "Internet", however my experience has been that it is trivial to attack POS systems in stores or retail outlets and obtain that data before it is transmitted across the web. The attack surface is not limited to the web.

Scenario 2: Compromise Supply Chain Management System

Ease of exploitability: hard

Impact is critical.

In several SCM systems unauthenticated web service are used to generate control data like shipping addresses. An attacker can use compromised web service to inject malicious data into shipping system. As a result 100,000 wool sweaters could be sent to Miami in July. Threat modeling and security code reviews can be used to minimize the possibility of this attack succeeding.

Our investigations led us to determine that from a business perspective the highest application risk to retail organizations comes in the following threats:

Insufficient authentication mechanisms

Poor authorization model

Lacking input validation controls

Susceptible to Denial of Service issues

Non-standard deployment of point of sales systems

SCM systems susceptible to insider attacks