Cyber Monday helps ring in the most festive time of year. But for hackers, it’s an invitation to play the Grinch.
That’s because amid the frantic online shopping, cybercriminals see opportunity.
This year’s supply chain issues add additional challenges. But we can all take solid steps to ensure a happy holiday for us — and a lump of coal for cybercriminals.
Nick Biasini is head of outreach for Cisco Talos, one of the largest and most advanced cybersecurity research teams in the world. In this interview, Nick shares his top tips for keeping Cyber Monday fun and joyous — for shoppers, not hackers.
Q. Hello, Nick! Supply chain slowdowns already threaten to put a damper on holiday spirit around the world. Can hackers take advantage of the situation to create even more mayhem than usual?
A. We’re in the midst of a perfect storm, if you will. We deal with a huge influx of scammers around the holidays anyway. And now with the supply chain issues, both from a product side and from a shipping side, the bad guys are becoming even more active. They’re even approaching people on social media who are complaining about not being able to find whatever product that they’re looking for and bringing them scams. And the very heavy news coverage around the supply chain issues plays into that. Because now everyone is aware of the supply chain problems, and it causes a snowball effect.
Q. So, in a way, they’re doing their own version of social engineering. Taking advantage of the collective psyche while also targeting people individually.
A. Yes, and they’re starting to use more avenues than they used to. In the past we would see emails and text messages broadly sent out to people saying, Here’s a great deal on some product, to entice you to click. What we’re starting to see now is a more active role, where they target someone on social media asking for tips on how find a toy or something. And some scammer will immediately respond.
Q. We’re all looking for great online deals on Cyber Monday? Are some of those deals literally too good to be true?
A. Everybody knows that things like game consoles and certain toys are going to be very difficult if not virtually impossible to find. So, if someone suddenly says, hey, I have five hundred of those, that should raise red flags — especially if they’re asking you to pay cash or send money via a cash app or gift cards. Stop and think, am I getting what I think or am I just engaging with a scammer?
Q. Any other tips for the average consumer that you would share?
A. I would talk more about general security hygiene, things like making sure your computers are patched, making sure you’re going to reputable websites, and being wary of any suspicious links or websites you come across. And if you can use things like Google Pay, Apple Pay or Samsung Pay, these payment mechanisms shield your credit card. So, if you do happen to use a site where your credit card is compromised, you’re not going to have as much collateral impact as you would otherwise.
Q. We hear a lot about the increasing sophistication of hackers, but they still love low-hanging fruit, don’t they?
A. We see very sophisticated things like spam campaigns that are targeting with very specific language. But the overwhelming majority is generic spam that has things like deliberate misspellings of retailer names and are obviously not legitimate. They want to get the people that are going to be most susceptible. They’re not going to waste valuable resources if they don't have to.
Q. What can online retail organizations do to shore up their own vulnerabilities around Cyber Monday?
A. This is such huge shopping day, they need to be very wary of attacks. In the past, we’ve seen some very high-profile cyber incidents occurring during this timeframe, because there is such a huge volume of activity. It becomes very difficult for defenders to have to pull out those true-threats when you’re seeing this huge influx of traffic and noise.
Q. How can Cisco and Cisco Talos help make it a happy season for all?
A. We always recommend applying your defense in depth, making sure that you have the right technologies in place. We provide that both on the enterprise side with technologies like our next generation firewall, the multifactor authentication products we provide, like Duo, the various other solutions we provide, like Umbrella. And also on the consumer side. Talos provides some open-source technologies like Snort and Clam AV. But most importantly know that at Talos there is a huge team of people working all the time to identify, block, and prevent these scams and threats as we see them pop up. And we’re working actively to share and to educate the public about what we’ve seen.
Q. 2022 looms. What key trends do you see emerging in the security space in the next year?
A. With the recent rebrand of Facebook to Meta and this immersive Web 3.0 looming as a metaverse or multiple metaverses, the next year is going to be full of things that we weren’t necessarily expecting. We could see an entire new class of threats emerge. Though I think the biggest concern going into 2022 is around securing the software supply chain — making sure that you are protected, understanding what that threat landscape looks like, and being able to defend against the ransomware cartels that are out there.
But for now, we just need to remember: This is a very joyous time where people are buying presents for one another. But do watch out for the scammers out there who are trying to play the role of the Grinch.
###
Related content:
