ANNAPOLIS, Md. -- In developing proper data-security precautions, an official with the Department of Homeland Security told retailers attending the Conexxus technology conference that everyone in their companies must be involved.
"We all share risk," said Gregory Touhill, the deputy assistant secretary for cybersecurity operations and programs for the Homeland Security Department.
Speaking before about 250 convenience-store retailers and suppliers, Touhill said retailers are not the only targets with regards to sophisticated data theft. The healthcare industry is a target in that if thieves get an individual's health records, they will have enough information to get multiple credit cards.
The same goes with law firms. He said a lot of information gets recorded during the discovery phases of all types of litigation.
He outlined five steps retailers need to take to build a basic data-security strategy:
- Identify. This means retailers have to identify what devices store information within their companies, the kinds of information that's stored and to decipher what has value. Retailers also need to identify the threats that exist to that information as well as vulnerabilities.
- Protect. Retailers need to prioritize what information really needs attention and create processes and install systems to defend that data.
- Detect. A collection of processes and automation should be in place to alert retailers if a breach has occurred. Many sources exist that provide alerts as to the latest types of breaches and attacks that have occurred.
- Respond. Is there a plan involved? Do retailers have thought-out processes in place so that if a breach does occur, staff will take the right steps?
- Resilience. Retailers need to be on constant watch, applying agreed-upon routines to make sure someone acts when the warning signs appear.
Finally, Touhill asked retailers to move forward with confidence. "Don't be afraid," he said. "Life is full of risks. Manage those risks."
Conexxus advises NACS on technical matters related to the convenience-store channel. At the five-day conference held in Annapolis, Md., retailer and supplier members of the Conexxus technology group met to discuss standards and evolving automation issues.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.