Cyber Security for Retail and E-commerce Businesses

Reduce the scope before you secure it

PCI DSS compliance gets dramatically cheaper when card data never enters your environment. Using a hosted payment page or an iframe from your payment provider, rather than capturing card details on your own page, moves most of the burden to them and typically qualifies you for a much shorter Self-Assessment Questionnaire.

The same applies in store. A card terminal that connects directly to the acquirer over its own path, on a segmented network, keeps your till system and office network out of scope. Getting this architecture right first is the single largest cost saving available in retail compliance.

• ✓Hosted or iframe payment pages rather than capturing card data yourself
• ✓Never store card numbers, and confirm no supplier or log is storing them for you
• ✓Segment card terminals and EPOS onto a dedicated network
• ✓Confirm your SAQ type with your acquirer before doing the work

Protecting the payment page itself

Digital skimming — where an attacker injects a script into a checkout page to harvest card details as customers type them — remains a live threat for online retailers. It usually arrives not through the shop itself but through a third-party script: an analytics tag, a chat widget, an abandoned plugin, or a compromised supplier.

Defences are practical: know exactly which scripts load on your checkout, remove the ones nobody can justify, apply a Content Security Policy, monitor the payment page for unauthorised change, and keep the platform and its extensions patched. PCI DSS v4.0 now requires script inventory and integrity monitoring on payment pages for exactly this reason.

• ✓Full inventory of scripts loading on checkout, with a business justification each
• ✓Content Security Policy restricting where scripts may load from
• ✓Integrity monitoring and change alerting on the payment page
• ✓Prompt patching of the platform, theme and every extension
• ✓Removal of unused plugins and dormant administrator accounts

Customer accounts and fraud

Retailers hold customer accounts containing addresses, order history and stored payment tokens, and those accounts are attacked at volume using credentials stolen from unrelated breaches. Customers reuse passwords, so a list from another site works against yours.

Rate limiting, bot detection, breached-password checking at registration and optional multi-factor authentication for customers all reduce this materially, and none of them requires a large project.