Ecommerce Security: How to Protect Your Holiday Shoppers

The holiday shopping season is upon us and it’s going to be a doozy. Online merchants are already working around the clock to keep customers happy and navigate the chaos that is holiday shipping. For retailers who are prepared to handle the surge in traffic and transactions coming their way, this year promises to be as profitable as it is busy.

Unfortunately, there’s a dark side to the online holiday shopping rush that no online seller can afford to ignore. The increase in buyer activity during the holiday months offers cybercriminals a slew of opportunities to exploit existing vulnerabilities.

While protecting your customers’ data is important at all times of the year, the heightened risk of data theft during the holiday season should be answered with an audit of your store’s security. If you haven’t already performed one, a quick security check followed up by an in-depth assessment of potential vulnerabilities should be completed as soon as possible.

Here’s how to quickly check your site security for potential vulnerabilities:

1. Take stock of who has access to your customers’ information.
2. Verify that your site is secured with encryption.
3. Make sure you’re not holding onto unnecessary data.
4. Revisit your password policy. Passwords should be complex and changed regularly.
5. Review your disaster plan. Has it been updated recently?

Limit Access to Customer Information

Your employees may be trustworthy, but they are human. Phishing and other forms of social engineering exploit human psychology and habits to gain access to sensitive information, with customer financial data as a common target.

Customer information should only be accessible by authorized personnel who have been educated in secure and ethical data management. Regular trainings on data defense strategies and the addition of extra security measures like two-factor authentication can serve to protect both your customers’ data and those with access to it.

Verify Ecommerce Site Encryption

Encrypting your site is one of the best ways to prevent eavesdropping on sensitive data exchanges. Once an option for sites that wanted an extra layer of security, SSL encryption is now mandatory for sites that want to maintain customer trust in the modern ecommerce climate.

To keep customer data safe, make sure your site has a valid SSL certificate. If your certificate has expired, consider renewing it as soon as possible. Holiday shoppers will be less likely to trust a site without encryption and may turn to competitors who offer a more secure shopping experience.

Save Only What’s Necessary

It’s easier to protect your customers’ data when you have less of it to worry about. The Payment Card Industry Security Standards Council (PCI SSC) recommends eliminating unneeded cardholder data. Cardholder data, which includes the cardholder’s name, card expiration date, and primary account number, can be stored separately from less sensitive data to minimize the number of storage locations that need significant protection.

Get Serious About Password Security

Universal passwords don’t cut it anymore. Every member of your team—even those who don’t have access to sensitive data—should be educated on modern password security. It is everyone’s responsibility to make sure they follow basic password security guidelines:

• Complexity: Passwords should be words not found in the dictionary and include a variety of characters—letters, numbers, and symbols.
• Secrecy: Emphasize the importance of keeping passwords secret. Make sure your employees know that no one will ever have a legitimate need to ask for their password.
• Uniqueness: Passwords used for professional purposes should not overlap with those used on personal accounts. Every password should be completely unique to the account.

Disaster Preparedness

Do you have a disaster recovery plan in place in the event of an emergency? If not, consider creating one. It may prove indispensable when some unforeseen event—human-caused or not—threatens the integrity of your data storage.

A well-prepared disaster recovery plan takes into account a company’s resources, potential vulnerabilities, and key personnel and outlines the steps for proceeding after a data incident. Even if you cannot develop a full plan by the time the holiday shopping season reaches its peak, the research and analysis involved in beginning one could help expose security weaknesses that you can address quickly.

Protecting Your Customers

Maintaining a secure site is one of those achievements that no one will notice as long as you’re doing it right. For ecommerce merchants in the midst of the holiday rush, that’s a good thing. If you want to keep your customers’ attention on your products and promotions, the last thing you need is an embarrassing data breach. By employing best practices for customer data protection all year long, you can keep your reputation (and your holiday profits) on the upswing.

Still not sure if you’ll survive the holiday rush? Read our 6 Indispensable Holiday Shipping Tips for Online Retailers.