Chick-fil-A Breach: Avoiding 5 Common Security Mistakes

The latest in a record year of retail industry attacks, Georgia-based fast food company Chick-fil-A confirmed recently that it is investigating a potential credit card breach. The investigation is focused on the company’s point-of-sale (POS) network at some of its restaurants, and the breach is thought to have occurred between December 2013 and September 2014. Brian Krebs, an Internet blogger who specializes in banking security, reported that one financial institution claims that the common thread among approximately 9,000 of its affected customers are purchases at Chick-fil-A restaurants.

As you all know, security breaches of this nature can be caused by a variety of issues: newly discovered software flaws, lax security from a service provider, insider fraud, weak network security, and countless other avenues. There is also the possibility that the data that has been compromised did not originate from Chick-fil-A at all. Theft can occur at numerous places along the payment chain. For example, it may be necessary to examine the bank where the electronic transactions were processed.

In one sense, it does not matter how the breach occurred. The fact that credit cards at a major corporation have once again been stolen highlights the threat that all quick-serve restaurants and retailers of every size are facing from data thieves. Businesses interested in keeping their networks and data secure should start with simple security measures that can effectively mitigate the growing problem that hackers represent. While nothing is fool proof, the following suggestions could have prevented most (if not all) of the breaches that have garnered so much attention in the past 12 months:

Suggestion 1: Protect a location’s incoming Internet traffic. The first step in stealing data is finding an avenue into the targeted business. All of a business’s data circuits and its Internet connections must be protected by a robust and adaptable firewall, protecting the business from unwanted incoming traffic.

Suggestion 2: Implement secure remote access. When permitting remote access to a network for the management of POS and other systems, it is essential that this access is restricted and secure. At a minimum, access should only be granted to individual (not shared) user accounts using 2-factor authentication and strong passwords. Remote access activities should also be logged so that an audit trail is available.

Suggestion 3: Keep anti-malware software up-to-date. It is critical to keep all anti-virus/anti-malware software up to date with the latest versions and definitions. The companies that make anti-malware software monitor threats constantly and regularly update their packages to include preventive measures and improvements to thwart malware seen in other attacks.

Suggestion 4: Update your point of sale as security patches are released. Much like anti-virus/anti-malware updates, POS manufacturers are constantly improving their software to prevent hackers from stealing data, especially if a criminal manages to bypass the built-in security. It is essential that the latest security releases and patches be installed on all POS systems.

Suggestion 5: Limit outbound Internet traffic. In addition to blocking unwanted traffic from getting into a location, it is always a good practice to selectively block outgoing traffic as well. Many modern breaches involve software that becomes resident on your network and then tries to send sensitive data to the hacker’s system via the Internet. No system can completely prevent unwanted malware or viruses, so a good last line of defense is making sure secure data doesn’t leave your network without your knowledge. The same firewall used in Step One should be configured to monitor outgoing traffic as well as incoming.

These suggestions might, on the surface, seem simplistic, but almost every major breach in the last 12 months failed to incorporate at least one of them. Of course, this list is not an all-inclusive way to prevent every type of credit card theft, but it is interesting to ponder how much theft could have been prevented if just these five elements had been implemented correctly. Remember that it costs nothing for data thieves to attempt to hack a business, so for them, every business is a worthwhile target.