What 2023 taught us about e-commerce security

There is an old saying in business: "what got us here won't get us there". To remain competitive, businesses must continually adapt and evolve. The same applies to cybersecurity. Cyber threats are growing in complexity and scale, while attackers look for new ways to compromise valuable data.

Cybercriminals are increasingly targeting the retail sector

According to an in-depth analysis by Tech Radar, retail is now one of cybercriminals' preferred targets. An analysis of attacks on retail businesses this year highlighted a number of key risks, including data theft, compromised accounts, reputational damage and downtime.

There are common threats such as digital skimming and malicious bots, while others, including account takeover (ATO) attacks and business logic abuse, are becoming more frequent. What lessons can we learn from 2023? And how can retailers respond to an evolving threat landscape?

Account Takeover

One of the biggest threats facing retail businesses this year has been account takeover (ATO) attacks, in which cybercriminals use automated bots to try to compromise online accounts by testing stolen usernames and passwords. For customers, a successful ATO attack can have serious financial consequences; for businesses, it can lead to reputational risks and lost revenue.

ATO attacks are a year-round threat, accounting for nearly one in six login attempts. Malicious activity is particularly widespread during the holiday shopping season. This year, the volume of malicious login attempts rose by an extraordinary 85% during Black Friday, exceeding even last year's 66% increase. And Black Friday is not the only concern: the number of ATO attacks increased by 82% between October and November 2023. These figures underline how important it is for e-commerce platforms and businesses to have defences in place to identify and mitigate malicious automated traffic that may be involved in ATO attacks.

Business Logic Abuse

Business logic refers to the rules or algorithms that determine how an application or program operates and interacts with a database. It can be thought of as an application's or API's decision-making process: the 'if' and 'then' scenarios designed to maximise return on investment (ROI). For example, a retailer might decide that 'if' a customer orders more than £200 worth of goods, 'then' they receive a 20% discount. This conditional logic makes it possible to automate business decisions and improve efficiency.

Over the 12 months of 2023, attacks targeting the business logic of retail websites almost doubled, rising from 26% to 43%. Business logic attacks can be used to steal money or sensitive data, commit fraud or simply cause disruption by crashing a business-critical application. They are becoming increasingly popular with hackers because they do not exploit a technical flaw but instead abuse an existing function of an application or system. As a result, they often go undetected by traditional security tools.

For example, if a retailer allows a customer to send digital gift cards to another customer, hackers could exploit flawed logic within the system to 'gift' themselves thousands of euros' worth of vouchers from another account. Such an attack could have serious consequences for both the consumer and the business.

Lessons Learned

Addressing these two issues, let alone the many other threats retailers face, requires action on both sides. For consumers, good password hygiene, such as not reusing passwords across different websites, is essential to reduce the likelihood of falling victim to an ATO attack. Meanwhile, businesses need a coordinated, comprehensive defence strategy, with a suite of capabilities covering every access point, including websites, mobile apps and APIs. This means going beyond a basic bot management solution to include tools such as attack analytics, client-side protection and runtime application self-protection (RASP).

Furthermore, responsibility for security needs to be shared more widely across the organisation. Combating business logic abuse requires developers and product owners to map risks and build security measures in from the outset and at every stage of the process to minimise potential exposure. This should be accompanied by regular audits and code reviews to identify issues that may not have been detected initially. Identifying business logic vulnerabilities is not a one-off exercise: software updates are continuous, and each one has the potential to introduce a new weakness into an application's logic.

What Does the Current Threat Landscape Have in Store?

Because the threat landscape is constantly changing, cybersecurity requires continuous adaptation. New threats can emerge overnight and become critical problems for businesses. In 2023, ATO attacks and business logic abuse were two of the main threats facing retailers. As the adoption of generative AI grows, the technology could help cybercriminals modify their attacks. As a result, 2024 could see a striking increase in attack volumes, particularly attacks on business logic, as attackers train AI systems to identify and exploit these vulnerabilities.