10-Step Plan to Better Web Security

1. Encrypt data. Any data that would cause your company issues if it were exposed (e.g., credit card numbers) needs to be encrypted, Toews said. Doing so ensures that if a hacker reaches the data it will be of no use to them.
2. Segment your network and isolate your data. Network segmentation is a time and monetary investment, Toews said, but it's worth it.
3. Monitor security events and keep logs.
4. Download anti-virus software everywhere and keep current with patching.
5. Create and train to a corporate security policy. This policy should include guidelines on the use of the internet, oversight of the use of thumb drives, what employees should do if they believe they're the target of a phishing attack, Toews said.
6. Create a security incident response team and a plan. This team should be comprised of employees from various departments - IT, customer service, marketing, etc.
7. Hack yourself. Find a trusted employee that doesn't have password clearance and see if they can access your network. Another test you can do is see how easy it is for someone to walk past your receptionist and out of your office with a laptop or other hardware. Web security is more than just digital in nature.
8. Measure security key performance indicators (KPIs) just like you would for website performance. Examples of security KPIs include the number of invalid network log-ons and the rate of unauthorized access to production services.
9. Include security benchmarks as a bonus goal for applicable employees.
10. Don't boast about security effectiveness. There's no reason to bring unwanted attention to yourself among the hacker community, Toews said.

Retailers need to be persistent when it comes to web security, Toews said. Hackers aren't going away any time soon. Therefore, make security a corporate priority. It should be part of your brand's culture just like driving revenue is.