Expert insights on retail device security
Exploring the challenges retailers face and why proactive device management is non-negotiable, we spoke with Jim Johnson, Head of Technical Services here at TPP Retail. Based on extensive experience supporting our customers, Jim shares his perspective on the importance of security, the risks of delaying updates and how expert device management helps retailers protect their technology, operations and business reputation.
What are the most common device security concerns that retailers have?
There are several concerns that retailers regularly raise. The first is: Are their devices secure, and how do they keep them secure? This can cover everything from keeping devices up to date with the latest security patches, having antivirus running to where devices are physically stored and secured.
Another major concern is users being able to access things they shouldn’t. Do they have restricted permissions that only allow them to access what they need? Retailers need to limit access to websites and apps that aren’t needed for the role, restricting devices to the tasks store colleagues need to complete. This also prevents staff from watching YouTube, playing games or downloading apps that they shouldn’t, which leads to lost productivity. There are methods to lock down devices, and where different levels of permissions may be required, user PINs or other forms of device authentication are a sensible solution here.
Without device authentication, I could walk into a store and find a device that’s been left on the shelf (as does happen), and potentially access the information held on the device. If your app stores Personally Identifiable Information (PII), such as dealing with customer orders, all of a sudden that information is accessible to me, and you have a breach. It can be as simple as that.
Device visibility is often raised, too. When retailers don’t have the right tools in place to support visibility, they can’t see what is happening across their device estate. This includes when a device was last connected and its last known location. If you’re unable to identify a device as missing, it could have been lost or stolen, taking your business data with it.
The final concern is accountability. Retailers need to know who is using their devices and, implementing single sign on or a software where a name is put on a device when it’s taken, helps here, too. This makes users accountable for the device when they are using it, meaning that they are more likely to look after the device and use it appropriately, as it can be traced back to them.
What security issues do retailers tend to underestimate?
One of the biggest issues is the severity of a device being lost or stolen. Not all retailers underestimate the security impact if there isn’t a PIN on that device; somebody can access it and potentially do whatever they want with it. If you haven’t prevented factory resets, the device can simply be wiped, leaving you with little control over what happens to it.
Accountability is also a factor here. Some retailers underestimate the value of a Mobile Device Management (MDM) solution and the importance of daily device monitoring; just one weakness can open a whole host of security issues. Actively monitoring devices means being able to identify specific devices by serial number that are out of contact and proactively work to find those devices. It also means you can remotely manage and control the device, so if it’s missing, you can choose to wipe business data from it and prevent a lost or stolen device from becoming a serious security breach.
It’s not always about being able to unlock a device; it’s about what information can be taken from the device and the business impact that can have later down the line.
What are the business risks of delaying Android security patches in a retail environment?
Leaving devices unpatched leaves vulnerabilities on your devices that can be exploited. This vulnerability creates a path – known as an attack vector – for hackers and cyber-criminals to exploit. Without the right tools in place, a retailer may not even know it’s happened, which could lead to even greater risk. This could expose customer and financial data if your devices are used to process payments, potentially resulting in breaches of GDPR and data protection regulations, as well as significant reputational damage.
It only takes one security incident to damage a business, and being proactive will always be more cost-effective. Proactive maintenance is everything we’ve talked about; it’s the preventative measures. You need to carry out security patching, you need to set security and access standards set on your devices, and it takes daily monitoring and ongoing management to ensure your devices remain compliant.
How do Android OS upgrades help the long-term security of retail devices?
When you use Android devices, the OS is continuously improved as bugs, exploits and security flaws are found and patched by Google monthly. From time to time, a new version of Android will be released. Sometimes this brings significant changes, such as new features or how the OS is structured alongside bug fixes, and other times the impact of the changes is less, such as new hardware support that doesn’t immediately affect your business.
The longer you wait to upgrade your OS to the latest version, the more vulnerabilities your Android devices will be exposed to. And this doesn’t just apply to Android; it applies to operating systems such as Windows and iOS too. But deploying a new OS must be carefully planned and managed.
Upgrading your OS could affect the performance of your own apps and prevent critical tasks from being completed. There could also be features such as the new privacy options in Android 15 that you want to make use of.
Retailers need to make sure their strategy meets their business needs, with clear ownership and responsibilities. This should include close collaboration with third-party app providers, thorough testing, robust change-approval processes, and a clear approach to deployment, including when OS updates will be deployed after they become available and how quickly they will be rolled out across the device estate.
Ensuring you have the right resources and sufficient time to manage this effectively is key, whether that means having mobile device expertise in-house or access to scalable external resources like our team.
What’s the biggest misconception retailers have about Android?
From my perspective, the biggest misconception is that Android is not secure or that it is less secure than iOS. Android offers robust, granular device controls. There are worldwide standards in place, such as the Centre for Internet Security (CIS) baseline – which you can apply. This is one of the standards that we follow here at TPP Retail, and it’s also used by several major retailers in the UK. CIS is a great benchmark to work towards. They provide practical guidance on how to strengthen your security and the measures you should have in place, helping to ensure you don’t overlook any key security requirements.
Another common misconception is that you don’t need device management or regular security patches. Retailers don’t always recognise the risks, and they may not have the same understanding of how people actually use devices. We have over 25,000 devices deployed through MDM, so we see first-hand how people really use them. Often in ways you wouldn’t expect, from colleagues watching YouTube to actively attempting to steal data.
Where do retailers struggle when managing Android devices themselves?
Typically, in retail, the same support team is responsible for covering their distribution centre, their tills, all their stores and their head office staff. This means that time, knowledge and resources are spread thinly across the entire business.
There is an additional resource demand on already stretched technical teams to implement, manage and maintain devices to high and secure standards. Device management could require new technology to be learnt and adopted, which, of course, can be done, but that knowledge also needs to be kept up to date, and devices require ongoing attention. Both time and knowledge are required to support ongoing maintenance and fulfil tasks such as recurring monthly patches, configuration changes, compliance checks and so on.
Finding time to complete general device management tasks to the right standard absorbs resources that these teams simply don’t have. Even monthly security patching can require a couple of days depending on your process.
What expertise does our team provide that customers don’t often realise they need?
Device management is our technical management team’s specialism. Yes, you can automate security patching, and a lot of retailers do, but when you’ve got bespoke applications on a device, you need to test that those applications still run. Leaning on our resources and expertise allows the customer to continue to do what is needed elsewhere in the business, whilst we run their devices on their behalf and alleviate the pressure of device management.
We offer peace of mind, and you don’t have to worry about whether your devices are compliant, patched and up to date. This same peace of mind applies if a problem arises; they have a trusted and knowledgeable partner who will take care of it.
We interrogate, test and deploy security patches, and we work with the retailer and its Infosec team to ensure devices are secure. The Infosec team is responsible for information security across the whole organisation, and we help play a vital role in helping those businesses retain the security of their data to meeting standards such as ISO 27001.
Keep your retail devices secure, compliant and up to date
Managing a device estate takes more than the occasional update. It requires proactive security management, ongoing monitoring and maintenance of your devices.
With the expertise to keep your devices protected, compliant and performing at their best, we simplify device management and give you the confidence that your technology is always up to date. Contact us to find out how our TotalSupport Device Management service keeps your devices secure and retail operations running smoothly.
