The numbers don’t look good: Despite being discovered, named and at least partially remediated late last year, the Backoff malware continues to infect point-of-sale (POS) systems across the country.

According to a report from Help Net Security on a new study from security firm Damballa, there was a 57 percent increase in Backoff infections from August to September 2014 and a 27 percent increase through the month of September. This works out to an average of 37 infected devices a day and doesn’t bode well for retail companies trying to avoid the POS malware scourge. Is there any way to stay protected?

Backoff Malware Worse Than It Looks

Since Dambella’s data only comes from systems where POS traffic is monitored, it gets worse: Companies that choose not to monitor their POS networks — many of which are stand-alone and include easy access for patches and updates — are at even greater risk. How big is this risk? In the latest quarter, close to 1,000 businesses were victimized by the Backoff malware, and high-profile corporations such as Home Depot, Kmart, Jimmy John’s, Goodwill and P. F. Chang’s have also come under attack. In short, any business that uses POS devices is a target.

So why has this malware problem reemerged after it was supposedly solved after the Target breach? Simply put, companies continue to rely on security controls that don’t detect this kind of malware — and won’t catch new versions that have been slightly modified from the original. It’s comparable to an oft-quoted definition of madness: doing the same thing over and over again expecting different results.

An Ounce of Prevention

Brian Foster, chief technology officer of Damballa, said data collected by his company “show that prevention controls cannot stop malware infections,” according to PC Magazine. However, this continues to be the most popular response to Backoff: build higher walls and put more pressure on security teams to find POS malware infections.

Instead, Foster and other experts recommend developing better security intelligence. It starts with businesses acting as if they are always under threat or in a state of continuous breach. Rather than ramping up IT security when news of another Backoff, Shellshock or Heartbleed hits the news — by which time systems are already infected — companies should assume a breach has happened and evaluate their systems accordingly.

The result is a proactive approach to finding and eliminating threats. Additionally, retail businesses need a better way to identify “true positives,” or security events on their systems that are genuine attacks. With a combination of automatic detection using evidence correlation, positive event confirmation and “risk ranking,” Damballa found companies reduced their number of daily infections by up to 40 percent.

Beyond intelligent security countermeasures, however, it is also time to take a hard look at the POS device ecosystem. Many of these devices come from third-party vendors, none of which are security companies or design their devices to withstand malware-based attacks. Instead, they are created to provide maximum functionality at a reasonable price and are often given unfettered access to corporate networks because they don’t act like “typical” computers. Pushing back against Backoff and other malware means getting POS traffic off the perimeter and into the secure heart of company networks, where it can be monitored for suspicious activity.

Backoff isn’t backing off, and it won’t so long as companies keep trying to build bigger walls around their POS systems. When this malware can go under, around or right through traditional security architecture, building walls is a waste. Opt for a moat instead, then monitor what sinks and swims.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…