The steadily increasing frequency of data breach occurrences in 2014 has been both astounding and worrisome. From Target and Neiman Marcus to Michaels, Chick-fil-A and Home Depot, fraudsters are leaving no stone unturned, and the millions of customers unlucky enough to use infected point of sale (POS) machines at these retailers now need to worry about whether their sensitive information has fallen into the wrong hands.

While retail IT organizations are keenly aware of the problem, they are often not so clear on the solution. Granted, though fraud-prevention solutions such as chip-and-PIN can help reduce the possibility that a customer's stolen information is useable to a hacker, this is not a failsafe approach and will not prevent an attack in the first place. The vast majority of brick-and-mortar retail attacks are the result of malware being installed on POS terminals, relaying customer data directly to hackers upon a scan. That said, the real problem lies in the endpoint (POS), and once a particularly malicious malware, such as Backoff, takes hold, it is able to proliferate across other POS endpoints on the same network, creating one giant collection facility for hackers that provides customer credit and debit information.

The situation may sound dire, but there are approaches that retail IT teams can take to protect both their and their customers' sensitive data assets. For example, because malware infects the POS machines, and then proliferates to other machines on the same network, implementing a next-generation network security solution capable of continuous monitoring and automatic remediation can help stop an attack before it gains a foothold in a retailer's system.

One important thing to note here is that many legacy network access control (NAC) solutions aren't continuously monitoring for endpoint changes, especially after the endpoint successfully connects to the network. The continuous monitoring piece is an imperative, as it allows IT to spot a change to an endpoint as it occurs, in contrast to periodic scans conducted at specific times that may miss a critical endpoint breach until it's too late to contain. Therefore, a strong security solution capable of continuous monitoring combined with a set of strong security policies to automate remediation allows for the immediate isolation of an offending POS machine from the rest of the network. This allows IT to take all necessary steps to eliminate the malware once removed from the mix.

Next-generation NAC solutions are one place to start looking at solving these issues.