2020 GLPS - Group LP Selfies
Your Team - Your Pride - Our Industry
Building Industry Pride - One Team Selfie at a Time

CVS Health's Asset Protection Field Leadership Team

Leading With Heart!

RILA & NASP Impact Tenn. Supreme Court Ruling on Serial Shoplifters/ORC

Tenn. Supreme Court Upholds Felony Conviction for Serial Shoplifters

The Tennessee Supreme Court decided yesterday that the state of Tennessee can use its burglary statute to prosecute serial shoplifters who have been issued no-trespass warnings banning them from re-entering retail stores.

"This is a significant victory for leading retailers who are doing all they can to combat the growing problem of shoplifting," said Deborah White, President of the Retail Litigation Center (RLC) & General Counsel of the Retail Industry Leaders Association. "Retailers are grateful to the state of Tennessee for recognizing the gravity of the problem and utilizing the prosecutorial tools at their disposal to make a difference."

The RLC along with the National Association for Shoplifting Prevention (NASP) and the Tennessee Retail Association (TRA) filed a friend-of-the-court brief in this case urging the Tennessee Supreme Court to permit the enforcement of felony burglary statutes to cover habitual shoplifters who ignore no-trespass notices and then re-enter retail establishments to try to steal more products - in this case, the defendant had followed this pattern for 5 years.

Compelled by our arguments, the court cited the amicus brief in the majority opinion:

The case before the court was State of Tennessee v. Abbie Leann Welch.  rila.org

Mass Shootings Update: Jan 1 - Feb 21, 2020 41 Shootings reported and verified & 52 Deaths

SIA Education@ISC West Program Focused on Converged Security Issues
ISC West, the largest converged security event in the United States, introduced the lineup for its 2020 SIA Education@ISC sessions, in collaboration with premier partner the Security Industry Association (SIA).

Together, SIA and ISC West will be making educational sessions available during ISC West, taking place March 17-20, at the Sands Expo in Las Vegas, Nevada. The comprehensive program includes nearly 100 accredited sessions covering a range of industry topics, such as connected security, unmanned systems, smart cities, loss prevention and supply chain and more, designed to provide the necessary knowledge security professionals require to prevent threats and make a real-world impact in an increasingly converged security landscape.

See the full list of education sessions here. sdmmag.com
 

Coronavirus Impact

ISC West Cancels Chinese Dedicated Pavilion
ISC West Modifying Venetian Ballroom Layout in Absence of Chinese Companies
ISC West is being affected only minimally by the COVID-19 coronavirus, which is having an impact on international business travel, specifically to and from China. One consequence of coronavirus travel restrictions is a decision by Reed Exhibitions International not to proceed with a dedicated pavilion for Chinese companies at ISC West, March 17-20. In the main hall, however, some Chinese companies will remain in the show and staff their exhibit booths with U.S. office personnel and resources.

"Our clear focus is on the health and safety for our entire ISC community, and empathy and compassion for our Chinese customers relative to personal health and safety, and the very challenging business predicament for these companies," says Will Wise, Group Vice President, Security & Gaming Portfolio, Reed Exhibitions. securityinformed.com

Coronavirus Having A Major Global Impact Financially - Costing Billions
What Apple, P&G, Walmart and other U.S. companies are saying about the coronavirus outbreak

Corporate Dominant Theme in Earnings Releases & Conference Calls of S&P 500's
Investors Pressing for Answers on Financial Impact

A FactSet search of the 364 earnings call that were held in the period stretching from Jan. 1 through Feb. 13 found 38% included the term "coronavirus" at least once. The industrial, IT and health-care sectors accounted for the highest number of companies discussing the topic, according to FactSet.

While many were asked to quantify the negative impact on their businesses, 34% said it was too early to say and did not include the virus in their financial guidance. As a result, "it is possible that there will be an increase in the number of companies issuing negative guidance later in the first quarter as these companies gain clarity on the impact."

- Apple Inc. is not expecting to meet second-quarter financial guidance because production has slowed or been halted.

- The Estée Lauder said the third quarter will be most impacted by the sales decline of luxury beauty products in China.

- Hasbro continues to have office and third-party factory closures = 2/3rd's of global sourcing shut down.

- Procter & Gamble expects the outbreak to materially impact earnings for the January to March quarter.

- Ralph Lauren said fiscal 2020 sales could be hurt by up to $70 million & operating income in Asia could take a $35 million to $45 million hit.

- Under Armour expects to lose between $50 million and $60 million in sales.

- VF Corp. which owns the sneaker brand Vans, has closed 60% of its owned and partner stores in China.

- Walmart anticipates a financial impact in the first quarter & potentially the second quarter to its China business.

- Walt Disney said if its shuttered Shanghai and Hong Kong theme parks remain closed for months, it would shave $175 million off operating income in the current quarter. marketwatch.com

Rabobank Predicts Coronavirus to Cost China Retailers Anywhere From $31B to $125B

Coronavirus Could Push Companies to Stop Relying on China, But It's Easier Said Than Done, Experts Say
 

Former Coca-Cola Sales Director Gets 1 Yr Prison & 25 Months Home Detention For $750,000 Embezzlment
Anne Gronek-Gibbs was a sales director who used her position to obtain personal goods and services from suppliers of the Coca-Cola Company and have the company pay for those goods and services. She ordered luxury goods, tickets, and gift cards and also booked first class travel, and had Coca-Cola pay for luxury hotel accommodations for personal trips. Gronek-Gibbs modified electronic versions of quotes, purchase orders, and invoices from vendors that she then submitted to Coca-Cola for payment. Ultimately, she purchased hundreds of thousands of dollars' worth of gift cards, jewelry, handbags, and purses using this system and, all told, embezzled over $750,000.

Anne Gronek-Gibbs, 42, of Atlanta, Georgia, was sentenced by U.S. District Judge Boulee to one year in prison and 25 months of home detention, to be followed by three years of supervised release, and ordered to pay restitution in the amount of $753,551. Gronek-Gibbs was convicted on these charges on November 19, 2019, after she pleaded guilty.

"Gronek-Gibbs believed her invoice-changing scheme would cover her theft. Instead, she is headed to prison." justice.gov

EU Plans Rules for Facial-Recognition Technology

Coming regulations could restrict use of cameras in public places to collect biometric data, identify people

European Union officials plan to regulate certain applications of facial-recognition technology later this year because it can violate privacy rights. The commission is accepting public comments on the plan until May and will use those to draft rules.

New regulations could restrict whether companies and governments can use cameras in public places to collect biometric data and identify individuals, according to a strategy paper on artificial intelligence published Wednesday by the European Commission, the EU's executive body. It won't affect use of the technology as a form of secure authentication, such as to unlock smartphones using facial images, the paper said. It won't affect use of the technology as a form of secure authentication, such as to unlock smartphones using facial images, the paper said.

Legal changes will not apply to less risky applications of facial recognition. One example could be an employer's use of the technology to identify workers who need access to a secure area. Such authentication systems match a person's face to a stored photo, instead of to a large database of facial images. Employers can justify their use of facial recognition for security reasons. wsj.com

Judge Upholds New York City's Predictable-Scheduling Law
Fast-food and retail employers in New York City must comply with both the city's predictable-scheduling law and the state's wage and hour laws, according to a recent court ruling.

State Trial Judge Arthur Engoron dismissed a lawsuit on Feb. 18, finding that the city's scheduling regulation isn't pre-empted by state law. Covered employers in the Big Apple, therefore, must continue to ensure that their policies and practices align with employee-scheduling rules outlined in the 2017 Fair Workweek Law. shrm.org

2020 Retail Sales "Starting Off on Strong Footing," NRF Chief Economist
U.S. retail and food services sales increased by 0.3% over the previous month to $529.77 billion in January. U.S. retail sales got off to a strong start in January. Four U.S. retail companies went bankrupt in late January and early February, bringing the total bankruptcy count for 2020 to five.

Clothing and clothing accessories stores saw the sharpest decline in sales in January at 3.1% to $22.27 billion. The retail sector lost 8,300 jobs in January, down to 15.7 million jobs.

7-Eleven Owner in Talks to Acquire Speedway
Tokyo-based Seven & i Holdings Co., which owns 7-Eleven, is in exclusive talks to acquire Marathon Petroleum Corp.'s Speedway stations for approximately $22 billion.

Seven & I Holdings is Japan's largest c-store operator, with around 70,000 stores in 18 countries and regions. Marathon Petroleum is looking to spin off Speedway, with about 4,000 stores in the U.S. cstoredecisions.com

How Business Travel Can Affect Mental Health

Are You Taking Care of Your Frequent Travelers?
Do you even have an assistance program?

A recent study from YouGov and NexTravel found that more than 22 percent of survey respondents said that business travel had some kind of impact on their mental health. And speaking to Skift, medical assistance organization International SOS noted 40 percent of its calls were related to mental health.

Risks involving anxiety and depression are making up a larger and larger chunk of first calls to risk management companies. This trend likely won't slow until companies make fundamental shifts to their corporate culture.

With stress-induced symptoms of anxiety and depression as one of the top issues travelers report. International SOS, perhaps the largest medical assistance and security company worldwide, fields 4.5 million calls a year. As the frequency continues to rise, companies are becoming increasingly aware of a need to change the corporate support systems in place.

A 2018 study in the Journal of Occupational and Environmental Medicine found that executives that spent more than 14 days a month traveling were 60 percent more likely to develop symptoms of anxiety and depression. It also noted that issues of insomnia, anxiety, and alcohol dependence were common among frequent business travelers. "Poor behavioral and mental health outcomes significantly increased as the number of nights away from home for business travel rose."

"Companies need to understand that this is an epidemic," he told Skift. "It's impacting all of us. It doesn't matter whether you're a senior vice president or a COO, or whether you're somebody on the frontline, nobody's immune. And so they need to first and foremost talk about it. They need to openly talk about it. They need to provide resources to HR, benefits, the Employee Assistance Program, medical assist programs, and they need to educate everybody." associationsnow.com skift.com

Coresight Research
Retail Store Databank - Week 8
2020 YTD Closures 1,252
2020 YTD Openings 2,026

Modell's to Close 24 Stores of its 141


Quarterly Results
Canada's Loblaw Co's Q4 Food comp's up 1.9%, Food sales up 2.7, Drug comp's up 3.9%, Pharmacy comp's up 6.1%, Front Store comp's up 2.2%, Drug sales up 4.2%, consolidated revenue up 3.3%

Kirkland's Q4 comp's down 2.7%, sales down 3.1%, full yr comp's down 7.1%, sales down 6.6%
 

What to Look for at RSA 2020 Conference

Keynote Preview, Important Themes and Health Tips

This special edition of the ISMG Security Report offers a preview of keynote presentations at the RSA 2020 conference, which begins Monday in San Francisco.

In this report, you'll hear (click on player beneath image to listen):

• ISMG's Mathew Schwartz offer a rundown of his picks for the hottest keynote sessions;

• Retired RSA Chairman Art Coviello discuss this year's conference theme, "The Human Element," and other key topics;

• Pandemic and disaster management expert Regina Phelps offer tips on how to stay healthy at this year's big event. govinfosecurity.com

RSA Conference 2020: ISMG Spotlights Security Leaders

Over 200 Video Interviews With Experts Planned

Information Security Media Group, a premier media partner at the annual RSA Conference, will conduct over 200 video interviews at this year's event with cybersecurity thought leaders, executives, CISOs and sponsors.

Security Thought Leaders
Over the course of four days, ISMG editors will conduct interviews with dozens of subject matter experts. Our guests will include:

• Sam Curry, the chief security officer of Cybereason;
• Gen. Keith Alexander (retired), the CEO of IronNet Cybersecurity;
• Dr. Anton Chuvakin, the head of solution strategy with Chronicle;
• Art Coviello, partner with Rally Ventures and the former chairman of RSA;
• Andy Purdy, chief security officer of Huawei Technologies USA;
• Allan Friedman, director of cybersecurity initiatives at the U.S. Commerce Department;
• Zulfikar Ramzan, CTO at RSA.

In addition, ISMG editors will host three exclusive executive roundtables at the 2020 RSA Conference, which will the themes: New CISO Stress Research: Causes, Consequences and Conversation and Driving Partnership Between Security & Development as well as Digital Transformation in Healthcare - The Impacts & Benefits of Digital Identity."

Watch for frequent updates on our RSA Conference news page. careersinfosecurity.com

Are CISOs ready for zero trust architectures?
Zero trust is a concept that is gaining an increasingly large and dedicated following, but it may mean different things to different audiences, so let's start with a definition. I refer to an excellent post by my friend Lee Newcombe and I agree with his definition of zero trust:

"Every request to access a resource starts from a position of zero trust. Access decisions are then made and enforced based on a set of trust metrics selected by the organization. These trust metrics could relate to the user, their access device, the resource to be accessed, or a combination thereof."

The concept of zero trust architectures is not new. During my career, I was a member of the Jericho Forum, a group that essentially invented the concept. At that time technology was not mature enough to support a true "zero trust architecture". This has changed and I firmly believe that today, technology is at a suitable level for enterprises to move to architectures without perimeters.

That said, a true full-scale transition to a zero trust architecture will require more than just changes to network, application and supporting technologies - it will also need to drive large scale security and general IT policies or be driven by a large scale transformation program. And as usual, training will play a big role.

In my opinion, CISOs should prepare for zero trust architectures by:

1. Engaging expert advice
2. Evangelizing lower cost of exposure

Finally, and probably most importantly, if we accept that the formula of zero trust equals to:

Access granted if [Sum(device score),Sum(user score), Sum(resource score)] > [required device score, required user score, required resource score]

Zero trust architectures are only possible when organizations know exactly what their users, device assets and applications are, and how these are configured, interrelated and secured. helpnetsecurity.com

Microsoft Announces General Availability of Threat Protection,
Insider Risk Management
Microsoft today announced the general availability of its Threat Protection and Insider Risk Management platforms, as well as the decision to bring Microsoft Defender Advanced Threat Protection to iOS and Android. The announcements come amid a wave of security product news ahead of RSA Conference.

When Microsoft Threat Protection (MTP) arrived in public preview last December, it was described as an "integrated solution" built on the Microsoft 365 security suite: Defender Advanced Threat Protection (ATP) for endpoints, Office 365 ATP for email and collaboration, Azure ATP for identity alerts, and Microsoft Cloud App Security (MCAS) for software-as-a-service applications.

MTP is designed to bring the capabilities of all of these Microsoft systems together into a single tool and, in doing so, to coordinate threat detection and response. darkreading.com

Companies Face Steep Litigation Risks Under California's New Privacy Law

The California Consumer Privacy Act has put businesses at substantial risk of data breach litigation and litigation from technical noncompliance.

Data Breach Litigation

The CCPA has a private right of action for data breaches, without any express causation requirement. If a business had inadequate data security, plaintiffs can recover statutory damages between $100 and $750 "per consumer per incident or actual damages, whichever is greater." Thus, a data breach affecting 50,000 California residents has a potential exposure of $37.5 million.

Litigation From Technical Noncompliance

Businesses also face litigation risk from technical noncompliance with the CCPA. Although the CCPA does not have a private right of action for noncompliance claims, plaintiffs will likely enforce noncompliance through class actions under the "unlawful" prong of California's Unfair Competition Law (Business & Professions Code, Section 17200) ("UCL"). The UCL law "borrows" technical violations of other laws and treats them as unfair business practices. It also allows for restitution and injunctive relief. Courts also have awarded prevailing plaintiff attorney's fees in UCL class actions.

Additionally, businesses face class action risk for violations of the CCPA under common law theories, such as negligence or invasion of privacy.

Given the anticipated litigation arising out of the CCPA, it is critical that companies review their cyber insurance policies to determine whether they adequately cover CCPA claims. jdsupra.com

European Union Releases Strategy Paper on Artificial Intelligence

University of Alabama to Offer Degree in Cybersecurity