5/20/21

LP, AP & IT Security's #1 News Source

Behind the Colonial Ransomware Payment
Colonial Pipeline CEO Tells Why He Paid Hackers a $4.4 Million Ransom

Joseph Blount says he needed to quickly restore service after cyberattack threatened East Coast supply

The operator of the Colonial Pipeline learned it was in trouble at daybreak on May 7, when an employee found a ransom note from hackers on a control-room computer. By that night, the company's chief executive officer came to a difficult conclusion: He had to pay.

Joseph Blount, CEO of Colonial Pipeline Co., told The Wall Street Journal that he authorized the ransom payment of $4.4 million because executives were unsure how badly the cyberattack had breached its systems, and consequently, how long it would take to bring the pipeline back.

Mr. Blount acknowledged publicly for the first time that the company had paid the ransom, saying it was an option he felt he had to exercise, given the stakes involved in a shutdown of such critical energy infrastructure. The Colonial Pipeline provides roughly 45% of the fuel for the East Coast, according to the company.

"I know that's a highly controversial decision," Mr. Blount said in his first public remarks since the crippling hack. "I didn't make it lightly. I will admit that I wasn't comfortable seeing money go out the door to people like this."

"But it was the right thing to do for the country," he added.

In return for the payment-made in the form of bitcoin, about 75 in all, according to a person familiar with the matter-the company received a decryption tool to unlock the systems that hackers penetrated. While it proved to be of some use, it ultimately wasn't enough to immediately restore the pipeline's systems, the person said.

The pipeline, which transports gasoline, diesel, jet fuel and other refined products from the Gulf Coast to Linden, N.J., wound up being shut down for six days. The stoppage spurred a run on gasoline along parts of the East Coast that pushed prices to the highest levels in more than 6 ½ years and left thousands of gas stations without fuel.

East Coast stockpiles of gasoline dropped by about 4.6 million barrels last week, the steepest weekly drop since late February, Energy Department data showed. wsj.com

Attack Began Months Earlier Than Previously Known
SolarWinds CEO: Attack Began Much Earlier Than Previously Thought

Investigation shows threat actors began probing SolarWinds' network in January 2019, according to Sudhakar Ramakrishna.

The attack on SolarWinds that resulted in malware being distributed to thousands of the company's customers started a full eight months earlier than previously thought.

At a keynote session at the RSA Conference today, SolarWinds CEO Sudhakar Ramakrishna said the company's continuing investigation of the breach shows the nation-state group behind it began probing SolarWinds' network as early as January 2019. The breach remained undetected until December 2020, or nearly two full years after the initial malicious activity.

Previously, it was widely believed that attackers first gained access to SolarWinds' systems in October 2019.

Security researchers and industry experts have widely described the SolarWinds breach as one of the most significant security incidents in recent years, both for its scope and sophistication. Details about the breach that have been released so far indicate the attack began when threat actors gained initial access to SolarWinds' build environment and planted malware called "Sunspot" into a single source-code file. They used the malware to insert a backdoor called Sunburst/Solarigate into builds of SolarWind's Orion network management product, which were then digitally signed and sent out to 18,000 SolarWinds customers.

A small subset of those victims - from government and the private sector - were later subjected to further intrusions and cyber espionage activity aimed at extracting sensitive data. The victims of data theft included several technology companies, such as Microsoft and FireEye. The attack and the extraordinary operational stealth with which it was carried out has sparked widespread concern about the vulnerability of US companies and government agencies to sophisticated nation-state actors.

US authorities have attributed the attack to a threat group working on behalf of Russia's foreign intelligence services group. FireEye, one of the security vendors that has been investigating the breach, is tracking the group as UNC2542. darkreading.com

An Increasingly Important & Evolving Role
The CSO role today: Responsibilities and requirements for the top security job

The CSO is the executive responsible for the organization's entire security posture, both physical and cyber, and has the big picture view of the company's operational risk.

The title chief security officer (CSO) was first used principally inside the information technology function to designate the person responsible for IT security. At many companies, the term CSO is still used in this way. Chief information security officer (CISO) is perhaps a more accurate description of this position, and today the CISO title is becoming more prevalent for leaders with an exclusive information security focus. But the distinction is not necessarily clean cut, as we'll see in a moment.

The CSO title is also used at some companies to describe the leader of the "corporate security" function, which includes the physical security and safety of employees, facilities, and assets. More commonly, this person holds a title such as vice president or director of corporate security. Historically, corporate security and information security have been handled by separate (and sometimes feuding) departments.

Increasingly, CSO means what it sounds like: The CSO is the executive responsible for the organization's entire security posture, both physical and digital. CSOs also frequently own or participate closely in related areas such as business continuity planning, loss prevention and fraud prevention, and privacy. Of course, there are many smart folks in the real world with the official CSO title who don't shoulder the burden for both areas.

However, if the CEO has a question about finance-any question-then he expects the "Chief Financial Officer" to be able to answer, or find the answer quickly. When the "Chief Security Officer" answers security questions with "Oh, that's not my problem; that's those other guys over there," the message to the CEO is that there's really no "chief" who has the big picture view of the company's operational risk. csoonline.com

Android apps exposed data of millions through cloud authentication failures

Malicious apps are not the only security problem on our handsets: misconfiguration can also put us at risk.

Researchers analyzing Android apps have discovered serious cloud misconfigurations leading to the potential exposure of data belonging to over 100 million users.

In a report published on Thursday by Check Point Research, the cybersecurity firm said no less than 23 popular mobile apps contained a variety of "misconfigurations of third party cloud services."

Cloud services are widely used by online services and apps today, perhaps even more so due to the rapid shift to remote working caused by the coronavirus pandemic. While useful in data management, storage, and processing, it only takes one access or authorization oversight to expose or leak records held. zdnet.com

Apple isn't happy about the amount of Mac malware out there

'Monumental Step' Toward Legal Cannabis
Marijuana Medical Research Growers Receive U.S. Approval

DEA licenses companies to cultivate cannabis for study, ending effective freeze under Trump administration

The U.S. government has approved new growers of research marijuana for the first time in more than 50 years, people involved in the process said, widening the capacity to study the drug's medical value.

The Drug Enforcement Administration's action after years of delay means researchers will be able to study marijuana from more than one grower, a farm at the University of Mississippi, which the government approved in 1968 as the only legal source of pot for federal research. Researchers have long argued that they need to study a wider variety of the plant to know if it can be effective in alleviating pain, fighting seizures, combating depression and relieving post-traumatic stress.

"This is a monumental step," said George Hodgin, a former Navy SEAL who has been waiting more than two years for his business, Biopharmaceutical Research Co. in Monterey, Calif., to receive permission to conduct studies. "This type of long-term thinking from the government will allow companies like ours to pioneer a federally legal cannabis market for products that are tested and approved to help the public." wsj.com

Mississippi Supreme Court Overturns Medical Marijuana Approval
Medical marijuana activists decry court decision
Mississippi was supposed to join dozens of other states with medical marijuana programs. People looking to grow and dispense marijuana for medical purposes were making plans, some spending millions on land and buildings. Those eligible under the list of 22 debilitating conditions were counting on it come August.

On Friday, the Mississippi Supreme Court flipped that reality upside down.

Its decision to overrule a voter-approved medical marijuana initiative has sparked outrage from several organizations. Some have started petitions, one coalition called for a boycott of the city of Madison - its mayor filed the lawsuit that was before the court - and another is planning a rally for June.

"The Supreme Court's decision effectively told the people of Mississippi: 'You have no voice, no vehicle for voter initiative, y'all's power is over,'" said Diesoul Blankenship, with Mississippians for Medical Marijuana and co-owner of Magnolia. "It's nothing short of erroneous and illegal." clarionledger.com

Bringing Pot on a Plane
Does TSA Care About Marijuana in 2021?
The Transportation Security Administration wouldn't admit it, but they're pretty apathetic about personal amounts of pot right now - or any personal amount of recreational drugs, for that matter.

Although the TSA's website warns travelers that only high-CBD products approved by the Food and Drug Administration are allowed on flights, the policy also advises that "TSA's screening procedures are focused on security and are designed to detect potential threats to aviation and passengers.

Accordingly, TSA security officers do not search for marijuana or other illegal drugs, but if any illegal substance is discovered during security screening, TSA will refer the matter to a law enforcement officer." westword.com

CO Lawmakers Aim to Restrict Medical Marijuana Access & Concentrate Sales
A new bill proposed by Alec Garnett, Colorado's Speaker of the House, calls for more packaging restrictions for commercial marijuana concentrate and tighter rules for medical marijuana patients and physicians, including a required THC dosage amount and tracking system for patient purchases.

After months of negotiations around limiting the potency of legal marijuana products, late last week lawmakers and a powerful portion of the pot industry reached a compromise bill. And while that proposal doesn't include a potency limit, it does contain a new set of guardrails, studies and tracking provisions intended to reduce youth marijuana use and diversion to the black market. westword.com

The benefits and unintended consequences of recreational cannabis

Major change to Minnesota medical cannabis law approved

San Antonio, TX: Man shot, killed in parking lot of East Side convenience store
A man was shot and killed in the parking lot of an East Side convenience store late Wednesday night, San Antonio police said. Officers were called around 11 p.m. to Stanley's Ice House Station on E Commerce, after receiving word of shots fired. According to police, officers arrived to find a man with multiple gunshot wounds to the chest. The man was pronounced dead at the scene. Police said there was a large gathering of people in the area, but nobody saw the shooting. A black sedan however was seen fleeing. SAPD did not give a name or age of the person killed. A motive for the shooting is not known. ksat.com

Chicago, IL: Man and Teen, 16, Die After Shooting Erupts at C-Store
A man caught in the crossfire when shots were fired inside a Chicago store was killed along with a 16-year-old boy who had fired into the business, police said. Chicago police said the teen fired shots into Big Salem's Food Mart on the city's South Side about 9 p.m. Wednesday while apparently targeting two males inside the business. usnews.com

New York, NY: NYPD officers exchange gunshots with Boost Mobile robbery suspect in the Bronx
Police exchanged gunfire with a suspected robber outside a Bronx cell phone store Wednesday night, cops said. The officers weren't hit, and it wasn't immediately clear if the suspect was wounded. According to police, two NYPD officers were responding to a robbery at a Boost Mobile store on E. 174th St. and Vyse Ave. in East Morrisania when they confronted a gunman just before 6:30 p.m. The armed man had a running dispute with a store worker, and had pulled out a gun when cops arrived, sources said. The man fired a shot, and the officers returned fire, police said. Cops recovered the man's gun after he fled the scene, police said. nbcnewyork.com

New Orleans, LA: Indiana man charged in Uptown CVS robbery, NOPD shootout has change of plea hearing set
In a sign that he may have struck a deal with federal prosecutors, one of two Indianapolis men charged with trying to rob painkillers from an Uptown drugstore at gunpoint and getting into a shootout with New Orleans police nearly two years ago is set to appear at a rearraignment on May 25. The rearraignment - or change of plea - hearing at U.S. District Court in New Orleans for Richard Sansbury, 28, is scheduled to take place a little less than three weeks before a June 14 trial date for him and his co-defendant, 20-year-old Alan Parson. Sansbury and Parson pleaded not guilty to charges of conspiracy to rob a pharmacy, attempted robbery of a pharmacy and discharging a firearm during a violent crime, which are all federal crimes. But defendants almost always plead guilty at rearraignments, usually in hopes of giving themselves the best possible shot at a more lenient sentence. nola.com

Houston, TX: Man trapped, shot at and robbed in restaurant drive-thru after leaving expensive jewelry store
Houston Police are looking for a couple robbery suspects that shot at a man in a restaurant drive-thru after leaving an expensive jewelry store off Richmond Ave. Investigators say on Wednesday, May 5, 2021 at around 2:00 pm, the victim was in the drive-thru line at a fast food restaurant, located at the 6000 block of Richmond. The victim told police that a black Mercedes suddenly cut in front of him while a silver Chrysler 300 blocked him from the side. One of the passengers in the black Mercedes rolled down his window and fired two rounds from an assault rifle, striking the victims vehicle, according to investigators. Another man in the Mercedes then jumped out of the vehicle and approached the victim while demanding his money. The suspect reached inside the man's vehicle, forcibly took his necklace from his neck and then grabbed his money. The suspect got back into the Mercedes and both vehicles then fled the scene, according to police. Shortly before this incident occurred, the victim told officials that they were inside a high-end jewelry store at the 6200 block of Richmond. He believes that someone might have noticed that he had a large sum of cash while he was purchasing jewelry and followed him to the fast food restaurant. cw39.com
 

Robberies, Incidents & Thefts

Victoria, B.C. Canada: Loss Prevention Officer survives Stabbing; Guard was stabbed while stopping a theft from Canadian Tire store
A loss-prevention officer was stabbed while trying to stop a suspected shoplifter at the Canadian Tire store at Hillside Shopping Centre Tuesday evening. The officer was able to apply a tourniquet to himself using a belt to stem the bleeding before emergency help arrived. Victoria police were called about 6:55 p.m. and added a second tourniquet. The man was transported to hospital and later discharged, said Const. Cam MacIntyre. He said the stabbing happened after the loss-prevention officer saw a suspect stealing items and went to intervene. The two struggled, and once the suspect was in handcuffs, the officer realized he was bleeding substantially. MacIntyre said the officer did a remarkable job. "We're thankful that the LPO is OK and that he's going to recover," he said. "He acted very bravely under difficult circumstances, to have the awareness to take the suspect into custody and to begin to address his medical needs." The suspect is facing recommended charges of assault with a weapon, assault causing bodily harm and theft under $5,000. timescolonist.com

Harris County, TX: 2 in custody after robbery at McDonald's
Two suspects entered the busy McDonald's during the busy mid-day rush and demanded money from the restraint and customer. Employees and customers were forced to move to the back of the restaurant. The suspects did get away with some money, but as they fled, calls went out to 911. A Harris County Sheriff's Deputy was able to apprehend both suspects. No one was reported injured during the event. news.yahoo.com

Pasadena, CA: Robbers wield syringes while stealing items from Ross store
Police are looking for a man they say threatened an employee with a syringe after stealing goods from the Pasade Naros store on Tuesday afternoon and facing the theft. Lieutenant Anthony Burgess of Pasadena police said the crime had taken place at a store at 460 South Lake Avenue at around 12:25 pm. According to the lieutenant, a man was seen leaving the store with a tote bag containing stolen goods. The employee approached the thief, at which point he pulled out the syringe and told the employee "out of the way". He was finally seen on foot. Police described the robber as a white man in a white baseball cap and black shirt. californianewstimes.com

Memphis, TN: MPD searching for suspect who burglarized Popeye's, other fast food businesses
Memphis police are searching for a suspect who burglarized a local Popeye's restaurant and other food businesses. One burglary happened May 16 at a Popeyes in the 2100 block of Frayser Boulevard. Police said an unknown suspect used a pipe to smash the window to the restaurant. The suspect is also wanted for burglaries at a Subway onf Danny Thomas, a Captain D's and a Church's in the on Frayser Boulevard, and a Church's on Thomas Street on May 18, police said. fox13memphis.com

Williamsport, PA: Suspect for Jersey Mike's robberies arrested
A suspect for the armed robberies of Jersey Mike's Subs on March 15 and April 9 was arraigned Wednesday in Williamsport, according to Crimewatch PA Lycoming County. northcentralpa.com

Medicine Hat, AB, Canada: Shoplifting complaint turns into a bit more for police; suspect armed with pellet gun

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights
 

	Division Asset Protection - Herald Square & NYC Brooklyn, NY - posted April 14 As Senior Director, Asset Protection you will serve as subject matter expert in the following areas: shortage, fraud, investigations, legal compliance, and training. Create and implement AP strategies in partnership with VP, Asset Protection. Manage, direct, & deploy District Managers of Investigations (DMIs) to support districts & stores...
	LP Auditor & Fraud Detection Analyst Greater Boston, MA - posted May 11 As a Loss Prevention Auditor and Fraud Detection Analyst for Staples, you will conduct LP operational field audits remote, virtual and in person, within a base of 60 retail stores to ensure compliance to operational standards to drive operational excellence and preserve profitability...
	District Loss Prevention Manager Chicago South / Illinois Central - posted April 27 The District Loss Prevention Manager develops and executes Loss Prevention vision and strategies for 15-45 selling locations. The DLPM is responsible for driving results through achievement of goals related to inventory shortage, budget lines, cash variance and operational compliance...
	Regional Asset Protection Manager Phoenix, Dallas, Denver and Houston - posted April 22 Victra is the leading exclusive, premium retailer for Verizon with a mission of connecting technology to life in the most trusting and profitable way. As the Regional Asset Protection Manager, you will be very logical, efficient, orderly, and organized in always safeguarding our company assets from losses due to theft or fraud...
	Area Loss Prevention Manager Pittsburgh, PA - posted May 11 Our Area Loss Prevention Managers ensure safe and secure stores through the objective identification of loss and risk opportunities. Our Area Loss Prevention Managers plan and prioritize to provide an optimal customer experience to their portfolio of stores. They thrive on supporting and building high performance teams that execute with excellence...
	Area Loss Prevention Manager Sacramento, CA - posted April 20 Our Area Loss Prevention Managers ensure safe and secure stores through the objective identification of loss and risk opportunities. Our Area Loss Prevention Managers plan and prioritize to provide an optimal customer experience to their portfolio of stores. They thrive on supporting and building high performance teams that execute with excellence...
	Corporate Security Manager Calabasas, CA - posted April 6 The Corporate Security Manager will, among other things, (a) be responsible for ensuring a safe and secure environment for our employees, vendors, and visitors, (b) develop, manage, execute and continuously improve corporate security processes and protocols, and (c) lead a team of security specialists at our corporate offices...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily