6/18/20

LP, AP & IT Security's #1 News Source

Having a Prosperous LP Career Without Compromising
Ethical & Moral Standards

By John Velke, SVP of Risk Management & Loss Prevention, Total Wine & More;
NRF LP Advisory Council, 2000-2016

The recent news that several security executives and contractors at EBay have been charged with serious crimes apparently motivated by a desire to please their higher-ups disturbs me. What is not yet clear is whether their bosses directed or knew what they were doing. Regardless, if the allegations made in their indictments are true, their behavior was nothing less than horrific.

Perhaps what bothers me the most is that apparently none of the accused had the moral courage to say, "Stop, this crosses the line, and I won't be part of it." The suggestion they might have been concerned about their career and livelihood by taking a stand might be legitimate, but I'm writing today to let your readers know that that concern is not justified.

For every media story about a bad security/loss prevention/asset protection executive who made poor choices there are hundreds of non-published stories of executives who made a different choice and did not suffer negative career or livelihood choices. To illustrate this point, but without getting into the details, I'll share with your readers that during my 40+ year career I have been asked or directed by someone above me five times to do something that crossed my ethical line. In several instances I was given a directive that would have violated the law. The first time was when I was 23 years old. I refused a direct order from my boss (who has long since left the industry) and went home. I expected to get a call that evening telling me not to come back to work. Instead I got a call back from my boss's boss and he asked me to tell him what happened. After explaining what I had been told to do and why I refused, he told me to come back to work the next day and that he would handle it - and he did. Several months later I was promoted, and my career began to take off.

In every instance after that, when asked to do something I felt crossed the line I quietly met with the executive (up to and including CEO's), explained why what was being asked of me was improper, and made it clear that I would not be part of it. I am certain that in several of those instances the executive simply did not understand the ethical or legal reason for my concern, and once explained, the directive was withdrawn. In only one instance did I feel the executive took my refusal as defiance of his authority over me. He and I both knew he could not use my refusal as a reason to fire me, but I also knew that the culture he had created was not going to work for me long-term. I left that company on my own terms and timeframe.

There are two lessons I hope you get from this. One - people in high places don't always understand the legal implications and consequences of their directives, and two - you can enjoy a long and prosperous career in this industry without compromising your ethical standards and morals. The key is to face these infrequent misguided directives in a calm, professional way, that allows the person giving them an opportunity to save face.

Click here to read more insights from John Velke in excerpts from his book, 'Prove 'Em Innocent:
The Art & Science of Workplace Investigations'

BEC Attacks on the C-Suite Dropped 37% in Q1
While hackers focus more on targeting Accounts Payable departments
Business email compromise (BEC) attacks increasingly are targeting accounts payable departments and attempting to establish trust via email exchanges before launching an attack.

Ken Liao, vice president of marketing at Abnormal Security, says people who work in finance or accounts payable often don't know every vendor - many companies have hundreds, even thousands of vendors and suppliers.

"The AP people are lower in the organization, but they still have the ability to make large payments," Liao says. "The criminals impersonate the vendor by folding into the natural workflow."

The numbers don't lie: In a report released today, Abnormal Security saw a 28% increase in the size and frequency of BEC attacks over the fourth quarter of 2019 and a 17% increase in large campaigns aimed at 10 or more recipients. Individual BEC attacks targeting the C-suite dropped by 37%. darkreading.com

AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever
Amazon said its AWS Shield service mitigated the largest DDoS attack ever recorded, stopping a 2.3 Tbps attack in mid-February this year. The incident was disclosed in the company's AWS Shield Threat Landscape [PDF], a report detailing web attacks mitigated by Amazon's AWS Shield protection service.

The report didn't identify the targeted AWS customer but said the attack was carried out using hijacked CLDAP web servers and caused three days of "elevated threat" for its AWS Shield staff. CLDAP (Connection-less Lightweight Directory Access Protocol) is an alternative to the older LDAP protocol and is used to connect, search, and modify Internet-shared directories.

The protocol has been abused for DDoS attacks since late 2016, and CLDAP servers are known to amplify DDoS traffic by 56 to 70 times its initial size, making it a highly sought-after protocol and a common option provided by DDoS-for-hire services.

The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, mitigated by NETSCOUT Arbor in March 2018. Before that, the biggest DDoS attack ever recorded was a 1.3 Tbps DDoS attack that hit GitHub, a month before, in February 2018. zdnet.com

Gartner Forecasts Worldwide Security & Risk Management Spending Growth to Slow but Remain Positive in 2020

Short-Term Demand for Cloud & Remote Worker Security Props Up Overall Market

Worldwide spending on information security and risk management technology and services will continue to grow through 2020, although at a lower rate than previously forecast, according to Gartner, Inc.

Information security spending is expected to grow 2.4% to reach $123.8 billion in 2020. This is down from the 8.7% growth Gartner projected in its December 2019 forecast update.

The coronavirus pandemic is driving short-term demand in areas such as cloud adoption, remote worker technologies and cost saving measures.

"Like other segments of IT, we expect security will be negatively impacted by the COVID-19 crisis," said Lawrence Pingree, managing vice president at Gartner. "Overall we expect a pause and a reduction of growth in both security software and services during 2020."

"However, there are a few factors in favor of some security market segments, such as cloud-based offerings and subscriptions, being propped up by demand or delivery model. Some security spending will not be discretionary and the positive trends cannot be ignored," he said. gartner.com

New SOC Research Reveals Security Teams Overconfident
in Detecting Cyberthreats
A new report that examines the processes and effectiveness of corporate security operations centers (SOCs) reveals that 82% of SOCs are confident in the ability to detect cyberthreats, despite just 22% of frontline workers tracking mean time to detection (MTTD), which helps determine hacker dwell time.

Compounding this unfounded confidence, says the 2020 State of the SOC Report, is that 40% of organizations still struggle with SOC staff shortages and finding qualified people to fill the cybersecurity skills gap.

"From 2018-2019, we learned that dwell time - or, the time between when a compromise first occurs and when it is first detected - has grown. Based on this, it is surprising for SOCs to report such inflated confidence in detecting cyberthreats," said Steve Moore, chief security strategist at Exabeam. "We see great progress in the SOC with attention paid to employee well-being, measures for better communication and more. However, disparate perceptions of the SOCs' effectiveness could be dangerously interpreted by the C-suite as assurances that the company is well-protected and secure, when it's not."

Highlighting the imbalance is that SOC leaders and frontline analysts do not agree on the most common threats facing the organization. SOC leaders believe that phishing and supply chain vulnerabilities are more important issues, while analysts see DDoS attacks and ransomware as greater threats. security magazine.com

DOJ compliance guidance offers risk-management lessons for cybersecurity leaders
Prosecutors use this guidance to assess criminal liability in a compliance breach, so it behooves business and security leaders to understand the expectations.

Target's former CISO joins FireEye as Chief Strategy Officer

Zoom 'Will Mostly Run On Amazon Cloud For Foreseeable Future', Says AWS CEO Andy Jassy

Leadership and COVID-19: How to Lead Your Cannabis Business During a Crisis
Leading through a crisis situation like the COVID-19 pandemic is challenging in all industries, and the cannabis industry is no exception. From effectively meeting customers' needs and generating revenue to keeping employees motivated, effective leadership is critical to keeping a cannabis business or ancillary business afloat.

To be an effective leader during times of uncertainty and change, you need to lead by example, communicate often, and take risks. There is no roadmap to follow when the economy shuts down. However, it's up to you to lead your team and your business through any crisis. By focusing on innovation, motivation, and emotional intelligence, you'll be well-positioned to do it successfully.

Prioritize Innovation over the Status Quo
What your cannabis business has been doing is unlikely to continue working during a crisis. Being agile is the new norm and being able to pivot as changes occur is crucial to surviving - and even thriving - during any crisis, including a global pandemic like coronavirus.

Be a Motivator
As a leader, you can motivate your employees by giving them a reason to want to work. It's natural for employees to become unmotivated, especially during a crisis when things change continually. Most people dislike change.

Exercise Emotional Intelligence: cannabisbusinessexecutive.com

Despite COVID-19, NY Still Pushing Toward Legalization of Recreational Cannabis
Just when the COVID-19 started to spread, New York's lawmakers and advocates were already over a year in the process of legalizing recreational cannabis for adults 21 and older. Political negotiations were made, proposals were presented from all sides but a "final deal" did not take place since, among other things, issues with the tax revenue were not resolved at the time. On top of this, to this day, New York has been hit the hardest by COVID-19 and the numbers are only slowly decreasing with 288,000 affected and over 17,000 deceased.

Just last week, one of the top lawmakers in New York expressed their hope to finally get marijuana legalized this year despite COVID-19 being in the spotlight. Apparently, one of the main hurdles was financial. It just didn't fit into the governor's budget anymore that currently needs to be used for effectively diminishing the COVID-19.

Other options would be ballot referendums that were used in states, such as California, Nevada, Maine and Oregon. These are usually introduced by lawmakers and activists that collect enough petition signatures to get the referendum on the ballot but it's been argued that in New York's case this would be very difficult to achieve due to the special type of infrastructure that it has compared to other states. sapphirerisk.com

How cannabis retailers can operate safely during and in the aftermath of coronavirus

Upcoming Webinar
Keeping Your Cannabis Business Safe: Q&A Session with Cybersecurity Expert Michelle Drolet

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

 

	District Loss Prevention Manager Cressona, PA Area The District Loss Prevention Manager ensures shrinkage control and improves safety in the stores through proper investigation and training. This position is responsible to provide feedback, guidance and protection for our Team Leaders and Associates. This role has oversight and responsibility for approximately 8 to 10 store locations...
	Physical Security Leader Corte Madera, CA Responsible for leading and execution of the Protection and Prevention tiers of the Profit Protection strategy for all RH locations including our Corporate Campus in Corte Madera, CA - PROTECTION - Access Control | Alarms | CCTV | Guards - PREVENTION - Awareness | Audits | P&P | Training...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily