7/8/21

LP, AP & IT Security's #1 News Source

LPRC Report:
Feedback and Trial Results of CIS Security Solutions' Tick-R-Tape Technology

Package tags and wraps are widely used to protect merchandise. However, as retail offenders adapt and learn techniques to defeat these technologies, solution providers must respond by developing new, more secure ways to protect products.

CIS Security Solutions Inc. developed and sought to test their Tick-R-Tape technology, a universal package tag designed to protect hard and soft merchandise.

In 2019, the Loss Prevention Research Council worked with a large department store chain to better understand the effects of implementing CIS' Tick-R-Tape in-store. The goals of the research were to:

1. Examine offender reactions to the Tick-R-Tape technology

2. Understand customer perceptions of CIS' Tick-R-Tape technology

3. Understand associate perceptions of CIS' Tick-R-Tape technology

4. Compare the Tick-R-Tape to traditional keeper boxes and spider-wraps by examining size differences and shelf availability between the technologies

NRF Retail Converge Session
How to protect your company from cyberattacks

NRF Retail Converge: Former NSA director discusses disruptive cyber threats

In a session at NRF Retail Converge, Admiral Mike Rogers, former director of the National Security Agency, discussed cyber threats and risks with Matt Dunlop, chief information security officer at Under Armour.

Dunlop kicked off the session by noting that he hears about a cyberattack seemingly every day. Rogers agreed, saying that in the past few years, many U.S. companies have been the target of cyberattacks, often resulting in leaked data and hefty ransom payouts. With increased remote work during the pandemic, the frequency has only increased.

The more attacks that happen, the more media coverage they receive, which includes sharing the ransom payout the attackers received. That just incentivizes criminals to continue targeting large companies, Rogers pointed out. But despite these criminals receiving millions of dollars, only 8 percent of companies get their data back.

That loss of data is particularly potent for retailers, as their reputations and revenue can be impacted by a cyberattack. "As you look across the retail space," Dunlop said, "if you can impact our ability to pick, pack, and ship, you can impact our revenue."

While most companies are spending their money and efforts on a cyber defense system, Rogers said a focused adversary has a high probability of success no matter how much money is being spent on defense.

"Cybersecurity needs to include both cyber defense and cyber resiliency," Rogers said, explaining that companies can not only prevent attacks but take action during them. nrf.com

Data-Leaking Security Flaw
Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software
Last week cybercriminals deployed ransomware to 1,500 organizations that provide IT security and technical support to many other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large networks remotely. Now it appears Kaseya's customer service portal was left vulnerable until last week to a data-leaking security flaw that was first identified in the same software six years ago.

On July 3, the REvil ransomware affiliate program began using a zero-day security hole (CVE-2021-30116) to deploy ransomware to hundreds of IT management companies running Kaseya's remote management software - known as the Kaseya Virtual System Administrator (VSA).

According to this entry for CVE-2021-30116, the security flaw that powers that Kaseya VSA zero-day was assigned a vulnerability number on April 2, 2021, indicating Kaseya had roughly three months to address the bug before it was exploited in the wild.

Also on July 3, security incident response firm Mandiant notified Kaseya that their billing and customer support site -portal.kaseya.net - was vulnerable to CVE-2015-2862, a "directory traversal" vulnerability in Kaseya VSA that allows remote users to read any files on the server using nothing more than a Web browser.

As its name suggests, CVE-2015-2862 was issued in July 2015. Six years later, Kaseya's customer portal was still exposed to the data-leaking weakness.

Mandiant notified Kaseya after hearing about it from Alex Holden, founder and chief technology officer of Milwaukee-based cyber intelligence firm Hold Security. Holden said the 2015 vulnerability was present on Kaseya's customer portal until Friday afternoon, allowing him to download the site's "web.config" file, a server component that often contains sensitive information such as usernames and passwords and the locations of key databases.

"It's not like they forgot to patch something that Microsoft fixed years ago," Holden said. "It's a patch for their own software. And it's not zero-day. It's from 2015!" krebsonsecurity.com

Not as Damaging as Initially Feared
Kaseya Ransomware Attack: 'It Could Have Been Much Worse'

Michael Daniel of Cyber Threat Alliance on Impact of Latest Supply Chain Attack

It was stealthy, and it was widespread. But perhaps the Kaseya VSA ransomware attack wasn't quite as effective and damaging as initially feared, says Michael Daniel, president and CEO of the Cyber Threat Alliance. He explains where defenses succeeded.

In a video interview with Information Security Media Group, Daniel discusses:

● The significance of the Kaseya attack;
● Why the attack might not have been as successful as initially believed;
● How U.S. ransomware defense needs to change - starting with disrupting the adversaries.

Daniel serves as the president and CEO of the Cyber Threat Alliance, a nonprofit organization that enables high-quality cyberthreat information-sharing among cybersecurity organizations. He also works with the Aspen Cyber Group, the World Economic Forum and other organizations improving cybersecurity in the digital ecosystem. bankinfosecurity.com

Study Recommends Government & Industry Action
Cyber insurance failing to live up to expectations
A RUSI paper finds that the contribution of the insurance sector to improving cyber security practice is 'more limited than policymakers and businesses might hope', and recommends government and industry action.

Identified along climate change and pandemics as 'one of the most challenging risks facing societies in the next five years' by the World Economic Forum, cybercrime is a complex, rapidly growing and severe threat to both government and business. In 2020, cybercrime costs the world economy more than $1 trillion.

This rise is taking place at a time of rapid change in the online environment as organizations seek to digitalise, increase connectivity and accommodate increased remote working, heightening the need for protection. With both national infrastructure and economic security at risk, 'one tool that has gained traction is cyber insurance'.

Not only is cyber insurance seen as a way for organizations to reduce the impact of cybercrime by transferring financial risk to insurers, but, as the market grows and matures, cyber insurers are seen as potentially able to fulfil the role played by insurers in other industries.

Being "well placed to incentivise better cyber security practices... they can reward 'good' risk management", or offer financial benefits and specialist knowledge to organizations implementing higher security controls or standards. helpnetsecurity.com

Using A.I. to Find Bias in A.I.
More than a dozen start-ups and some of the biggest names in tech, offering tools and services designed to identify and remove bias from A.I. systems.

It is unclear how regulators might police bias. This past week, the National Institute of Standards and Technology, a government research lab whose work often informs policy, released a proposal detailing how businesses can fight bias in A.I., including changes in the way technology is conceived and built.

Many in the tech industry believe businesses must start preparing for a crackdown. "Some sort of legislation or regulation is inevitable,"

Over the past several years, studies have shown that facial recognition services, health care systems and even talking digital assistants can be biased against women, people of color and other marginalized groups. Amid a growing chorus of complaints over the issue, some local regulators have already taken action.

But efforts to address the problem reached a tipping point this month when the Software Alliance offered a detailed framework for fighting bias in A.I., including the recognition that some automated technologies require regular oversight from humans. The trade group believes the document can help companies change their behavior and can show regulators and lawmakers how to control the problem.

Though they have been criticized for bias in their own systems, Amazon, IBM, Google and Microsoft also offer tools for fighting it. nytimes.com

Impersonation Becomes Top Phishing Technique

Cannabis Shops Vulnerable to Violent Crime
Increase in Dispensary Crime Just Reaffirms the Need for Cannabis Banking

Many legal cannabis businesses are forced to be cash-only, leaving them vulnerable to burglaries, robberies, and violent crimes.

Despite most states legalizing cannabis in some form, it is still federally illegal. So many banks, credit unions, and lenders refuse to conduct business with licensed cannabis companies out of fear of federal retaliation.

Responding to this, lawmakers have introduced the SAFE Banking Act as bipartisan legislation that would impede federal banking regulators from intervening in a financial institution's ability to conduct business with plant-touching cannabis companies and ancillary brands that service the industry. Legislators have attempted to pass various versions of the SAFE Banking Act over the past several years. In April 2021, the latest version passed in the House with overwhelming bipartisan support. It's now waiting to be passed in the Senate before being signed into law by President Biden.

But until the SAFE Banking Act is signed into law, many cannabis businesses and their employees cannot easily access banking services and rely on cash to operate, leaving them exposed to a variety of crimes.

While large, multi-state operators (MSOs) and other big players can afford heavy security, such as armored vans to transport cash and armed guards to protect their stores; smaller shops cannot afford the same protections. Without access to traditional business loans, some retailers have no way to recover from the damages incurred by burglaries and robberies.

Even if a dispensary is banked, they still cannot legally accept credit or debit cards as forms of payment, constraining them to accept cash only. Coupled with the fact that bad actors can resell their products at much higher rates on the illicit market in non-legal states, dispensaries are an easy and obvious target.

The ever-increasing occurrence of violent incidents has sparked more conversation about whether pot shops should allow their employees to carry weapons. Those in favor of this added level of protection cite the daily threats that dispensary workers face. greenentrepreneur.com

The Future of the Cannabis Industry
What Will the Cannabis Industry Look Like In Ten Years?
For a variety of reasons, I recently found myself inside a legal marijuana dispensary for the first time. I wasn't sure exactly what I expected the retail experience to be like - a liquor store? a coffee shop? a used car lot? the paraphrenelia shops I first checked out as a teenager? - but I was nevertheless surprised.

The closest analogy I can think of is a jewelry store. There was pretty decent security, including a whole separate room for customers to check in, and everything was presented in a secure display case. A salesperson walked you through the samples to answer questions, guide you in one direction or another, and take your order, while the order itself was filled in a secure area away from the showroom. The other shopping experience I've had that's similar was buying medical equipment, which makes some sense given the origin of a lot of retail dispensaries in the medical marijuana era. You could also say it's a little like a pharmacy (which again, is probably unsurprising).

Some of the setup of dispensaries is a function of legal regulations (do you need to check IDs and differentiate between medical and recreational customers?) and some of it solves some practical problems (weed is expensive and there's still a viable aftermarket, so you are in principle a target for theft).

But it's also a question of culture: who's involved in the transaction as a seller and as a buyer, and what are their assumptions and competencies that they're bringing to the party (so to speak)?

Someone with more than a passing acquaintance with these shops and their alternatives will have to do the full anthropology. But it does seem to me that with the legalization of marijuana, we are in the process of changing more than who is allowed to get high and who is allowed to get paid without being punished. kottke.org

Coming to a Neighborhood Near You: Cannabis 'Coffee Shops'
Cannabis Lounge: Restaurant or Dispensary?
The idea of a cannabis "coffee shop" has been around for decades: a place where a person of legal age can go to consume cannabis while on-site in a relaxing environment, free from judgment. While the same base desires for a similar space still exist within the average cannabis consumer, the level of expectation and innovation for the fulfilment of those desires by the consumer is exceedingly complicated to bring to fruition. The amount of regulations around cannabis consumption are either very complicated, or do not exist at the level that allows for licensing/providing for public consumption spaces. In fact, one of the only crimes that has increased in states that allow for recreational cannabis is consuming illegally in a public space.

The desire for places to legally consume cannabis outside of a private residence needs to be accounted for in regulations, and normalized within the states that have legal cannabis. Beyond that, running a consumption lounge is a feat in-and-of itself: complying with regulations, intersecting hospitality and the traditional dispensary model, "turning tables," monitoring consumption, allowing for and monitoring "takeaway" product, all underscoring the main goal of trying to create the best customer experience and journey possible. sapphirerisk.com

Medical marijuana gets broad approval in first vote by North Carolina lawmakers

Connecticut launches new website dedicated to recreational marijuana updates

Opportunities in the Texas Cannabis Market

Amazon Price Gouging Lawsuit
Class-action lawsuit accuses Amazon of 'exploiting consumers in their most vulnerable hour' during the pandemic

A lawsuit filed in California says Amazon hiked up prices by as much as 1,000% during the pandemic.

A lawsuit accuses Amazon of "exploiting consumers in their most vulnerable hour" by hiking up prices on medical items, cleaning products, canned food and other necessary supplies during the coronavirus pandemic.

The class-action lawsuit has now expanded to potentially include all Amazon shoppers across the US who purchased such products, the law firm Hagens Berman said on Friday.

The lawsuit says American consumers turned to Amazon and other online retailers at the height of the coronavirus pandemic in the spring of 2020, when stay-at-home orders and the threat of the disease made it difficult to purchase much-needed food and supplies.

"In this environment-consistent with the directions of government and public health officials-consumers have understandably turned to online purchasing, and Amazon in particular, to fulfill their essential needs," the lawsuit says. "Without venturing into public and risking exposure to themselves and others, with just a few clicks Americans can purchase consumer goods from Amazon that will be delivered to their homes."

Amazon did not immediately reply to a request for comment from Insider asking about the lawsuit.

The lawsuit alleges the e-commerce giant significantly hiked up prices of various goods. The cost of face masks, for example, jumped 500%, the lawsuit alleges, from $20 to $120. Disinfectant cost went up by 100%, the lawsuit says, while the cost of an ordinary staple pantry item like black beans went up by 672%. Among other items whose costs drastically went up on Amazon were pain relievers, flour, and cold remedies, according to the lawsuit.

The complaint, first filed in April 2020 in California's Northern District Court, says some items went up by as much as 1,000%. businessinsider.com

New Online Tech Helps Retailers Solve the 'Fitting-Room Dilemma'
Shuttered fitting rooms anger shoppers and drive up online returns

With the health crisis serving as a wake-up call, retailers including the biggest in the country, Walmart, are looking for ways to fix the fitting-room dilemma.

The headaches for consumers are somewhat obvious: Not being able to try on items in stores means potentially stocking up on extra sizes, like Hearden did, to later see what works at home. Shoppers tend to employ a similar strategy when looking for clothes or shoes online - they'll buy a dress in two or even three sizes - which has increasingly happened over the course of the health crisis. For businesses, this chain of events sends return rates skyrocketing. And that comes with a cost. With the Covid pandemic serving as somewhat of a wake-up call, retailers including the biggest in the country, Walmart, are looking for ways to solve the fitting-room dilemma.

Retailers are now turning to smaller start-ups that have been working on technology, for years, to fix this very issue.

3DLook, a mobile body-measuring technology business, recently debuted a new platform, called "YourFit," that it plans to offer to more apparel retailers. It allows shoppers to virtually try on clothes and will make sizing recommendations based on user data. The technology aims to show customers exactly how the clothing will look on them, in a virtual experience online or on a smartphone. cnbc.com

Amazon launches at-home COVID-19 test kit for $39.99

Hopewell, VA: Investigation underway after man shot to death outside Hopewell convenience store
A homicide investigation is underway in Hopewell after a man was shot to death outside a convenience store Wednesday night. Around 9:30 p.m., Hopewell Police and EMS responded to reports of a person shot near the gas pumps at the Quick Express Store on S. 15th Avenue. Upon their arrival, they found a man unresponsive with life-threatening gunshot wounds. wric.com

Bellevue, WA: Man shot, killed in Factoria Mall parking lot
Bellevue police are searching for a gunman after a fatal shooting in the parking lot of the AMC theater at Factoria Mall on Wednesday night. Witnesses found the man in his 20s in the parking lot and began rendering aid until police arrived. He was taken to Harborview Medical Center, where he later died of a single gunshot wound to the chest. The Bellevue Police Department tweeted around 9:30 p.m. that this is now a homicide investigation. mynorthwest.com

Decatur, GA: Grandmother begs for answers after 19-year-old gunned down at convenience store
Police are searching for a gunman in a deadly shooting outside of a DeKalb County food mart Wednesday night. Now the 19-year-old victim's grandmother is speaking out about her loss. Johnnie Jones described her grandson Jakare McKellar as a "loveable kid." The 19-year-old was outside a Food Mart on 3800 block of Flat Shoals Parkway, just outside of Interstate 285, when he was gunned down late that night. Police on the scene didn't say much about the investigation. McKellar's family tells us a car drove up and someone started, killing the young man. No arrests have been made. fox5atlanta.com

Update: Mason, MI: Gun store reforms policies in response to lawsuit on 2018 murder-suicide
A Mason gun store and range has agreed to implement policy reforms in response to a lawsuit filed by the mother of a woman killed by her ex-boyfriend with a gun he rented, then stole, from the store, according to the mother's lawyer. Rachel Duncan, a 25-year-old Charlotte woman, was shot and killed by her ex-boyfriend, Timothy Olin, in March 2018, after Olin rented a semi-automatic handgun at Total Firearms in Mason and walked out with the gun after target practice, police said in 2018. lansingstatejournal.com

Noble County, IN: Kendallville Gas Station shooting suspect to seek insanity defense in murder trial
The man accused of wounding two people and killing one more at a Kendallville gas station appeared in court to face charges Wednesday. Matthew Rodriguez, 24, is now back in Noble County after he was captured in Ohio last week. He is accused of fatally shooting Justin Smead inside the Gallops Party store and gas station, while leaving Blake Lewis and Alyssa Jefferies wounded.

Prosecutors charged him with murder and attempted murder in connection to the crime. An attorney representing Rodriguez filed a notice of defense of mental disease or defect commonly referred to as the insanity defense Wednesday. The attorney also asked that his client undergo a psychological evaluation. The judge ordered him to be checked out by two mental health doctors, and they will determine his competency to stand trial. wpta21.com
 

Robberies, Incidents & Thefts

Nashville, TN: Man arrested in gas station clerk stabbing
Metro Police have arrested and charged a man with especially aggravated robbery after they say he stabbed a gas station clerk on Sunday. The stabbing at the Sam's Express on East Thompson Lane sent the clerk to the hospital and kicked off a search to identify the man captured on surveillance video. Police say the suspect, 46-year-old Arrick Darnell Fields, walked into the Sam's Express to buy chips. When he went to the counter to pay for his chips, the cashier opened the register, and Fields reportedly attempted to come around the counter. Police say surveillance video shows the ensuing fight between Fields and the clerk, which ended with Fields stabbing the clerk with a sharp object multiple times.  wsmv.com

Davenport, IA: Iowa State University employee accused of mishandling $115K in credit card fraud
An Iowa State University employee is accused of mishandling the school's money. Investigators say 25-year-old Miranda Richmann put more than $115,000 on a credit card shared between certain employees. She is accused of using that card at several banks, Target, Venmo and Walmart. It's issued to be used only for work-related items. When police contacted her, she admitted to using the card to pay her attorney fees and other debt. She was arrested and charged with three counts of unauthorized use of credit card and has since bonded out of the Story County Jail. According to the university's website, Richmann is a secretary in the Human Development and Family Studies Department. kcci.com

Gillette, NJ: A Family Falsely Accused Of Shoplifting in a TJ Maxx
A Family Falsely Accused Of Shoplifting At A TJ Maxx in Gillette, NJ. The women tell the officer he doesn't understand how embarrassing it is to be accused of shoplifting after spending almost $300. A three-part series of TikTok videos documenting three Black women being suspected of shoplifting at a T.J. Maxx in Gilette, New Jersey, has gone viral and sparked accusations of racial profiling. The first video featuring the incident garnered more than 1 million views, with people weighing in on the apparent inconsistencies in the security officer's story and his accusatory questions. The officer initially tells the three women he received a call from a Black man for possible shoplifting. Later in the videos, the officer says he talked to the man in person.

According to a study on the experience of Black shoppers in retail stores, 80% of Black shoppers reported experiencing racial stigma and stereotypes while shopping, and 59% reported being perceived as a shoplifter. The 55 middle-class Black shoppers interviewed in the study reported being followed around the store, ignored, and informed of the sale section without asking.  dailydot.com

Atlanta, GA: Shaq's historic Krispy Kreme doughnut shop in Atlanta catches fire for second time less than five months after arson attack
Firefighters were called to the Atlanta landmark on Wednesday afternoon. No one was injured in the blaze, investigations are ongoing to determine cause. It is the second fire this year at the doughnut shop, which was hit by arson in Feb. It has yet to reopen following extensive damage sustained in the earlier blaze. Basketball legend Shaquille O'Neal bought the building in 2016 The store has stood on the same site for more than 60 years and donated 150 dozen doughnuts to mourners at Atlanta churches following MLK's funeral. dailymail.co.uk

Pecos, NM: Dollar General shoplifter accused of pointing gun at New Mexico State Police Officer
New Mexico State Police say a call turned into a dangerous situation for an officer. Last Wednesday, NMSP were called to the Dollar General in Pecos when Officer Ray Montoya arrived, and a man identified as Isaac Valencia, 39, and two women, one identified at Josephine Vigil, was walking out of the store suspected of shoplifting. When Officer Montoya tried to stop them, police say Valencia pointed a gun at the officer's face. NMSP says they began to wrestle for control of the gun during which Officer Montoya was able to convince Valencia to let go. He was eventually arrested and faces charges including aggravated assault on a police officer. krqe.com

Abilene, TX: Man admits to robbing 3 convenience stores at gunpoint

Peoria, IL: Gun store burglary suspect now in custody

Brazilian iPhone thieves reveal trick to 'hack' devices with shocking ease

Alexandria, VA: Man arrested five months after DNA links to 7-Eleven break-in

Los Angeles, CA: Gardena Man Charged in Indictment Alleging Five-Day Armed Robbery Spree of Donut Shops, Pet Clinic, and Other Businesses

Miami, FL: Serial Armed Robber Pleads Guilty in Ft. Lauderdale Federal Court

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights
 

	Asset Protection Coordinator Rochester, NH - posted June 17 Preventing and deterring theft and limiting the loss of company assets in the stores through best-in-class service, healthy business partnerships, profit analysis, and investigations. Oversee and complete Asset Protection Department responsibilities including but not limited to internal theft investigations, external theft investigations, and physical security...
	Asset Protection Coordinator York, ME - posted June 17 Preventing and deterring theft and limiting the loss of company assets in the stores through best-in-class service, healthy business partnerships, profit analysis, and investigations. Oversee and complete Asset Protection Department responsibilities including but not limited to internal theft investigations, external theft investigations, and physical security...
	Asset Protection Coordinator Dover, NH - posted June 17 Preventing and deterring theft and limiting the loss of company assets in the stores through best-in-class service, healthy business partnerships, profit analysis, and investigations. Oversee and complete Asset Protection Department responsibilities including but not limited to internal theft investigations, external theft investigations, and physical security...
	Sr. Lead, Organized Retail Crime Baltimore, MD - posted May 25 The Sr Lead, Organized Retail Crime (ORC) is responsible for the direction and support of Organized Retail Crime (ORC) investigations, strategies and training to ensure the effective execution of asset protection and retail initiatives...
	Area Loss Prevention Manager Pittsburgh, PA - posted May 11 Our Area Loss Prevention Managers ensure safe and secure stores through the objective identification of loss and risk opportunities. Our Area Loss Prevention Managers plan and prioritize to provide an optimal customer experience to their portfolio of stores. They thrive on supporting and building high performance teams that execute with excellence...
	Area Loss Prevention Manager Sacramento, CA - posted April 20 Our Area Loss Prevention Managers ensure safe and secure stores through the objective identification of loss and risk opportunities. Our Area Loss Prevention Managers plan and prioritize to provide an optimal customer experience to their portfolio of stores. They thrive on supporting and building high performance teams that execute with excellence...
	Corporate Security Manager Calabasas, CA - posted April 6 The Corporate Security Manager will, among other things, (a) be responsible for ensuring a safe and secure environment for our employees, vendors, and visitors, (b) develop, manage, execute and continuously improve corporate security processes and protocols, and (c) lead a team of security specialists at our corporate offices...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily