9/24/20

LP, AP & IT Security's #1 News Source

Don't miss Day 4 as NRF PROTECT ALL ACCESS ends with a bang tomorrow!




Miss a session? Register here and watch all videos on-demand!


Mark Your Calendars: NRF PROTECT 2021 will take place June 14-16, 2021 in Grapevine, Texas. Registration will open shortly after the digital event.

More Than 1,000 Californians May Have Died from Wildfire Smoke
The heavy smoke from wildfires that choked much of California in recent weeks was more than an inconvenience. It was deadly. And it almost certainly killed more people than the flames from the massive fires themselves, health experts say.

Between Aug. 1 and Sept. 10, the historically bad concentrations of wildfire smoke were responsible for at least 1,200 and possibly up to 3,000 deaths in California that otherwise would not have occurred, according to an estimate by researchers at Stanford University. Those fatalities were among people age 65 and over, most of whom were living with pre-existing medical conditions like heart disease, diabetes and respiratory ailments.

By comparison, through Wednesday, 26 people have died directly in wildfires this year statewide. govtech.com

  Northern California and Bay Area face high winds, critical fire danger this weekend


NRF Recognized with "Pledge to America's Workers" Presidential Award
This week the White House honored the National Retail Federation with the Pledge to America's Workers Presidential Award, recognizing the NRF Foundation's RISE Up initiative. Ivanka Trump and Commerce Secretary Wilbur Ross highlighted NRF and eight additional businesses and trade organizations for their workforce development programs.

A White House initiative, the "Pledge to America's Workers" aims to increase the skills of the U.S. workforce by expanding apprenticeships, educational opportunities and job training programs. NRF was among the original signers of the pledge in 2018 and committed to create enhanced career opportunities for 250,000 individuals over the next five years.

"The National Retail Federation has demonstrated a meaningful and substantive commitment toward re-skilling and investing in the futures of their workers, more urgent now than ever before due to the changes brought on by the pandemic," said Ivanka Trump. "Prioritizing American workers and ensuring they are well prepared for the jobs of today and tomorrow will guarantee the continued exceptionalism of our country's workforce for decades to come." nrf.com

American Crime Prevention Institute to deliver online
crime prevention training and certification
The American Crime Prevention Institute (ACPI) and SecureBI have partnered to bring online crime prevention training and certification courses to law enforcement agencies and security professionals across the country. ACPI has pioneered the development and delivery of in-person crime prevention training and certification programs for law enforcement since 1998. ACPI certifications are well-respected throughout the public safety arena, demonstrating a commitment to crime prevention and expertise in proactive security strategies. securitymagazine.com

Neiman Marcus New Round of 'Widespread Layoffs' Started This Week


Quarterly Results
Rite Aid Q2 comp's front-end comp's up 6.1%, retail pharmacy comp's up 2.5%, sales up 11.5%
 

Fraud has long been a pain in the retail concern. That concern doubles when it comes to fraud committed by retailers' own employees. With insider knowledge of their employers' security protocols (and by extension, how to sidestep them), employee fraud is notoriously difficult to catch with conventional security methods like CCTV, anti-theft alarms, etc.

Enter prescriptive analytics. This robust, award-winning software solution uses data to identify even the most subtle instances of fraud and alert loss prevention to their occurrence. It also sends the stakeholder prescriptive actions in plain text, dictating a response for launching an investigation into the suspected fraud. In this insightful webinar, Scott Pethuyne will explain how and why prescriptive analytics is an invaluable asset in the modern loss prevention professional's arsenal, using real case studies from the world's best-known retailers.

At the end of the session, Zebra Prescriptive Analytics will also give away 5 free LPC Course Scholarships to random webinar attendees! Winners will be notified the day following the Webinar via email.

This webinar is presented by the Loss Prevention Foundation in partnership with Zebra Prescriptive Analytics and qualifies for 1 continuing education unit (CEU) towards your LPC recertification or CFI recertification.

Insider Threat: E-Commerce Hack Hits Nearly 200 Retailers
Shopify's Employee Data Theft Underscores Risk of Rogue Insiders

The e-commerce platform has alerted more than 100 merchants of a data breach, highlighting the danger of malicious insiders.

Shopify has confirmed a security incident in which two support team employees were involved in a scheme to steal customer transaction records from specific merchants. The activity affected fewer than 200 merchants, the e-commerce platform reports.

Merchants whose stores were illegitimately accessed may have had customer data exposed, according to a company blog post. This information includes basic contact data, such as name, email and physical addresses, and order details such as products and services purchased. The customers' payment card data and other financial records were not targeted in the theft.

While Shopify did not report when the theft took place, an email sent to the customers of cosmetics seller 100% Pure indicates transaction records were accessed on Sept. 15, according to a report from Bloomberg.

Upon learning of the employees' involvement in the scheme, Shopify terminated their access to its network and referred the incident to law enforcement. It says there is no indication the stolen data has been used; however, it's working with the FBI and international agencies in an ongoing investigation and will update affected merchants as needed, Shopify says in an update.

The company notes the incident did not stem from a technical vulnerability in its platform, and the majority of sellers are not affected. darkreading.com

When Was Your Last Table Top Exercise?
Firms Conduct 'War Games' to Prepare for External Threats
Some companies are taking role-playing to a new level when it comes to mitigating risks that could potentially disrupt a business.

For years, companies have dabbled in scenario planning, also known as war gaming or tabletop exercises, to help understand and reduce risk. Recently, amid tariff talks, threats of trade wars, geopolitical uncertainty, and, of course, the global pandemic, such gaming has become more popular.

The drills can be designed to help companies work through multiple types of external threats. Cyber-threats are common, but other examples can be weather-related disasters (including climate change), tariffs, changes in interest rates, active shooters and other forms of risk. Of course, pandemic-related threats are also becoming an increasingly popular tabletop exercise.

"There has been a rising sense that the world is becoming more complicated and resiliency is something executives need to think about," says Ed Barriball, a partner at McKinsey & Co. "I think for a lot of folks, Covid brought that fully into focus."

"You don't want to do discovery learning at the point of crisis," "Executives don't really realize how much they are not communicating,"

Common communication problems, such as not understanding roles and responsibilities, tend to be exposed when realistic scenarios are designed. Executives tend to make uninformed assumptions or judgments.

Ideally, consultants say, the exercises lead to productive changes in a company's policies, procedures and division of responsibilities. wsj.com

Jazz It Up - Make it Interesting & Challenging
Security awareness training key to changing security culture
As users receive more security awareness training, their ability to effectively deal with security threats increases, reveals a new study by MediaPRO, co-sponsored with Osterman Research. The report also found that boring security awareness training doesn't make employees want to be secure.

"Our research found that users who found training to be 'very interesting' were more than 13 times more likely to make fundamental changes in the way they think about security compared to those who found the training to be 'boring'," said Michael Osterman, researcher and president of Osterman Research, who conducted the study.

The research supports the claim that employees get far more benefit out of interesting and engaging training, joining facts such as "the sky is blue," and "water is wet."

The study, Security Awareness Training as a Key Element in Changing the Security Culture (requires registration), surveyed both everyday employees and IT managers and decision makers to gauge opinions on the current state of security training and awareness. The work was co-sponsored by training and awareness firm MediaPRO, who wouldn't know how to produce boring training if you gave them directions. securitymagazine.com

Microsoft Warns That Critical Windows Server 'Perfect 10' Exploit Attack
Is Underway
Microsoft Security Intelligence has tweeted that it is "actively tracking" Zerologon attack activity by threat actors exploiting CVE-2020-1472. This follows multiple examples of proof of concept exploit code being released into the public domain, which prompted the CISA directive. " inhomelandsecurity.com

NIST Cybersecurity and Privacy Program
Performance Measurement Guide for Information Security:
Pre-Draft Call for Comments
NIST is planning to update NIST Special Publication (SP) 800-55 Revision 1, Performance Measurement Guide for Information Security. For more details on an opportunity to provide input, see the Call for Comments which is open through November 19, 2020. govdelivery.com

Nationwide 'Synthetic Identity' Fraud Scheme $100M
Hauppauge, NY: Suffolk County police have charged 13 people and three corporations in a $ 1 Million Identity Theft Ring
According to District Attorney Tim Sini, the victims were mostly children and it's unlikely that their parents had any idea until the 13 individuals were arrested and charged in Suffolk County. Some adults and teenagers were also targeted. Sini says the group worked to steal the social security numbers of children and would then open multiple credit cards in their names.

In total, the group generated $1 Million in loans and credit.

Sini said while local losses topped $1 million dollars, authorities believe the same schemers amassed a credit limit of hundreds of millions of dollars across the country.

The DA notes that the ring was a nationwide scheme, with the ringleader living in California. Nationwide, the losses totaled $100 million. "It's a 108-count indictment and certainly it is the first of its kind here in Suffolk County," Sini said.

The DA called the indictment "historic" and said the prosecution was the first of its kind in Suffolk to target a new kind of criminal scheme."With the stolen social security numbers, the defendants that are charged in this indictment would use their name and date of birth and typically the address would be a random address selected here in Suffolk County," explained Sini. Sini says the false identities are known as "synthetic identities" as they use a combination of real social security numbers with fake names and addresses.

In the case under prosecution locally, the fraud scheme infiltrated 19 financial institutions, including local entities Bethpage Federal Credit Union, Nassau Financial Federal Credit Union, Suffolk Federal Credit Union and the formerly named Nassau Educators Federal Credit Union, according to prosecutors. wcbs880.radio.com

Vacaville, CA: Police arrest 2, 1 with 8 warrants, after theft and chase
"He has eight warrants" was the information given to patrol officers Monday as they responded to a business on the 3000 block of Harbison Drive, police reported Wednesday. A store employee recognized a man from several prior thefts walking out of the store with a box full of cargo that was not paid for. The employee was able to provide a description of the man along with the vehicle and license plate as it left the area.

Police report that an officer located the suspected vehicle a short time later while speeding through a retail area and passing other vehicles. Jamie C. Thomas, 37, and Tamara N. Weaver, 38, were found inside the vehicle after it was stopped.

Suspected stolen property filled much of the vehicle's interior, according to police. Police report that as the suspected stolen property was sorted through, evidence of identity theft was found as well as a loaded firearm that was wedged between the front passenger seat and door. Thomas was detained for his eight misdemeanor warrants and arrested anew on suspicion of two theft-related offenses and a pair of suspected drug-related offenses. Solano County court records indicate that he has 17 aliases and is due in court in March. He was not listed Wednesday as being in custody. dailyrepublic.com

Rochester, NY: Over $1,700 in merchandise stolen from Von Maur at Eastview
The Ontario County Sheriff's Office reports the arrest of a Rochester resident following a large theft at Von Maur at Eastview Mall. Deputies arrested Lynn Feeney, 40, of Rochester for grand larceny after an investigation on Wednesday around 8 p.m. at the mall. She's accused of concealing $1,758 worth of merchandise before exiting the store. fingerlakes1.com

Galesburg, IL: Man busted for multiple theft from Walmart totaling over $1,300; using self-checkout
September 17th, Galesburg Police were notified by Walmart Loss Prevention employees that a male subject had been stealing high-priced items from the retail store for a week now. The Loss Prevention employees followed 50-year-old Robert Bollinger that day after he left Walmart to a residence on East North Street where GPD made contact. According to police reports, GPD reviewed several surveillance videos and photos of Bollinger in the store and at the self check-out machines. Each time Bollinger stole from the store, he would scan a trial-sized stick of Degree deodorant valued at 97 cents - but then walk out with the high-priced item. On September 11th he stole a Mainstays Mantel Fireplace; September 12th - a 32 inch TV; September 13th - a mini-fridge; September 14th - an upright air compressor; September 15th - a 43-inch TV; and September 17th - a child's Ride-on ATV. The total value of all the items stolen came to $1,379. Bollinger has a prior conviction of larceny. wgil.com

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights
 

	Asset & Profit Protection Investigations Analyst San Francisco, CA - posted September 24 You should have strong analytical skills, be a quick learner, and drive to innovate with both technology and processes. They will be personable, open to learning, collaborating with others, and apt to saying "yes" or "I'll find a way", rather than "no" or "that's impossible"...
	Area Loss Prevention Manager Pittsburgh, PA - posted September 10 Our Area Loss Prevention Managers ensure safe and secure stores through the objective identification of loss and risk opportunities. Our Area Loss Prevention Managers plan and prioritize to provide an optimal customer experience to their portfolio of stores. They thrive on supporting and building high performance teams that execute with excellence...
	Manager of District Loss Prevention Seattle, WA - posted August 28 Will be responsible for driving company objectives in profit and loss control, sales performance, customer satisfaction, and shrink results. District Loss Prevention Managers are responsible for leading Loss Prevention functions within a specific operations district and for collaborating with Store Operations and Human Resources in an effort to prevent company loss...
	District Loss Prevention Manager Fort Wayne, IN - posted August 24 The District Loss Prevention Manager ensures shrinkage control and improves safety in the stores through proper investigation and training. This position is responsible to provide feedback, guidance and protection for our Team Leaders and Associates. This role has oversight and responsibility for approximately 16 to 20 store locations...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

View Featured Jobs   |   Post Your Job
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

FEEDBACK    /    downing-downing.com    /    Advertise with The D&D Daily