Retail & Hospitality ISAC and Security Innovation to Host Inaugural Security Awareness Symposium

The virtual event on Oct. 26 will offer multiple sessions, hands-on training exercises for both technical and non-technical audiences, and speakers from leading corporations.

Vienna, VA (October 5, 2021) - The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) announced today it is partnering with Security Innovation to provide in-depth cybersecurity training for employees across the retail and hospitality sector during Cybersecurity Awareness Month this October.

The inaugural Security Awareness Symposium is a virtual, full-day event that will take place on Tuesday, October 26, and is ideal for general employees, IT personnel, and security partners across the organization. The morning program includes different sessions on "The Future of Secure Work" and "Phishing & Social Engineering" while the afternoon program provides hands-on training for technical and non-technical staff.

For the technical track, Security Innovation will provide a hands-on hacking challenge leveraging Shred Skateboards, one of their CMD+CTRL Web Application Cyber Ranges. Shred is a fully functional eCommerce platform that represents the threats and attacks commonly seen in Retail & Hospitality IT systems. With over 35 different vulnerabilities, players try to buy items in an unintended way, crack passwords, tamper with other users' functionality, and conduct other nefarious acts. This hands-on experience builds an attack mentality and reinforces the implications of insecure software development practices.

The closing keynote will feature a panel discussion about the growing risk that third-party and supply chain vendors can create for organizations. Ed Adams, CEO of Security Innovation, will moderate and the panelists will be Kara Gunderson, Director of Payment Card Operations at CITGO Petroleum, Mark Carl, Chief Security Officer of PDI Software, and Devon Bryan, Global Chief Information Security Officer of Carnival Cruise Line.

"The retail and hospitality industry continues to be a target of cybersecurity attacks. RH-ISAC is doing outstanding work sharing valuable cybersecurity practices across its membership," said Ed Adams, President, and CEO of Security Innovation. "We are thrilled to be a part of this event that is addressing software security awareness at both the business and technical level."

Registration is open to all companies that are currently RH-ISAC members as well as non-member organizations in the retail, hospitality, and travel sector, including retailers, restaurants, hotels, gaming casinos, food retailers, consumer products, and other consumer-facing companies. Visit rhisac.org/SecurityAwareness for more event information and to register.
 

33% are Lacking Cybersecurity Response Plans
One in three IT security managers don't have a formal cybersecurity incident response plan
Regardless of industry, information security incidents have become more of a targeted threat for businesses, increasing in amount and efficacy, according to the 2021 Data Security Report from GetApp.

Of all the security incidents identified by over 900 surveyed employees at U.S. businesses, the three most threatening incidents were: increasingly severe ransomware attacks, more effective phishing schemes, and rampant reusing of passwords.

● Respondents reported phishing emails have nearly tripled in effectiveness over the past two years. Phishing emails are rapidly becoming more difficult to spot and thus far more destructive.

● Over the past year, ransomware attacks have increased by 25%. Ransom demands were significantly higher than average for businesses in specific industries, such as banking and financial services and construction, with higher payouts.

● The report found that password reuse is strongly associated with higher incidences of security breaches. Reported account takeovers were three times as common among people who reuse passwords as those who don't.

"Data security threats are becoming more targeted to individual victims, whether that's a phishing scheme aimed at a specific person or ransomware attacks on a particular company," said Zach Capers, senior analyst at GetApp. "Companies must redouble security training efforts and fortify their networks to protect against today's increasingly sophisticated cybercriminals."

Alarmingly, 23% of the IT security managers surveyed say their company doesn't have protocols in place to report a suspected cyberattack and 33% don't have a formal cybersecurity incident response plan. helpnetsecurity.com

More 'Alarming' Increases in Cyber Threats
91.5% of malware arrived over encrypted connections during Q2 2021
The latest report from the WatchGuard shows an astonishing 91.5% of malware arriving over encrypted connections during Q2 2021. This is a dramatic increase over the previous quarter and means that any organization that isn't examining encrypted HTTPS traffic at the perimeter is missing 9/10 of all malware.

Researchers also found alarming surges across fileless malware threats, a dramatic growth in ransomware and a big increase in network attacks.

"With much of the world still firmly operating in a mobile or hybrid workforce model, the traditional network perimeter doesn't always factor into the cybersecurity defence equation," said Corey Nachreiner, CSO at WatchGuard.

"While a strong perimeter defence is still an important part of a layered security approach, strong endpoint protection (EPP) and endpoint detection and response (EDR) is increasingly essential." helpnetsecurity.com

Protecting 150 Million Google Accounts
Google to Enable Two-Factor Authentication for 150M More Users
Google today published updates on how it plans to increase user account security, including a goal to auto-enroll an additional 150 million Google users into two-step verification (2SV), and require 2 million YouTube creators to enable 2SV, by the end of this year.

This step is Google's latest move to improve account security and builds on existing measures including the Google Password Manager, built directly into Chrome, Android, and the Google App. iOS device owners can use Chrome to autofill saved passwords in their other apps as well, and Google says they'll soon be able to use Chrome's password generation tool for any iOS app.

The company states the best way to improve user security is to enable protections by default; however, it also acknowledges not everyone will be ready for these changes at the same time. darkreading.com

What, exactly, is cybersecurity? And why does it matter?

Mall Security Guards Enforcing COVID Rules
Canada retailers and restaurants deploy private security to enforce Covid rules
Want to sit down and enjoy that food court burger and fries? Get ready to show your passport to the mall cops. Beginning late last month, Ontario residents must provide proof of COVID-19 vaccination for a wide variety of indoor activities, including dining.

While non-essential retail is exempt from the vaccine passport requirements, anyone dining at a mall food court needs to show their papers. Who enforces that is up to the mall owner and the food court restaurants themselves, according to a spokesperson for Ontario Health Minister Christine Elliott.

"This could be at the point of service or at specific entrances/exits to the seated area of the food court based on their unique operations and setup," said Alexandra Hilkene, who added that mall and restaurant owners might want to check with a lawyer to ensure their plans follow the rules.

At the Toronto Eaton Centre and other malls owned by real estate giant Cadillac Fairview, security guards are being posted at the entrance to the food court seating areas, according to Cadillac Fairview spokesperson Anna Ng.

"Our security teams will be stationed at the entrance of food court seating areas to validate visitors' vaccination passports to ensure that guests planning to use the seating are adequately protected," said Ng in an email.

Knowing that malls will be taking on the passport-checking duties is a relief for the food court kiosks and their staff, says James Rilett, an executive with the Restaurants Canada trade association.

Still, the concern hasn't completely vanished for mall food court restaurants, Rilett said. There's still too much uncertainty about enforcement, he explained.

"Until we get something in writing from the government, there's still going to be some concern. The regulations aren't at all clear on whose job it is," Rilett said. privateofficerbreakingnews.blogspot.com

'We Won't Ask': Businesses Openly Ignoring Vaccine Mandate
Businesses in Canada Defying Government Mandates to Check for Proof of Vaccination
A growing number of Canadian businesses are openly defying government mandated directives to check customers and consumers for proof of vaccination in order for them to enter their establishments.

In fact, a national movement has sprung up called We Won't Ask where businesses are placing round blue stickers at the front of their businesses saying they won't ask people about their vaccination status.

Sheila Gunn Reid, with Rebel News which launched the campaign, said early on when in the pandemic businesses were divided into essential and non-essential with some closed and some not, the media outlet had a campaign called I Will Open.

"That was for businesses who were willing to defy the lockdown and reopen their doors. And We Won't Ask is sort of along that same theme where there are businesses out there who are rejecting the idea that they need to violate their customer's privacy, their medical privacy, before they can serve them," she said. "And a lot of the business owners that I'm talking to are saying they just completely had it with being in constant confrontation with their customers. They want to reset the relationship that has sort of been destroyed by the government over the last 18 or 19 or 20 months I suppose depending on where you live in the country."

"They've been fighting with customers about wearing masks and when they can be open and whether they can serve you at the counter or you have to wait outside for curbside pickup. They're just over it. They're not doing it anymore and asking for proof of vaccination is just a bridge too far for them. The uptick has been pretty strong."

Michael Kehoe, broker/owner of Fairfield Commercial Real Estate in Calgary, said the number of businesses openly defying the government mandated health measures requiring proof of vaccination for entry is a sign of the growing unrest among business owners that is brewing across the country. retail-insider.com

More than 80 per cent of eligible Canadians fully vaccinated against COVID-19
 

Account Takeover Attacks Surge Globally
ATO attacks increased 307% between 2019 and 2021
Sift released a report which details the evolving methods fraudsters employ to launch account takeover (ATO) attacks against consumers and businesses. The report details a sophisticated fraud ring that sought to overwhelm e-commerce merchants by innovating upon typical credential stuffing campaigns.

Specifically, the fraud ring, dubbed Proxy Phantom, used a massive cluster of connected, rotating IP addresses in carrying out automated credential stuffing attacks to hack user accounts on merchant websites. Using over 1.5 million stolen username and password combinations, the group flooded businesses with bot-based login attempts to conduct as many as 2,691 login attempts per second-all coming from seemingly different locations.

As a result, targeted merchants using rules-based fraud prevention methods would be forced to play a supercharged, global game of "whack-a-mole," with new combinations of IP addresses and credentials (likely purchased in bulk on the dark web) coming for them at an unthinkable pace.

Account hacking explodes during pandemic

The report also revealed a staggering 307% increase in ATO attacks between April 2019-shortly after many COVID-19 stay-at-home orders were enacted-and June 2021. This attack method made up 39% of all fraud blocked on Sift's network in Q2 2021 alone.

Defending against the fraud economy

"As the discovery of the Proxy Phantom fraud ring demonstrates, fraudsters will never stop adapting their techniques to overwhelm traditional fraud prevention, making suspicious logins look legitimate, and legitimate ones look suspicious," said Jane Lee, Trust and Safety Architect at Sift.

"At the same time, poor consumer security habits-like reusing passwords for multiple accounts-make it easy and continue to breathe life into the Fraud Economy. To proactively secure customer accounts and fuel expansion into new markets, merchants need to adopt a Digital Trust & Safety strategy to stop these advanced attacks before they shatter consumer loyalty and stifle growth." helpnetsecurity.com

Online Companies Take On Biden's Legislation
Apple, Amazon and others back groups trying to kill US climate legislation

Disney and Microsoft are also connected to lobbyists who are fighting the $3.5 trillion budget bill.

Apple, Amazon, Microsoft and Disney are among the major companies backing corporate lobby groups and organizations that are battling a US climate bill, according to a report. That's despite those companies all making pledges to reduce their impact on the environment.

The United States Chamber of Commerce, the Business Roundtable and the Rate Coalition are three of the lobbyist and business groups that oppose the Democrats' $3.5 trillion budget bill, which includes measures to fight climate change. The Guardian reports that watchdog Accountable.US analyzed the groups to learn which companies have connections to them.

The Chamber of Commerce, the biggest lobbying group in the US, has said it would "do everything we can to prevent this tax-raising, job-killing reconciliation bill from becoming law." The group's board includes executives from the likes of United Airlines and Microsoft.

The board of the Business Roundtable includes Apple CEO Tim Cook, Google and Alphabet chief executive Sundar Pichai and Amazon CEO Andy Jassy. The group has said it's "deeply concerned" about the bill and the increased taxes it would lead to for the rich. Google has also made political contributions in the past to individuals and organizations that have denied climate change.

The report notes that The Rate Coalition is set to release attack ads against the bill. That body's members include Disney and Verizon (Engadget's former parent company).

The support of lobbying groups that are attempting to kill the bill conflicts with the tech companies' attempts to tackle the climate crisis. Apple, Google and Microsoft have all backed the Paris Agreement, for one thing. Apple and Microsoft promised to become carbon neutral and carbon negative respectively by 2030. engadget.com

Google expands shopping searches with Lens and in-store inventory checks

Baton Rouge, LA: EBRSO looking for trio who allegedly took "multiple power tool items" from a Lowe's store
The East Baton Rouge Sheriff's Office is asking for the public's help finding three men who allegedly took power tools from a Lowe's store in the Capital City. It all began on September 21, when deputies were called to a Lowe's located at 10303 South Mall Dr. The call was in reference to a possible retail theft. According to the East Baton Rouge Sheriff's Office, "It was reported that three men entered the store and stole multiple power tool items from the store." This may have not been the first time that this trio stole from a Lowe's store. Investigators believe that "these males have stolen from other Lowes locations in surrounding parishes." brproud.com

Northbrook, IL: Louis Vuitton Purses Taken in Retail Theft, Flash Mob Robbery Northbrook Court Mall
Police responded about 6:45 p.m. Tuesday, October 5, 2021 to a report of retail theft at Northbrook Court in Northbrook. Police received a report that six offenders armed with unknown weapons took multiple Louis Vuitton purses and fled the store. Initially the name of the store was not released, but there is a Louis Vuitton store at the Northbrook Court Mall, 1515 Lake Cook Road in Northbrook. The offenders fled in a black Kia sedan and a gray SUV - make and model not initially described. arlingtoncardinal.com

Wilton, NY: Troy woman arrested for allegedly stealing $8k+ in merchandise from Best Buy
The Saratoga County Sheriff's Office arrested Makyla Minius, 21, of Troy, N.Y. after she allegedly stole more than $8,000 worth of merchandise from a local Best Buy store on September 30. This comes after Minius was previously arrested the day before on September 29 on Burglary charges out of the town of New Scotland. Minius' latest charges include: Grand Larceny 3rd Degree- Class D Felony (2-counts) Minius was arraigned at the Wilton Town Court, released and is scheduled to return to court at a later date. The case is said to still be under investigation and police say more arrests are expected. news10.com

Vernon Hills, IL: Thieves flee with over $7,000 in phones, other devices from T-Mobile

Blooming Prairie, MN: A man who allegedly acquired more than $6,000 in merchandise from an O'Reilly Auto Parts charged with felony theft by swindle

Cleveland, OH: Tenth time not a charm for Shoplifter caught stealing at Meijer