Captis Intelligence specializes in developing highly sophisticated means of suspect identification. Their I-4 solution (Information, Intelligence, Investigation, and Identification) unifies situational awareness, geographic crime intelligence, social media investigation, criminal databases, access to solveacrime.com, and secured information exchange portals for national retailers, neighboring businesses and law enforcement.

Dan Santell, CEO, Captis Intelligence, tells us what makes the I-4 platform so unique, how it's reduced theft rates in stores by 50%, and how it helped police solve a high-profile murder/robbery case within 72 hours.

Tom Meehan & Steve Sell - CONTROLTEK - Quick Take 9

Steve Sell, VP of Global Sales & Marketing for CONTROLTEK, chats with Amber Bradley about some of the new solutions CONTROLTEK is rolling out this year, and then takes on the "Lightning Round", before Tom Meehan, Chief Strategy Officer & CISO - and famous author of the D&D Daily's "Tom's Tek Tip" column - crashes the party to share a little wisdom on business cards and LinkedIn.

Mike Case promoted to Senior Director of Loss Prevention for Art Van Furniture
Mike was previously the Director of Loss Prevention, and has been a part of the loss prevention team at Art Van Furniture for over thirteen years. Prior, Mike was a Reserve Deputy for the Macomb County Sheriff's Office, an Emergency Medical Technician for AMR Ambulance, Medstar Ambulance and a Regional LP and Operations Manager for Meijer. Congratulations Mike!

Submit Your New Corporate Hires/Promotions or New Position

Rethinking Security Surveillance with Intelligent Analytics

Rethink security surveillance with video and audio analytics
for real-time monitoring and greater customer insights.

Video surveillance has long been deployed for safety and security purposes, but until recent years most installations were analog-based. These systems were severely limited, often generating grainy, blurry video that could slow down response time to incidents and bog down investigations.

But that's the past. Today, the industry recognizes the value that IP solutions bring in terms of delivering high-quality video that can be useful for real-time monitoring and fast, efficient post-incident investigation. Advanced network cameras can offer excellent low-light performance, and they can be used to alert security personnel of potential problems, providing real-time situational awareness that can guide fast, effective and often proactive response.

One technology that has changed how IP video surveillance solutions are utilized is video analytics. This technology analyzes video captured by the camera for specific events that may indicate a potential security issue. These include cross line detection, object left behind detection, object counting and more. Advanced analytics add intelligence to cameras while opening up a number of potential security and business applications for video surveillance.

Going Beyond Security into Business Optimization

The benefits of video and audio analytics extend beyond security, allowing video to be used for wider purposes including business optimization. The additional intelligence that can be gleaned from existing cameras can contribute to improved operations and result in a greater return on investment.

The retail industry is a prime example of a market that has embraced "beyond security" applications. This should come as no surprise considering most retailers already have cameras installed at entrances, above cash registers and in other locations throughout their stores. More likely than not, these were installed for security purposes, such as monitoring people as they enter and exit, watching to detect theft and keeping a close eye on POS transactions. Advanced analytics, however, can turn surveillance video into cross-functional video that can be used for marketing, merchandising, customer service and other general business purposes. Integration with other systems further expands the use cases for video surveillance.

Read More Here

U.S. Government Sides With Apple & Amazon
Denying Bloomberg 'Spy Chip" Report
Homeland Security has said it has "no reason to doubt" statements by Apple, Amazon and Supermicro denying allegations made in a Bloomberg report published earlier this week.

It's the first statement so far from the U.S. government on the report, casting doubt on the findings. Homeland Security's statement echos near-identical comments from the U.K.'s National Cyber Security Center.

Bloomberg said, citing more than a dozen sources, that China installed tiny chips on motherboards built by Supermicro, which companies across the U.S. tech industry - including Amazon and Apple - have used to power servers in their datacenters. The chip can reportedly compromise data on the server, allowing China to spy on some of the world's most wealthy and powerful companies.

Apple, Amazon and Supermicro later published statements on their websites. Bloomberg said it's sticking by its story. And yet, this latest twist isn't likely to leave anyone less confused, days after the story was first published.

It's rare for the government to issue a statement on an apparent threat which, according to Bloomberg, is a classified matter that's been under federal investigation for three years.

The reality is that days after this story broke, it seems many of the smartest, technically minded, rational cybersecurity experts still don't know who to believe - Bloomberg, or everyone else.

And until someone gets their hands on these apparent chips, don't expect that to change any time soon. techcrunch.com

"Personal Data"
"The New Oil of the Internet & Currency of the Data World"
GDPR requires unprecedented view of data flows
Why is it important to know where data flows, with whom it's shared and where it lives at rest, and what is the best way of achieving this?

It would be unacceptable for a company not to know where its physical assets were stored, how they got there and who had access to them. So why should it be acceptable for companies to have no visibility over where their data assets live and who can access them?

With the General Data Protection Regulation (GDPR) now in play, there is growing recognition that companies must have better oversight and control over their data. This requires the ability not only to secure data and prevent mishandling and misuse, but also to ensure it is only used or processed according to the permissions granted by the law. Achieving such control requires an unprecedented and granular level of understanding of how data flows through organisational processes across the entire business ecosystem.

Under GDPR, this means companies must be able to anticipate where personal data may end up, and how it may be compromised. This contrasts with the previous trend of collecting data en masse in the hope that it held some enigmatic value waiting to be unlocked. computerweekly.com

Stop Social Engineering at Your Co.
Social Engineering Tester Releases 3 Yrs of Data
"Successful Scammers Call After Lunch"
Analysis of 20,000 voice phishing, or vishing, calls reveals patterns in how social engineers operate and how targets respond.

Voice phishing scams are most successful in the afternoon and least effective on Mondays, according to an analysis of thousands of these "vishing" calls over a three-year time frame.

Chris Hadnagy, founder and CEO of Social-Engineer, and Cat Murdock, a social engineer and pen tester at the company, had the idea to record vishing calls back in 2015. More than 20,000 calls later, they decided to compile the data they collected into a single report. Today, the duo took the stage today at DerbyCon to present their findings.

Of the 20,144 total calls made, 5,690 were completed, meaning the social engineer spoke with someone on the other end of the line. Of the completed calls, agents had a total of 3,017 compromises, a success ratio of 53%. Less than half (45.3%) of the calls resulted in a "shutdown," meaning they weren't able to get the minimum amount of data from their target.

Their calls dug up a total of 8,685 "flags," or pieces of information they had to obtain from their targets. This ranged from Social Security numbers, which they were able to learn 15.6% of the time, to information on internal projects (9.48%), to answers to security questions (1.1%).

Mondays Are The Worst/Fridays Are The Best
An obvious statement, to be fair, but one that very much applies to vishing calls. Monday is the day you're most likely to get someone on the phone - but the least likely to compromise them.

"Monday is a really interesting outlier," Murdock said. The first day of the workweek has a compromise ratio of 29%, which is very low compared with Tuesday (62%), Wednesday (63%), Thursday (58%), and Friday (65%). People are most likely to answer the phone on Monday, which is also the day with the lowest voicemail ratio (60%) and shutdown ratio (70%).

"Monday, I just got back from the weekend, I'm refreshed, I'm ready to rock and roll," he said. "By the time Friday hits, I've been battered like an egg in a pan, and now I just wanna give up and go back to the weekend." What's more, he continued, people are more likely to take Fridays off for long weekends. Few folks take vacation on Mondays, so most people are in the office.

Drilling down into specific times of day, vishing calls are more successful the later it gets. Afternoon seems to be the best time, Murdock said, citing the 65% average compromise ratio.

When people arrive to their desks in the morning, the rate of compromise is lower. They're alert, they're focused, and they're less likely to share sensitive information. Later in the day, the compromise ratio increases, hitting its peak just as employees are getting ready to leave.

"Highest is at 5 p.m.," Murdock told Dark Reading. "People who are potentially working a little bit late and they're really ready [to leave, they'll] tell you what you need to get you off the phone."

Is That Call Really From HR?
The analysis also touched on the pretext, or the social engineer's strategy, for convincing their targets they were legitimate. More than three-quarters (76%) of agents pretended to work with facilities, 74% said they were calling as part of their work with a training department, 72% claimed to have lost the organization's address, and 63% pretended to be calling HR.

Impersonation, a tactic in which social engineers research a specific person and pretend to be that person to elicit information, is the most difficult technique to pull off, Murdock noted.

Hadnagy and Murdock divide the most common pretexts into two themes. One is HR, which encompasses vishing calls related to healthcare, databases, financial questions, open enrollment, portals, training, and wellness. The second was IT, where pretexts relate to audits, badges, databases, security, updates, and VoIP.

Yes, both categories include database-related questions. However, HR-related database calls had a higher compromise ratio (28%) than IT (21% compromise). Open enrollment vishing calls were the most effective, with a 100% compromise ratio. If you're looking to capture key data from HR, a well-timed open enrollment angle could be effective.

Women Are Winning
"Women just do better at social engineering," says Hadnagy, citing the data showing how female social engineers typically outperform males regardless of the target's gender.

This finding applies across all pretexts the team studied, meaning women were more successful in obtaining key information, whether they pretended to be an employee of the target company, a reporter, a facilities worker, IT personnel, or a training manager. The only area in which men were more effective than women was in calling with questions related to a conference. darkreading.com

RFID Needs to Be Part of the Building
Throughout the past five or six years, RFID solution providers have tremendously improved their tags, readers and software. We used to hear about problems reading tags, but that is almost never an issue anymore. We used to hear about the challenges of tagging certain products, such as drill pipes, but now there are tags that work on almost any object.

We've also seen some amazing deployments. Organizations as diverse as Lululemon, BAE Systems, and Florida Fire and Rescue are using RFID to improve their operations, and we're seeing the technology being adopted around the world (see RFID Brings Lululemon's Inventory Accuracy to 98 Percent, Equipment Value Stream Management and RFID at BAE Systems and Florida Fire and Rescue Supplier Extends Visibility via RFID).

However, one area in which there has been very little progress is in RFID becoming part of an organization's infrastructure. Only on rare occasions is the technology deployed as part of a building's physical infrastructure-and that's a shame. RFID should become part of a building, just like running water, lights and heat. This would make it less costly to deploy (retrofitting involves running wires, electricity cables and sometimes conduits), less visible to those using the building, and less likely to be damaged as things move around and more.

Some companies looking at and experimenting with unmanned stores are considering RFID. Amazon has used cameras and weight sensors at its Amazon Go store (see Amazon Aims to Revolutionize Brick-and-Mortar Shopping), while at least one company in Asia is using RFID as well. If that project is successful, it could lead to many more unmanned stores and possibly unmanned areas of conventional stores.

RFID will eventually be built into factories, warehouses, hospitals and other facilities. We need to start educating architects now. If anyone has any suggestions on how to do this, I'm all ears. rfidjournal.com

California mandates manufacturers of internet-connected devices must have unique password capability
The Information Privacy: Connected Devices bill demands that electronics manufacturers equip their products with "reasonable" security features begininng on January 1, 2020, meaning that each electronic product produced in the state will be given a unique password when it is made. secuitymagazine.com

Facebook could face up to $1.6bn fine for data breach in EU Alone, Because of GDPR

Amazon employee shared email addresses with third-party seller
Sellers paying for customers' email addresses to game the ratings system
In September, Amazon started investigating reports that some of its employees in the US and China have been leaking data to third-party sellers in exchange for money. Now, the e-commerce giant has notified affected customers that an employee shared their email addresses with a third-party seller. Amazon told The Wall Street Journal that it already fired that particular employee and booted the seller who received the email addresses off the platform. More importantly, it said no other customer information other than those addresses were disclosed.

Amazon didn't clarify whether that former employee was the sole culprit or if they just happened to be the only one caught out of many. It also didn't specify where they're from and didn't reveal the real scope of the issue. engadget.com

Two Cities Get Second Looks From Amazon's HQ2 Search Committee
Amazon representatives have visited all 20 cities on the short list: Toronto, Columbus, Indianapolis, Chicago, Denver, Nashville, Los Angeles, Dallas, Austin, Boston, New York City, Newark, Pittsburgh, Philadelphia, Montgomery County in Maryland, Washington, D.C., Raleigh, Northern Virginia, Atlanta and Miami. Many experts like the odds of Amazon putting down roots in the D.C. area, and Sperling's Best Places has put its bet on Oatlands, Va. Media reports say Amazon search committee members have made second trips to Miami and Chicago this fall. fortune.com

Online holiday spending to increase by double digits over last year
Digital holiday sales are expected to increase by 14% from last season, growing from $129 billion to $151 billion in 2018. Many of these sales will happen early in the season, and will be largely driven by promotions, according to early findings from Forrester Research's holiday retail forecast.

According to data, more than one-third of the year's e-commerce sales will stem from the holiday season. In addition, online holiday retail sales will account for over 32% of total United States e-commerce sales in 2018. chainstoreage.com

Costco's e‑commerce sales jump 26.2%

Stitch Fix grows its online revenue 23.2%

Tesco chief calls for 'Amazon tax' on goods sold online

Luis Banuelos named District Loss Prevention Manager for Smart & Final

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

	Director Loss Prevention Irvine, CA The Director of Loss Prevention at Tillys builds and implements policies, programs, and procedures that control risk, reduce shrink and protect the employees and assets. The director is responsible for leading and developing LP team members in the corporate, retail, and distribution centers...
	VP Asset Protection Westborough, MA Reporting to the SVP Internal Audit & Asset Protection, the Vice President Asset Protection is primarily responsible for overseeing and validating all corporate Asset Protection, security, and theft reduction procedures within the field and home office...
	VP, Asset Protection Dallas, TX As the Vice President of Asset Protection you will provide leadership and direction in the development, implementation and monitoring of effective, coordinated programs to reduce the possibility of internal and external theft, to reduce shrinkage, to ensure physical protection of associates, customers and Company assets, and to investigate losses...
	Vice President, Chief Information Security Officer Grapevine, TX The Chief Information Security Officer (CISO) is the GameStop executive responsible for leading our global information security organization and will have officer level fiduciary responsibility...
	Vice President, Asset Protection Columbus, OH Oversees and directs all Asset Protection related functions for a Corporate Office, multi-state distribution centers and large retail store network. Responsible for enterprise direction and strategy as it pertains to Asset Protection with a goal of minimizing shrink, reducing loss and maximizing security and associate safety...
	Vice President, Loss Prevention Houston, TX This pyramid head position is responsible for developing and leading this company's shrinkage reduction efforts and integrating these efforts throughout the entire organization...
	Global Manager of Environmental Health and Safety Austin, TX ● Establish goals for EHS performance and implement effective EHS systems to ensure continuous improvement ● Provide oversite to Regional Environmental Health and Safety Administrators and Global Risk Leadership on EHS matters with a focus on environmental issues...
	Regional Loss Prevention Manager Baltimore MD This position is responsible for managing all aspects of loss prevention for a geographic area to reduce and control shortage and other financial losses in 120 to 140 company stores. The coverage areas average $550 million in sales revenue and $3.5 million in shrink losses annually...
	Loss Prevention Investigator Wawa, PA The Loss Prevention Investigator is responsible for utilizing proper investigative techniques and act as the primary liaison with field operations management. Conducts investigations into cash losses, deposit shortages, associate theft, overall shrinkage, and other matters...
	Regional Asset Protection Manager Harrisburg/State College, PA The Regional Asset Protection Manager will lead their region in Shrink Reduction, Asset Protection and Safety efforts through an in-depth understanding of the overall business, effective partnerships and by directing the region with integrity and professionalism...
	Loss Prevention Market Specialist Jacksonville, FL To monitor store locations to detect, investigate and resolve internal and external situations and circumstances that could lead to or result in losses to the company. All actions and conduct within the scope of the position must be performed according to performance standards set by Burke's policies, procedures and Code of Ethics...
	Loss Prevention/Asset Protection Investigator Boston, MA Responsibilities will include but are not limited to: ● Protect the assets of the store as well as the associates and visitors. ● Maintain surveillance of the store via CCTV and conduct physical inspections including perimeter checks...
	Asset Protection Analyst Norcross, GA AP Analyst based in Norcross, GA reporting to the Director of Asset Protection. This high-visibility role will be responsible for business-wide security administration, multiple fraud detection programs and functional communication...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

Today's Daily Job Postings from all around the net - Appearing today only

To apply to today's Internet Jobs, Click Here

Sponsor Today's Internet Jobs 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here