U.S. retailers & NRF President to address impact of European privacy regulations
During Brussels Conference this Week
U.S. retailers will highlight challenges faced in complying with European privacy rules while still serving the needs of their customers as regulators meet for an international conference in Brussels this week, the National Retail Federation said today.

"In an increasingly global economy, retailers are required to comply with regulations from around the world," NRF President and CEO Matthew Shay said. "Privacy is a top priority for retailers and they want to honor the privacy expectations of their customers and the laws of the countries where they live. But retailers shouldn't have their hands tied when it comes to using technology and data to deliver the high quality of customer service that consumers demand. It's important to find the right balance between regulations and practicality."

Shay, other NRF executives and a dozen representatives of major U.S. retailers will hold a series of meetings with U.S. and European Union officials during the annual International Conference of Data Protection and Privacy Commissioners.

"We want officials to realize that retailers' use of consumer data is very different than what other industries might do," Shay said. "Retailers use data to better serve their customers and improve the shopping experience, not to monetize the data itself."

Retailers will meet later in the day at the U.S. Embassy with Mark Libby, deputy chief of the U.S. Mission to the European Union, to seek support in making EU officials aware of how GDPR affects retailers and how U.S. businesses use technology to benefit their customers. nrf.com

Security budgets are rising, but is it enough?
A majority of companies (54 percent) are worried that they will soon outgrow their security solutions, according to Threat Stack. While budgets are expected to increase by 19 percent over the next two years, organizations are struggling with a disconnect between security and DevOps and are facing difficulties in determining where to allocate this budget in the face of rapidly evolving infrastructure.

With less than half of their infrastructure remaining on-premise (41 percent), businesses are increasingly making significant migrations to infrastructure-as-a-service (IaaS) (25 percent), platform-as-a-service (PaaS) (17 percent), and containers (10 percent). This is one of the primary reasons why respondents indicated that their top two budget investments in 2019 will be directed at cloud workload security and intrusion detection systems (IDS). helpnewsecurity.com

WSJ Cyber Daily: Organized Hacker Groups Target Tech Outsourcers
Hackers after the big fish are targeting outsourcers, the Department of Homeland Security warns. If there are holes in the networks of these firms, which manage companies' websites, cloud applications and other technology services, attackers could infiltrate and then poke around for ways to spread into the networks of customers, such as big banks, drug makers and others. Securing your supply chain is never easy -- and never a job complete -- but business leaders can take steps to be safer, WSJ Pro Cybersecurity's Catherine Stupp reports. A critical move: keep careful track of the credentials you give to your providers and make sure they have expiration dates.

Behind the First U.S. Cybersecurity Assessment
October 2018 marks the 15th annual National Cybersecurity Awareness Month, and today, FICO is making big news: we have teamed with the U.S. Chamber of Commerce to help all American businesses be more aware of, and better manage, their cybersecurity risk.

The first step in managing risk is quantifying it - and that's exactly what the Assessment of Business Cybersecurity (ABC) does. Designed by FICO and the Chamber, and powered by the empirically derived FICO Cyber Risk Score, the ABC was developed to provide an objective benchmark for the cybersecurity of U.S. businesses. It's the first national cybersecurity assessment benchmarking the risk levels of different business sectors, and our joint initiative gives all companies the opportunity to see how their risk of data breach stacks up to peer organizations.

Today marks the release of the first quarterly Assessment of Business Cybersecurity, at the Chamber's Seventh Annual Cybersecurity Summit in Washington, DC. The ABC is based on the individual FICO Cyber Risk Score of 2,574 businesses across 10 key sectors of the US economy. It's an aggregate measure of security risk across small, medium, and large companies, and an important indicator in understanding macro cyber risk trends at the national and sector levels. fico.com

Understanding SOCs' 4 Top Deficiencies
In this year's edition of its annual security operation center (SOC) survey, the SANS Institute identified the four most common SOC deficiencies. The root of these shortcomings can be traced to a familiar source: people, processes, and proper planning and implementation of technology. Here's a look at the worst four and what security teams can do about them.

1. Automation/Orchestration
Most SOCs lag in automation and orchestration because the SOC team doesn't know what processes should be automated. An organization's employees are its first line of defense. Start by interviewing SOC personnel to understand their responsibilities and identify repeatable processes, such as evidence gathering during an incident (IP/URL reputation, whois information, etc.) that are time consuming and easily automated.

Finally, SOCs that fall short in terms of processes and playbooks typically have a low-maturity security program. For these organizations, working with a managed security service provider or managed detection and response service are good options.

2. Asset Discovery and Inventory
Asset inventory and management is hard. Even with automated tools in place, technology teams still have some heavy lifting to perform, especially in the initial up-front investment of time and energy. In a world of instant gratification, most organizations expect that if they invest in a tool, it should accelerate business processes. Unfortunately, due to the dynamic nature of IT environments and technology, SOC teams are too often required to roll up their sleeves.

3. Manual Event Correlation
This seems counterintuitive, but there's a good explanation. Deploying a SIEM is not as simple as turning it on and pointing log sources to it. Organizations must understand their log sources and the overall visibility they provide into the environment.

4. SOC/NOC Integration
This deficiency is a cultural problem. SOC teams have one agenda (detection and protection), while Network Operations Teams (NOCs) have another (maintaining uptime and availability). These two are often at odds with each other. Take, for example, the age-old conflict of least privilege. NOC teams want to have the keys to the castle and be able to move freely about the environment. SOC teams are focused on locking down the environment to better identify anomalies that may indicate malicious activity.

With proper planning and deployment, and with the right processes and procedures in place, overcoming these SOC deficiencies is within reach of most organizations. For those that lack the appropriate resources or security program maturity, a managed security service provider or managed detection and response service is a good alternative. darkreading.com

Investigation or Exasperation? The State of Security Operations
Cyberattacks are top of mind for organizations across the globe. In fact, 62 percent of firms are being attacked at least weekly and 45 percent are experiencing a rise in the number of security threats. But do organizations have the processes in place to investigate and effectively respond to these incidents? IDC recently surveyed security decision makers at 600 organizations to understand the state of security operations today.

Download this InfoBrief to discover:
• The consolidated time security teams spend on incident response
• How organizations are coping with an average of 40 actionable security incidents per week
• Where organizations are focusing their security efforts govinfosecurity.com

Download Brief

2.6 billion to use biometrics for payments by 2023
The report, Biometrics for Payments; Market and Technology Analysis, Adoption Strategies and Forecasts 2018-2023 - Second Edition, includes the prediction that there will be 2.6 billion people using biometric payments by 2023, driven by demand for frictionless authentication in all channels, the need to reduce payment fraud, regulation at both the state and industry level, and technology standardization. biometricupdate.com

Audits: The Missing Layer in Cybersecurity
Involving the audit team ensures that technology solutions are not just sitting on the shelf or being underutilized to strategically address security risks.  darkreading.com

Trend Micro shines a light on its new cybersecurity solutions

Loss Prevention Leadership in a Digital Age

Becoming a subject matter expert in your field is an important first step at each position you reach in your career. After that, it all boils down to developing your leadership skills, which is critical in reaching the senior level and staying there.

Shannon Hunter, VP, Loss Prevention & Sustainability, Office Depot has been recognized and promoted over the years by focusing not only on his technical skills but on his leadership skills as well. Here, he shares the leadership traits that have helped him the most throughout his career.

Note: At the time of this filming, Shannon was Sr. Director of LP & Safety for Office Depot, prior to his promotion to VP of LP & Sustainability.

Episode Sponsored By:

Jim Geyer - STANLEY Security - Quick Take 12

Jim Geyer, Vice President of Sales for STANLEY Security, talks about some of the innovative new solutions STANLEY is bringing to the retail community to help keep stores safe - from their active shooter detection system and Stanley Guard employee safety app to the IntelAssure "cyber hygiene" tool and profit-enhancing Stanley Retail Insights.

Quick Take Sponsored By:

CAPTCHAs Don't Stop Bots-They Stop Customers
The CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) was originally designed to prevent bots, malware and artificial intelligence (AI) from interacting with a web page. These days, e-commerce companies use CAPTCHAs in an attempt to prevent fraud at scale, such as credential stuffing (testing stolen passwords in order to commit account takeover) and carding (testing stolen credit card numbers online in order to commit credit card fraud).

There are multiple ways, however, fraudsters get around CAPTCHA. A common method is to use a CAPTCHA-solving service, which relies on low-cost human labor in developing countries to solve CAPTCHA challenges on demand.

So, putting a CAPTCHA on your website or mobile app won't stop fraud. But that's not even the worst part.

A Stanford study found that a CAPTCHA typically takes 7-12 seconds for a consumer to successfully complete. As every marketing and e-commerce professional knows, the more time it takes to make a transaction, the more likely cart abandonment and site bounces become. cardnotpresent.com

Brand Protection: Combating Online Counterfeit with AI
To discover and monitor the brand-damaging content and counterfeit on the internet, web crawling is a technology commonly used by brand owners as well as banks and payment companies, which have to fulfill the requirements of card schemes like Visa GBPP (Global Brand Protection Program) and Mastercard BRAM (Business Risk Assessment and Mitigation Program).

Nevertheless, while web crawling technology helps to save a lot of time and human resources in checking an e-commerce website, a weakness of most of the current web crawling tools is that they can only do text-based crawling. That means bad merchants can easily bypass the keyword monitoring by using some ambiguous description with product photos.

Now, benefit from the development of artificial intelligence, brands or logos can be recognized by AI image analysis. And this technology has been adopted in some new web crawling tools or services. With this technological advancement, even if the counterfeit sellers use general wordings to describe the branded items, the new web crawlers can still recognize the logo or other signature graphics from the product pictures. We see that image recognition is a trend in brand protection, marketing, security, and many other scenarios. finextra.com

Uber Ambitiously Eyes 2021 for Food-Delivery Drones Launch
Job posting seeks an operations executive to help make delivery drones functional as soon as next year. The San Francisco company is seeking an operations executive who can help make delivery drones functional as soon as next year and commercially operational in multiple markets by 2021, according to a job posting that appeared on Uber's website. App-reliant Uber has limited experience developing hardware beyond its nascent electric scooters and its equipment for self-driving vehicles, an as-yet unproven technology. wsj.com

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

	Divisional Loss Prevention Director Florida Provides strategic loss prevention management for a division of 2,000+ stores with sales volumes totaling +/- $4B. Maximizes profits by developing and executing programs to reduce and prevent the loss of company inventory/assets and managing Regional Loss Prevention Managers within an assigned geographical area...
	Director Loss Prevention Irvine, CA The Director of Loss Prevention at Tillys builds and implements policies, programs, and procedures that control risk, reduce shrink and protect the employees and assets. The director is responsible for leading and developing LP team members in the corporate, retail, and distribution centers...
	Global Manager of Environmental Health and Safety Austin, TX ● Establish goals for EHS performance and implement effective EHS systems to ensure continuous improvement ● Provide oversite to Regional Environmental Health and Safety Administrators and Global Risk Leadership on EHS matters with a focus on environmental issues...
	Regional Asset Protection & Safety Manager Emeryville, CA The Regional Asset Protection and Safety Manager will lead the Region in shrink reduction and profit maximization efforts. The position will proactively seek to bring economic value to the company, promoting profitable sales and world class customer service while ensuring a safe place to work and shop...
	Regional Loss Prevention Manager Baltimore MD This position is responsible for managing all aspects of loss prevention for a geographic area to reduce and control shortage and other financial losses in 120 to 140 company stores. The coverage areas average $550 million in sales revenue and $3.5 million in shrink losses annually...
	Loss Prevention Investigator Wawa, PA The Loss Prevention Investigator is responsible for utilizing proper investigative techniques and act as the primary liaison with field operations management. Conducts investigations into cash losses, deposit shortages, associate theft, overall shrinkage, and other matters...
	Regional Asset Protection Manager Harrisburg/State College, PA The Regional Asset Protection Manager will lead their region in Shrink Reduction, Asset Protection and Safety efforts through an in-depth understanding of the overall business, effective partnerships and by directing the region with integrity and professionalism...
	Loss Prevention Market Specialist Jacksonville, FL To monitor store locations to detect, investigate and resolve internal and external situations and circumstances that could lead to or result in losses to the company. All actions and conduct within the scope of the position must be performed according to performance standards set by Burke's policies, procedures and Code of Ethics...
	Loss Prevention/Asset Protection Investigator Boston, MA Responsibilities will include but are not limited to: ● Protect the assets of the store as well as the associates and visitors. ● Maintain surveillance of the store via CCTV and conduct physical inspections including perimeter checks...
	Asset Protection Analyst Norcross, GA AP Analyst based in Norcross, GA reporting to the Director of Asset Protection. This high-visibility role will be responsible for business-wide security administration, multiple fraud detection programs and functional communication...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

Today's Daily Job Postings from all around the net - Appearing today only

To apply to today's Internet Jobs, Click Here

Sponsor Today's Internet Jobs 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here