Handling Sexual Harassment: A Fresh Perspective

In the wake of widespread revelations of misconduct in workplaces, people from all types of industries have begun sharing their stories of harassment and abuse. Refusing to bury their heads in the sand, retail LP executives recognize that old-school "not in my wheelhouse" thinking won't fly. It's time to act with integrity and transparency, embrace authenticity and commit to changes in organizational culture.

Joan Manson, Vice President of Employee Resources, Asset Protection & Legal, The Container Store, shares how LP and human resources professionals can bring their distinctive skills to the table, cultivating a collaborative, productive, and high-trust relationship.

Bob Bonstrom & Alan Rabinowitz - Delta Lock - Quick Take 16

Alan Rabinowitz and Bob Bonstrom tell us how Delta Lock is taking a "traditionally dumb device" like keys and making them smarter with artificial intelligence and analytics. Learn what sets Delta Lock apart from the competition, what new innovations they're bringing to market, and how their global partnerships allow them to offer retailers a total turnkey solution.

A Columbia couple charged with selling counterfeit goods
on eBay and other online retailers

A Columbia couple faces numerous federal charges for allegedly selling counterfeit products valued at more than $2.6 million.

A grand jury on Friday indicted Tabitha and Clint Rodgers on seven counts of wire fraud, six counts of fraud, smuggling, counterfeiting labels, copyright infringement, trafficking in counterfeit goods and conspiracy to commit mail fraud.

According to case documents, over the course of several years the couple received multiple shipments of a variety of fake goods from known counterfeiters in China. The shipments were sent to the couple's home, where they were resold on eBay and other e-commerce websites at a profit. The grand jury charged the couple had been running the scheme since August 2011. Read more

For further information on PROACT, email inquiries to PROACT@eBay.com.

S-TRON's Military Leadership - "Failure Is Not an Option"

At S-TRON, military leadership has been found to not only bring success but also create an atmosphere of true partnership with customers across the country.

S-TRON, one of the nation's leading full-service security providers to national retailers, has intentionally based its business model on military leadership qualities since the beginning. This leadership starts at the top with CEO Steven Dunn, who while serving in the Navy received the Expeditionary Force Award for being part of a multinational peacekeeping force in in the Beirut Lebanon war zone.

Pete Mattschull, S-TRON's President, decorated with the Navy Expedition Medal, Armed Forces Expeditionary Medal and the Navy Achievement Medal has been a driving force at S-TRON since 2003.

Through rough seas and smooth sailing alike, Dunn and Mattschull have assembled an ever growing team of military veterans and highly skilled civilians that is second to none in the security industry. And because of this operational military environment, S-Tron customers enjoy Respect, Reliability and a high-level of Communication.

"No customer left behind" is not just the S-Tron mantra, Pete Mattschull says "it's our way of life".

ABOUT S-TRON
S-TRON is an electronic security integrator for national and regional retailers with thousands of installation locations and headquarters in Melville, New York. S-TRON provides outstanding customer service for national retail, grocery stores, restaurants and C-stores.

Why Retailers Must Prioritize Cybersecurity in the Mobile Era
By 2025, 60 percent of U.S. consumers believe that the average shopper will carry a phone but no physical wallet, according to data published by consumer financial services company Synchrony. What's more, 67 percent of respondents to the Synchrony Retailer Survey said that they've downloaded a retailer's application, findings that are indicative of a culture dominated by use of mobile devices, particularly smartphones.

At the same time, a report published by ThreatMetrix finds that one-third of all fraud now targets mobile channels. In the first half of 2018 alone, mobile attack rates increased 24 percent compared with 2017, according to the report.

"Mobile is quickly becoming the predominant way people access online goods and services, and as a result, organizations need to anticipate that the barrage of mobile attacks will only increase," noted LexisNexis Risk Solutions Chief Identity Officer Alisdair Faulkner.

Retailers Face Distinctive Challenges for Mobile Security

Increasingly, retailers must focus on how to keep their mobile customers safe from growing cyberthreats. According to the Verizon Mobile Security Index 2018 Report, 82 percent of retail and hospitality professionals surveyed said mobile devices are a risk, with 22 percent of respondents calling that risk significant, in large part due to the temporary nature of many in the workforce.

"Retail and hospitality companies face distinctive challenges when it comes to mobile security," the report states. "Many of them have large numbers of employees, often employed on part-time or seasonal contracts. These employees may not take security precautions as seriously as full-time or permanent employees."

Still, the report also finds that nearly 90 percent of enterprises surveyed have only one of four basic mobile security measures (changing all default passwords; encrypting data sent over public networks; restricting access on a need-to-know basis, regularly testing security systems) in place; conversely, only 1 in 7 companies had all four practices in place. biztechmagazine.com

AT&T, T-Mobile Sued Over Mobile Crypto Thefts
America's leading cryptocurrency investor law firm - announced it has filed lawsuits against AT&T and T-Mobile on behalf of crypto asset holders who were allegedly victims of "SIM swapping."

The suit alleges that by leaving holes in their security protocols, and failing to train and monitor employees adequately, the phone providers assisted criminals in remotely taking over smartphone SIM cards, allowing them to access financial records and account information to steal cryptocurrency and other assets.

The complaint explains how one of Silver Miller's clients - an AT&T account holder - was robbed of over $621,000 in cryptocurrency during an SIM swap, even after the mobile carrier had supposedly boosted security on the user's account after an earlier attempted theft. In addition, other Silver Miller clients, who used T-Mobile, were robbed of $400,000 and $250,000.

"'SIM swapping' or 'SIM hijacking' is a growing crime in the telecommunications world that, in a few moments' time, can allow a thief to steal millions of dollars of an unsuspecting victim's assets with little more than a persuasive plea for assistance, a willing telecommunications carrier representative and an electronic impersonation of the victim," according to Silver Miller in a press release. pymnts.com

SMS Phishing + Cardless ATM = Profit
Thieves are combining SMS-based phishing attacks with new "cardless" ATMs to rapidly convert phished bank account credentials into cash. Recent arrests in Ohio shed light on how this scam works.

A number of financial institutions are now offering cardless ATM transactions that allow customers to withdraw cash using nothing more than their mobile phones. But this also creates an avenue of fraud for bad guys, who can leverage phished or stolen account credentials to add a new phone number to the customer's account and then use that added device to siphon cash from hijacked accounts at cardless ATMs. krebsonsecurity.com

Symantec Uncovers North Korean Group's ATM Attack Malware
Emptying Tens of Millions of Dollars from ATMs
Researchers from Symantec have uncovered the malware tool North Korea's infamous Lazarus Group has been using since 2016 to empty millions of dollars in cash from ATMs belonging to mostly small and midsize banks in Asia and Africa. In a report this week, the security vendor described the malware as designed to intercept and approve fraudulent ATM cash withdrawal requests before they reach a bank's underlying switch application server that processes them. darkreading.com

Microsoft's cloud wins business from Gap as another retailer shuns Amazon

Microsoft President says 2024 could become 1984 without biometrics regulation

Dealing with Magecart and Other Attacks
Are Companies Doing Enough to Protect Customers?
Over the last couple of months, there has been an alarming number of attacks on eCommerce and ticketing companies, with the resulting theft of customer credit card data. Those responsible for these attacks are a group of hackers called "Magecart". In June 2018, the group attacked Ticketmaster and breached credit card data of some 40,000 customers; there followed two major attacks in September, which affected 380,000 British Airways customers and an unknown number of Newegg customers.

The modus operandi in these attacks was very similar: to inject malicious JavaScript code which could then act as a credit card skimmer. This code actively monitors events on web pages and triggers an action whenever credit card details are submitted (event hijacking). In this way, Magecart was able to intercept credit card data from customers in the checkout pages and send it to Magecart's servers.

By understanding the methodology of these attacks, it is possible to identify prevention strategies.

The first security standard to be considered should be to add Subresource Integrity (SRI) attributes to the script elements loading the external scripts. However, SRI comes with a major pitfall: it's notably complex to apply to dynamic code. And, as you may expect, most of these providers (like Inbenta) keep improving their services, resulting in frequent changes to JavaScript source code. Adapting SRI to match this dynamism can be a burden and, if SRI isn't properly set up, it can block a perfectly safe third-party script, crashing the website.

The second standard is Content Security Policy (CSP).

CSP does have its limitations though and means new challenges ahead, such as being vulnerable to open-redirect attacks and requiring substantial configuration as well as maintenance; we have also seen strategies that bypass CSP altogether.

SRI and CSP should be considered, despite their drawbacks. Still, potential attacks featuring browser extensions as a vector for instance would be severely damaging to a wide number of eCommerce businesses, as SRI and CSP would be completely powerless to prevent them. cbronline.com

Counterfeit goods are a half trillion dollar industry
Here's how QR codes and digital assets can help solve the problem of fakes
Valued at $450 billion, the counterfeit luxury goods industry continues to be a major problem for luxury brands and retailers. According to the 2018 Global Brand Counterfeit Report, the losses incurred due to online and offline counterfeiting was an estimated $98 billion, with luxury brands suffering a total loss of $30 billion because of the sale of counterfeits through the internet.

This widespread problem hasn't just affected the financial income of luxury brands; it has also affected their consumers' trust. The market has become alarmingly advanced, having reached major social media platforms like Facebook. The alarmingly large presence of counterfeit sales on these platforms, along with the fact that no one flags these offending sellers, makes it hard for e-commerce and social media platforms to put a stop to the problem.

The use of Digital Assets in order to keep track of all the original personal luxury goods (e.g., handbags and watches) within circulation in the fashion and luxury ecosystem will greatly benefit everyone in the system - from the luxury brands, to the retailers and resellers, and the consumers too. Digital Asset information can also be shared across e-commerce sites or secondhand retailers to increase buyer trust. Read more yahoo.com

Amazon's virtual Christmas tree farm opens for business

American Eagle invests in hot online company

Submit Your New Hires/Promotions or New Position

Featured Job Spotlights

	SOC Director Scottsdale, AZ ADT Cyber Security is searching for a Senior level security practioner/manager with extensive experience in providing a multi-tenant or Enterprise equivalent customer focused 24x7x365 Managed Security Service. This opportunity encompasses the day-to-day operation of the Security Operation Center and will have primary responsibility for customer satisfaction driven by the service provided through the SOC...
	Divisional Loss Prevention Director Florida Provides strategic loss prevention management for a division of 2,000+ stores with sales volumes totaling +/- $4B. Maximizes profits by developing and executing programs to reduce and prevent the loss of company inventory/assets and managing Regional Loss Prevention Managers within an assigned geographical area...
	Regional Asset Protection & Safety Manager Dallas, TX The Regional Asset Protection and Safety Manager will lead the Region in shrink reduction and profit maximization efforts. The position will proactively seek to bring economic value to the company, promoting profitable sales and world class customer service while ensuring a safe place to work and shop...
	Regional Loss Prevention Manager Baltimore MD This position is responsible for managing all aspects of loss prevention for a geographic area to reduce and control shortage and other financial losses in 120 to 140 company stores. The coverage areas average $550 million in sales revenue and $3.5 million in shrink losses annually...
	Loss Prevention Investigator Wawa, PA The Loss Prevention Investigator is responsible for utilizing proper investigative techniques and act as the primary liaison with field operations management. Conducts investigations into cash losses, deposit shortages, associate theft, overall shrinkage, and other matters...

Featured Jobs

To apply to any of today's Featured Jobs, Click Here

Today's Daily Job Postings from all around the net - Appearing today only

To apply to today's Internet Jobs, Click Here

Sponsor Today's Internet Jobs 

Mentorships: Look for Your Future Self,
Warning Signs, and Ask your Co-Worker
 

We want to post your tips or advice... Click here

Not getting the Daily? Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here