The D&D Daily Mobile Edition
LP, AP & IT Security's #1 News Source

See All the Executives 'Moving Up' Here   

Submit Your New Corporate Hires/Promotions or New Position
 

Top 10 Action Items for 2021: The California Privacy Rights Act (CPRA)
How can your business prepare for the California Privacy Rights Act (CPRA) ramp-up in 2021? The CPRA is scheduled to become effective in January 2023. Preparations will occur over the next two years, including establishing the new California Privacy Protection Agency, which will take over rulemaking from the California Attorney General. With an impact on most medium to large businesses located in California or doing business in California, even companies that have already taken steps to comply with the CCPA will need to plan carefully for successful CPRA compliance.

Here are 10 essential steps that companies can consider taking now to prepare for the CPRA:

1. Determine whether the CPRA applies to your organization.

2. Advise senior management of coming changes to privacy law and impact on your organization.

3. Designate a CPRA compliance team with an appointed team leader, schedule monthly check-ins and ensure CPRA compliance costs are built into this year's budgets.

4. Determine if software development work is required and ensure software development teams update this year's development roadmap.

5. Update your data map to include new CPRA-specific details, including sensitive personal information designations and data retention periods.

6. Inventory your company contracts to determine contracts that will need to be updated for compliance with the CPRA.

7. Identify privacy notices that will need to be updated.

8. Watch out for updates on the timing of additional CPRA regulations.

9. Review your company's current security posture and identify potential security enhancements to be implemented this year.

10. Develop a CPRA compliance roadmap. jdsupra.com

Massive spike in fraud across all industries - 4.3B attacks detected since Black Friday
Arkose Labs, provider of online fraud and abuse prevention technology, released new data on the latest fraud trends that reveal a massive spike in fraud across all industries from Black Friday onwards. As consumers continue to flock online in droves greater than ever before, credential stuffing, account takeover (ATO) attacks and gift card fraud are poised to be top attack vectors in 2021.

“2021 remains full of unknowns, however what’s certain is the frequency and severity of fraud will never return to pre-pandemic levels,” said Vanita Pandey, VP of Marketing and Strategy at Arkose Labs. “With digital channels serving as an invaluable lifeline for much of the world, the Arkose Labs network saw 4 times as many transactions compared to the year prior. This increased activity has created an ideal breeding ground for attacks as fraudsters work to blend in with trusted users, rendering typical models of good versus bad user behavior obsolete.”

The Black Friday Effect and Gift Card Fraud
As in previous years, the Arkose Labs network recorded a sustained increase in fraud in the ecommerce industry from Black Friday through the end of the year. This year, however, this sustained increase in fraud occurred across all industries -- even those not typically associated with Black Friday, such as social media, online dating and financial services.

Credential Stuffing and New Attack Types
The influx of new digital accounts created in Q4 of 2020 led to a drastic increase in credential stuffing attacks, which power account takeover attacks. Credential stuffing attacks more than doubled in Q4 compared to Q3, and increased by nearly 90% compared to Q1.

To access the full Q1 2021 Fraud and Abuse Report, please click here. securitymagazine.com

Insider Threat Unleashed a $100M Cryptocurrency Theft
Authorities arrest SIM swapping gang that targeted celebrities
Eight men were arrested in England and Scotland as part of an investigation into a series of SIM swapping attacks targeting US celebrities.

Eight men were arrested across England and Scotland this week as part of a coordinated crackdown against a SIM swapping gang that has hijacked the identities and social media profiles of US celebrities.

The UK National Crime Agency, which made the arrests on Tuesday, said the gang targeted well-known sports stars, musicians, and influencers, primarily located in the US. Officials said this gang engaged in SIM swapping attacks, where they tricked US mobile operators into assigning a celebrity's phone number to a new SIM card under the attacker's control.

While they had access to the victim's phone number, the SIM swappers would reset passwords and bypass two-factor authentication on the victim's accounts. "This enabled them to steal money, bitcoin and personal information, including contacts synced with online accounts," the NCA said.

Europol said the gang stole more than $100 million worth of cryptocurrency using this method.

The practice usually relies on tricking telco call center staff into assigning a phone number to a new SIM card, but it often also relies on rogue employees inside telephone companies willing to cooperate with criminal gangs.

One such employee was charged in the US on Monday. The US Department of Justice indicted Stephen Daniel Defiore for his role in helping SIM swappers steal the identities of at least 19 people while working as an employee for an unnamed US phone company between August 2017 and November 2018.

US authorities said Defiore received $2,325 in a series of twelve payments for his role in the scheme. If found guilty, he now faces a prison sentence of up to five years and a fine of up to $250,000. zdnet.com

Most zoombombing incidents are inside jobs
Most zoombombing incidents are “inside jobs” according to a study featuring researchers at Binghamton University, State University of New York.

The videoconferencing app Zoom became an online home for many of these activities, but the migration also led to incidents of zoombombing. Similar apps such as Google Meet and Skype also saw problems.

Attackers don’t just stumble upon meeting invitations

They found that the vast majority of zoombombing are not caused by attackers stumbling upon meeting invitations or “bruteforcing” their ID numbers, but rather by insiders who have legitimate access to these meetings, particularly students in high school and college classes. Authorized users share links, passwords and other information on sites such as Twitter and 4chan, along with a call to stir up trouble.

“Some of the measures that people would think stops zoombombing — such as requiring a password to enter a class or meeting — did not deter anybody,” Blackburn said. “Posters just post the password online as well.

“Even the waiting rooms in Zoom aren’t a deterrent if zoombombers name themselves after people who are actually in the class to confuse the teacher. These strategies that circumvent the technical measures in place are interesting. It’s not like they’re hacking anything — they’re taking advantage of the weaknesses of people that we can’t do anything about.” helpnetsecurity.com

NIST Publishes NISTIR 8301: Blockchain Networks—Token Design and Management Overview
NIST announces the publication of NISTIR 8301, Blockchain Networks: Token Design and Management Overview, which provides a high-level technical overview and conceptual framework of token designs and management methods. The document highlights the different types of tokens and how they are held in custody. It then examines transaction management under three fundamental aspects: validation, submission, and viewability. Infrastructure tools used to develop applications that integrate blockchain networks and second layer protocols are also reviewed.  Finally, the paper presents deployment scenarios and use cases for tokens before concluding with potential breakthroughs in privacy-preserving verifiable data exchange. csrc.nist.gov

'The Rumors Became Real'
Former Nygard employees, intern say fear, intimidation, even sexual harassment commonplace at the company
Thirteen years after leaving a job at Nygard International Partnership, Brenda Bourns finally feels safe enough to share her story. Bourns worked as the special events manager at the company's head office on Inkster Boulevard in the fall of 2007. She quit 10 months later.

Peter Nygard, 79, was arrested in Winnipeg in December and is currently awaiting extradition to the U.S. for allegations he sexually trafficked women and girls over a 25-year period. Nygard denies all the allegations and says they are part of a conspiracy to tarnish his reputation.

Bourns said what she witnessed during a trip to Burnaby, B.C., for a Nygard store opening made her realize the job wasn't for her.

"The rumours became real ... all the things that I've heard for decades of rumours, innuendo, allegations, hearsay, all of the things ... they were real and I'm done," recalled Bourns. cbc.ca

Racial Bias in the U.S. is Spilling Into Canada
The retail sector has a racial bias problem — and this Sephora survey suggests it's costing it customers
A study commissioned by beauty giant Sephora on racial bias in the U.S. retail sector is having reverberations in Canada — at Sephora's Canadian stores and for those in the beauty industry. The Racial Bias in Retail Study, released in January, aimed to quantify how common it is to experience racial bias, and identify opportunities to eliminate it.

"I absolutely saw myself in that study," said Canadian beauty brand creator, Tomi Gbeleyi-Curtis. "I've had experiences where people follow me around the store."

"It was the first of its kind study to really glean insights into the disparate experiences that many U.S. BIPOC shoppers and employees actually face today," said Debbie McDowell, director of social impact for Sephora Canada.

Sephora Canada doesn't plan to do a Canadian version of the survey; instead, it will build off of the U.S. findings. cbc.ca

J.Crew has officially closed all of its Canadian stores
J. Crew has exited Canada for good. After 10 years in the country, the American fashion retailer has closed its last remaining stores. The company has been experiencing a years-long decline worldwide, largely attributed to the brand's failure to keep up with fast fashion and athleisure trends. blogto.com

Big Changes Coming for Canadian Grocery in 2021 and Beyond: Expert

Nordstrom Appoints New Canadian Head of Stores

Air Canada to temporarily cut 1,500 jobs, suspend 17 routes
 

Serial Robber Has Long Criminal Record
Halifax, NS: Man accused of committing four robberies in two hours
Halifax Regional Police responded to a robbery at the Roots Store on Spring Garden Road on Friday at about 2:30 p.m. A man entered the store, demanded cash and stated he had a knife. He left the area on foot with an undisclosed amount of cash. Shortly after that, attempted robberies were reported at two other businesses on Spring Garden Road – a CIBC branch and Totally Raw Pet Food. In both incidents, a man demanded money but left without obtaining any. At 4:35 p.m., a fourth robbery was reported at Moffatt’s Pharmacy on Gladstone Street. A man who said he had a firearm fled with an undisclosed amount of cash. Police said no weapon was seen in any of the incidents and nobody was injured. thechronicleherald.ca

Waterloo, ON: Employee assaulted during convenience store robbery
Waterloo Regional Police are looking for a suspect following a convenience store robbery in Cambridge. It happened around 7 p.m. Saturday at a store in the area of Chalmers Street South and Elliott Street. Upon entering the store, the suspect walked behind the counter, allegedly assaulting the employee. The male suspect then fled with merchandise. kitchenertoday.com

Police in P.E.I. seize more than $45K worth of hydromorphone, arrest two men

Charlottetown, PEI: Suspended sentence for theft for Summerside man

Vancouver, BC: Anti-masker accused of threatening employee with baton after stealing apple
 

Robberies & Burglaries

● C-Store - Waterloo, ON - Robbery/Employee Assaulted
● CIBC- Halifax, NS - Robbery
● Dog Store - Halifax, NS - Robbery
● Drug Store - London, ON - Burglary (2x)
● Pharmacy - Halifax, NS - Robbery
● Roots - Halifax, NS - Robbery

How are we doing? We need your input & suggestions. Send to lpnews@d-ddaily.net

View Canadian Connections Archives
 

Submit Your New Hires/Promotions
or New Position
See all the Industry Movement

Feature Your Job Here For 30 Days -
70% Aren't On The Boards
Post your job listing

Passion is probably the one trait all employers look for in every search and in every candidate. It's also the one ingredient that's hard to manufacture and almost impossible to fake. Certainly, energy level has a lot to do with it and virtually everyone can pick it up a notch when they need to. But passion is something that's deep and something money can't buy and quite frankly it's worth it's weight in gold because passion motivates people and it's what separates the good from the great. If you've got passion, let it show and, if you don't, try to go find it because every employer wants it.

Just a Thought,
Gus

Post Your Tip or Advice!
(content subject to approval)

See More Events

Recruiting?
Get your job e-mailed to everyone... everyday
Post on our Featured Jobs Board!

Not getting the Daily?
Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here
 

SUBSCRIBE

FEEDBACK

www.downing-downing.com

Advertise With The D&D Daily

36615 Vine Street, Suite 103
Willoughby, OH 44094
440.942.0671
copyright 2009-2019
all rights reserved globally