The D&D Daily Mobile Edition
LP, AP & IT Security's #1 News Source

APPRISS RETAIL ACQUIRES LP SOFTWARE
TO EXPAND RETAIL SOLUTIONS

Adding the LPMS product line and client base increases
Appriss Retail’s market leadership

IRVINE, Calif. (February 22, 2019) - Appriss Retail, the industry leader in retail performance improvement solutions, today announced the acquisition of LP Software, a leading developer of loss prevention and risk mitigation solutions. LP Software has a broad, diverse, and global customer base of more than 150 retailers, many new to the Appriss Retail family. This combination expands Appriss Retail’s premier analytics position in the market, as well as increases the resources and capabilities available to LP Software.

Established in 1998, the Chicago, Illinois-based company is best known for its case management system (LPMS) and its compliance and store audit solution (CAMS). A strong brand name and a team with a wealth of experience in case/incident management solutions, LP Software’s products and expertise provide a complementary fit to Appriss Retail’s existing solutions, including Secure Store. Appriss Retail and LP Software already have a successful, jointly-developed integration to build upon.

“The acquisition of LP Software allows Appriss Retail to serve 250 of the largest, most advanced retailers in the world,” said Krishnan Sastry, president of Appriss Retail. “We committed ourselves to deliver the most comprehensive retail analytics platform to help loss prevention and store operations executives to continue to improve the competitiveness and profitability of their companies. LP Software’s expertise in compliance and audits, in addition to their long-standing position in case management, will lead to further product innovation for our customers.”

“We are excited about the acquisition and the ability to combine LP Software’s expertise in case and incident management with Appriss Retail’s skills in artificial intelligence,” said Brian Eskra, president and CEO of LP Software. “This will enhance the ongoing service and value we deliver to our clients. In fact, we have compiled an extensive dataset of more than 6 million cases, which gives us deep insight into the fraud, compliance, and audit work space that will help drive future innovation.”

With more than 20 years of retail data science expertise, Appriss Retail’s Software-as-a-Service (SaaS) platform targets the retail Global 1000 and generates advanced analytical insights and real-time decisions that drive action throughout the organization, including operations, finance, marketing, and loss prevention. Its performance-improvement solutions yield measurable results with significant ROI among retail store, ecommerce, and inventory functions.

About Appriss Retail
Appriss Retail, a division of Appriss, Inc., provides artificial intelligence-based solutions to help retailers protect margin, unlock sales, and cut shrink. With more than 20 years of retail data science expertise, the company’s Software-as-a-Service (SaaS) platform generates advanced analytical insights and real-time decisions that drive action throughout the organization, including operations, finance, marketing, and loss prevention. Its performance-improvement solutions yield measurable results with significant return on investment among retail store, ecommerce, and inventory functions. Appriss Retail serves a global base of leading specialty, apparel, department store, hard goods, big box, grocery, pharmacy, and hospitality businesses in more than 125,000 locations (brick and mortar and online) in 45 countries across six continents. For more information about Appriss Retail, visit https://apprissretail.com.

About LP Software
LP Software provides customizable software to help companies of all sizes, by providing innovative product solutions, and delivering results that increase your bottom line. Our proven solutions will help you manage Loss Prevention incidents, HR incidents, Compliance Auditing/Checklists, Accidents, OSHA reporting, Award Management, and Task Management. As a leading provider of software solutions, LP Software provides both on premise installation as well as On-Demand service. With our On-Demand service, you experience the benefits of an integrated management solution without large upfront costs or having to build a large IT infrastructure. For more information, please visit www.LPguys.com

We’ve Changed Our Name, but the Mission Remains the Same

R-CISC Changes Name to Retail and Hospitality ISAC to Reflect Expanded Membership

The R-CISC was built to create a secure place for retailers to share cybersecurity information and intelligence to not only better protect their own companies, but to also strengthen the entire sector – a rising tide lifting all boats. What started with about 30 companies coming together in Pittsburgh, PA, in 2014 has now grown to include 120 Core Members (retailers, restaurants, hotels, gaming casinos, consumer product companies and more) sharing not only the threat information that they are seeing but their cybersecurity journey, as well, so others can learn, grow and continue to mature. It also includes 20 Associate Members who share their insights and provide key services to our community.

What started with building trust one meeting at a time has led to a vibrant sharing community in which, last month, 50 percent of member companies shared something and last year the community collected more than 40,000 indicators of compromise that could be ingested automatically into members’ systems.

In building the R-CISC, we also created the Retail Information Sharing and Analysis Center (Retail ISAC), but housed it under the broader name for concerns of government over-reaction during those heady days of 2014. But, to be honest, the name has always been a bit of a stumbling block, requiring an extra step of explanation of who we are.

That’s about to change. Effective this week, the R-CISC is now the Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC).

  

What is an ISAC - Information Sharing and Analysis Center?
ISACs provide real-time threat and attack intelligence sharing, training and curated reporting to their members, who may pay an annual fee depending on the market sector. Information sharing through ISACs is usually protected by legal agreements that protect against non-disclosure and attribution back to the reporting organization, providing some protection for their members against inappropriate disclosure. In addition, the advent of automated sharing platforms hosted by some ISACs can allow for consistent collaboration between member organizations and some may be able to respond and share actionable threat intelligence more quickly than the government. acscenter.org

CISO = “chief information scapegoat officer”
The CISO’s Days as Scapegoat Could Be Coming to an End
Battle Worn - Battle Tested - Experience Counts
Many chief information security officers fear that a data breach will cost them their jobs, but there is a growing recognition among companies that this strategy can do more harm to businesses than good, according to executive recruiters and cybersecurity experts.

Getting rid of security leaders, who often know the company’s systems better than anyone, can slow recovery after a breach, disrupt the company’s technology organization and add to management’s headaches on top of urgent repair work.

CISOs who have experienced big cyberattacks first-hand can be valuable, executive recruiters said.

“It’s not universal yet, but companies are starting to recognize that those who successfully live through an incident bring some scar tissue with them,” said Aileen Alexander, co-leader of executive-search firm Korn/Ferry International’s cybersecurity practice. “If you did the right things and were proactive, it can make a CISO candidate more desirable.” cmail19.com

California To Strengthen Data Breach Laws, Close Loopholes
California, which has some of the strongest data breach notification laws in the U.S., thinks it can do even better.

The golden state’s attorney general Xavier Becerra announced a new bill Thursday that aims to close loopholes in its existing data breach notification laws by expanding the requirements for companies to notify users or customers if their passport and government ID numbers, along with biometric data, such as fingerprints, and iris and facial recognition scans, have been stolen.

California remains, however, one of only a handful of states that require the provision of credit monitoring or identity theft protection after certain kinds of breaches. techchrunch.com

92% of organizations rank users as their primary security concern
On average, 81% of organizations had some degree of concern around security issues, according to the results of a new research: What Keeps You Up at Night – The 2019 Report, released by KnowBe4.

92% of organizations rank users as their primary security concern. And at the same time, security awareness training along with phishing testing topped the list of security initiatives that organizations need to implement.

Organizations today have a large number of attack vectors to prevent, monitor for, detect, alert and remediate; in terms of attacks, 95 per cent of organizations are most concerned with data breaches. helpnetsecurity.com

The Hot, Lucrative Market in IT Security Talent
A shortage of talent is driving up salaries in the cybersecurity field as companies try to lure new hires.

Here’s a look at who’s making what and you can see more pay trends here. cmail19.com

Now For the Bad News
Cyber Extortionists Can Earn $360,000 a Year
Extortion scams capitalize on compromised credentials, sensitive data, and technical vulnerabilities on Internet-facing applications to pressure victims to pay up.

Cybercriminals seeking sensitive data on high net-worth individuals will pay aspiring extortionists an average of $360,000 per year to target executives, lawyers, doctors, and other prominent figures, researchers discovered.

The extortion landscape is broader and more diverse than any of us thought before we started," says Rafael Amado, senior strategy and research analyst with Digital Shadows.

Today's extortionists are getting creative and finding new ways to earn cash. They're after details of victims' personal lives and/or sensitive corporate data. Sextortion scams, in which criminals claim to have evidence of targets watching sexually explicit content, have skyrocketed. Between July 2018 and Feb. 2019, Digital Shadows collected and analyzed 792,000 sextortion attempts targeting 89,000 recipients. Criminals amassed $332,000 USD in payments; analysis of Bitcoin wallets linked to attacks shows they could earn $540 per victim, on average.

Many cybercriminals are looking for members to collaborate with so they can grow their operations. There are many ways to jump into the game, and you don't have to be technically savvy: aspiring extortionists with weak skillsets can find tutorials on the Dark Web. Some experienced attackers sell DoS and ransomware-as-a-service models to novice hackers.

"Extortion campaigns aren't the most sophisticated from a technical perspective, but you still need people to create spoof emails, to mine for personal data like compromised credentials," says Amado. "You need someone to manage Bitcoin transactions, someone to launder money."

The extortion skillset is broad. Researchers found admin panels, network and website access, and sensitive data being sold on the "accesses" sections of top-tier criminal forums. For these, extortionists would need technical skills to move laterally inside target networks and find data. On the other end of the spectrum are entry-level buyers and sellers of data trading credentials.

Is Your Business at Risk?

Extortion can affect any organization, says Amado, but the type of threat you're likely to encounter depends on the type of business you are.

All businesses should be asking themselves: Do I have public-facing infrastructure? Should it be public-facing? If it does need to be open to the public, are there vulnerabilities?

Researchers recommend treating sextortion emails as spam, discovering breached accounts and passwords on HaveIBeenPwned, and securing email end-users, developing a ransomware playbook, and applying best practices for user permissions: remove local admin rights, restrict execution privileges on temporary data folders, and implement whitelists application lists. darkreading.com

NRF On The Current State of E-Commerce Supply Chains
The rapid growth of e-commerce is driving deep changes in our industry, from tightening up trucking capacity to elevating the importance of final-mile delivery processes. To respond, supply chain managers now need to leverage diverse systems, thereby making processes more efficient.

Jonathan Gold, Vice President, Supply Chain and Customs Policy for the National Retail Federation shares his insights and observations on e-commerce in this exclusive interview.

Supply Chain Management Review: How is e-commerce changing the way we approach logistics/distribution network strategy?

Jonathan Gold: By eliminating the physical constraints of how much merchandise will fit into a physical store, e-commerce allows a retailer to offer a virtually unlimited selection of merchandise. But the more merchandise that’s offered, the more challenges there are in where it is sourced from, how it gets to the retailer, how it is sold to the customer and how it gets delivered to the customer. As retailers expand into options like selling products that are drop-shipped directly from the manufacturer to the customer or selling their products through third-party online marketplaces like eBay or Amazon, the complexity is even greater. Delivery and opening the box also take on greater importance. The way a company ships the product – is it traceable while on its way, does the customer get alerts, is shipping quick, when the box arrives is the product well-packed and does it arrive in good condition – is all part of the customer experience and can color how the customer feels about the transaction. Since an online customer doesn’t have the opportunity to visit a store or interact with a store associates the arrival of the box is the first tangible interaction with the company. It can make the difference between a good and bad brand experience. Read full interview here. scmr.com

Legit Brand Creative Is Getting Hijacked –
And Advertisers Need To Start Paying Attention
Walmart, Nike, Amazon, Dell, Honda, Lowe’s – all brand advertisers you can trust, until a bad actor steals their ad creative to use as a vehicle for spreading malware. The problem grows during periods of higher traffic, like the holidays, said Maggie Louie, CEO and founder of DEVCON, a cybersecurity startup focused on fraud detection.

Even if the first incident doesn’t affect an advertiser’s bottom line, turning a blind eye allows more fraud to be seeded into the open ecosystem over time, and that will eventually show up at their doorstop.

Ads are hijacked when fraudsters take real creative assets, usually basic banner ads, and inject them with bad code to run exploits and then deploy the reconfigured ads through programmatic pipes. If an ad network’s or exchange’s quality assurance process isn’t robust enough – perhaps they’re only looking at the images and text rather than the code within – the fake ad can slip through.

DEVCON came across a Hollister ad in the wild offering users a 50% discount that was really a trojan to distribute malware. Ad Lighting discovered a Wacoal banner during the 2018 holiday season in which the click-through URL was replaced with a malicious domain. Users who tried to “X” out were redirected to the phony site.

Digital marketers do need to be alarmed, he said. Performance display represents a lot of dollars and it’s all centered on getting people to click and buy – yet maybe that’s actually part of the problem. Click-based strategies don’t work, Heimlich said, whose research into the matter suggests that traffic coming from people who click on ads is not incremental. adexchanger.com

ORC News
Sponsored by Auror
 

Omaha, NE: Stolen goods are funding gangs; Detectives say 'boosters' could be funding gang activity
For the past year and a half, Omaha police have been busting aggressive shoplifters known as "boosters." "This is a different type of theft than a child stealing a Snickers bar at the local Walgreen's," Sgt. Aaron Hanson said. Police said boosters swipe as much expensive merchandise as they can and even threaten store managers. Retail Crime Detective Jerrod Galloway said he noticed a pattern. "The same suspects keep showing up across the area and stealing large amounts of clothing," he said. Some of these suspects include Nenzhingha Davis, Montashia Montgomery and Kasandra Rolling. Galloway said they started a boosters ring in 2017, when Rolling was pregnant. He said they boosted 17 times in one month, stealing thousands of dollars in clothing. Galloway said the women turn around and sell the items on social media to make a profit, but police suspect the crimes may go beyond that.  ketv.com

Los Angeles, CA: High-End Makeup Thieves Target Studio City Shop
Police Thursday released video of suspected members of an organized theft ring that has targeted high-end makeup stores in the Los Angeles area. An investigation was launched in January by the Los Angeles Police Department's Commercial Crimes Division, Burglary Special Section. "The suspects enter the businesses with empty purses or shopping bags," according to a police statement. "The suspects conceal high dollar fragrances in the empty bags and leave the store without paying for the merchandise. In some incidents, the suspects were confronted by employees who attempted to retrieve the merchandise and were overpowered by the suspects." Losses have been in the thousands of dollars, according to the LAPD, which reported that the suspects have struck stores at the Beverly Center and in Studio City, Marina Del Rey, Tustin and Glendale.  patch.com

Butler County, OH: Court docs detail FBI investigation into alleged stolen baby formula scheme
Three men allegedly used drug addicts to steal from retailers in Butler and Hamilton counties, going as far as requesting specific types of baby formula, and then shipped the stolen goods to other parts of the country, according to federal court documents. Khalil Yacub, 44, Khalil Jaghama and Jasser Saleh, 41, are all charged with federal crimes of transporting stolen goods, conspiracy to commit the crime and unlawful possession of a means of identification, according to court documents from the United States Federal Court in Cincinnati. Yacub’s family owns and operates the convenience store The Pit Stop in Colerain Twp., and much of the alleged criminal activity centered around that store, although a confidential person told investigators she has sold stolen formula at two other Cincinnati businesses run by Yacub. Employees of the Pit Stop, including Yacub, Jaghama and Saleh, would allegedly pay individuals, many of them drug addicts, to work as “boosters” to steal baby formula.  journal-news.com

Philadelphia, PA: 4 Arrested at Wawa Spree, two Wawa Employees assaulted

Gainesville, FL She stole three TVs from one Walmart. Then she stole four more; total over $1,500

Lexington, SC: Police are trying to identify a young woman for $1,000 Credit Card Fraud

Guilford, CT: Two wanted for theft at Ulta Beauty

Home of the Industry's Original
On the Move
 

Submit Your New Hires/Promotions
or New Position
See all the Industry Movement

Featured Job Listings
Sponsored by NuTech National
Feature Your Job Here For 30 Days -
70% Aren't On the Boards
Post your job listing

Just a Thought,
Gus

Post Your Tip or Advice!
(content subject to approval)

Upcoming Events

Appriss Retail User Conference Feb. 25-27 i3 International Innovision 2019 Feb. 25-27 IAI West Coast Chapter Meeting Mar. 1 LPRC Supply Chain Protection Summit Mar. 12 IAI Elite Training Day April 3-4 ISC West April 9-12 RILA AP Conference 2019 May 5-8 RLPSA Connect May 14 CNP Expo 2019 May 21-24 The D&D Daily 'Live at NRF Protect' June 14 OROCC Conference June 20 RFID Journal Live! Retail June 25-27 IAFCI Training Conference Aug. 26-30 Global Security Exchange Sept. 8-12 CLEAR 10th Annual Training Conference Oct. 28-31 NJFC LP Conference & Exhibition Oct. 30

See More Events

Recruiting?
Get your job e-mailed to everyone... everyday
Post on our Featured Jobs Board!

Not getting the Daily?
Is it ending up in your spam folder?
Please make sure to add d-ddaily@downing-downing.com to your contact list, address book, trusted sender list, and/or company whitelist to ensure you receive our newsletter. 
Want to know how? Read Here

SUBSCRIBE

FEEDBACK

www.downing-downing.com

Advertise With The D&D Daily

36615 Vine Street, Suite 103
Willoughby, OH 44094
440.942.0671
copyright 2009-2019
all rights reserved globally