The Loss Prevention Foundation (LPF) Announces New Board Members
The Loss Prevention Foundation (LPF) has announced the selection of its newest board members to assist in governing and providing strategic direction for the Foundation. The following individuals have accepted the nomination and have been approved by the board to serve on the Foundation's Board of Directors. yourlpf.org

A Legal Perspective
How Does CCPA Act Impact Your Company?

The California Consumer Protection Act (“CCPA”) & the “Do Not Sell My Personal Information" link
Must a business that doesn't sell California Consumer's Personal Information (PI) comply?
When the CCPA was signed into law confusion abounded about how to comply with it. One major question was whether an effected business that does not sell a consumer’s PI, as defined in Section 1798.140(o)(1)(A)-(K), needed to comply with Sections 1798.120 and 1798.135. Section 1798.120 created an opt-out right to the sale of a consumer’s PI and Section 1798.135 provides in part that, “A business that is required to comply with Section 1798.120 shall…Provide a clear and conspicuous link…Titled “Do Not Sale [sic.] My Personal Information” on its website’s home page. While it may seem clear initially that these sections would not apply to a business that does not sell PI, Section 1798.140(t)(1) created confusion as to what a sale was as the term was broadly defined and could be construed to mean a transfer of PI between a business and a service provider or third party for valuable consideration.

Public service announcement provided by The Zellman Group

Intellicheck’s Age ID is Key to Underage Vaping Epidemic

The nation is in the grip of an underage vaping crisis. President Trump has called for a ban on flavored vaping products. The FDA is looking at regulatory relief and punitive actions. States and municipalities across the U.S. are struggling to deal with the underage vaping crisis at a local level. With the death toll on the rise and cases of vaping-related illnesses surging, answers to how to tackle this crisis have seemed elusive.

Many states and municipalities have focused efforts on passing Tobacco 21 legislation raising the purchasing age. The thinking is that this will prevent the sale of e-cigarettes and vaping products to young people. Others have instituted a ban on the sale of any flavored vaping products as these seem to be so attractive to young people. Some have instituted a complete ban on the sale of any vaping products.

The education community is also taking steps to try and curb underage vaping. College campuses are declaring smoke free zones. Elementary, middle and high schools are adding enforcement measures and some are installing vaping detectors in bathrooms to catch young people in the act. Some schools have removed bathroom doors and others are limiting when young people can use rest rooms during school hours.

Enforcement agencies are stepping up sting operations aimed at assuring retailers are not selling vaping products to minors. Retailers share their concern. One national retailer, Walmart, has removed all vaping products from its shelves in an effort to stop underage access.

The problem is these efforts have failed to curb underage vaping. A critical aspect of this problem is the same issue that continues to fuel underage access to alcohol. Fake IDs. Fake IDs are so sophisticated that even the most seasoned enforcement officers and retailers aren’t able to catch the high-tech fakes with traditional methods. The answer? Age ID.

Age ID authenticates IDs and verifies age information in real-time with proven 99.9 percent accuracy. The budget friendly SaaS technology solution is easy to adopt and use and is readily deployed on mobile devices including smartphones and tablets and can also be easily integrated with point-of-sale systems. The cutting-edge technology solution draws on a comprehensive, proprietary database, updated on an ongoing basis, to ensure information is timely and accurate.

Cross-border Cybercrime
Interpol aims to set up international cybercrime database. Interpol this week soft-launched a secure technology platform to help authorities in the agency’s 194 member countries share sensitive information about cases and training and potentially collaborate on investigations. In the future, Interpol plans to include a chat function and ways to share files.

The platform, which is encrypted and hosted on a secure cloud managed by Interpol, is separate from the agency's plans to create a cybercrime database. The international police agency wants to aggregate cybercrime data from national authorities and share it with other investigators, who might be able to draw connections between hacking methods or large criminal groups. cybersecurity.cmail20.com

5 things security executives need to know about insider threat
Screen Pre-hires - Limit New Hires - Warning Signs - Ongoing Evaluation - Intervene Early
According to the 2018 Deloitte-NASCIO Cybersecurity Study, CISOs’ top challenges remain “budget, talent and increasing cyber threats,” and to some, insider threat doesn’t even make the list of top-ten priorities.

Considering what’s at stake – and our 21st-century ability to see signs of, and ultimately prevent, insider threat – this is a phenomenon security executives can no longer afford to ignore. Specifically, leaders need to know these five things about insider threat:

1. Don’t underestimate the business threats that stem from within - according to Verizon’s 2019 Data Breach Investigation Report, more than one third of breaches that took place during November 2017-October 2018 involved internal actors.

2. Disengaged employees are usually grown, not hired - Companies know that with every new hire, they naturally run the risk of making a bad hire every once in a while. That’s why many already conduct pre-hire background checks, and why some even instate “new-hire” periods where employees aren’t yet entitled to certain benefits or granted access to confidential information.

These steps aren’t enough. As time goes on, events arise in an employee’s personal life that can impact their performance and behavior in the workplace. Stress can drive otherwise ethical employees toward contemplating putting the company at risk for their own financial gain – i.e., stealing office supplies, stealing intellectual property, lying on reimbursement forms, etc.

3. Disengaged employees exhibit warning signs - The good news is that insider threats like these are often precluded by observable patterns of behavior that usually boil down to one thing: stress.

Gallup, stressed and disengaged employees are 37% more likely to take time off from work, and the companies they work for are 18% less productive and 15% less profitable. Or, in more extreme cases, stress might manifest verbally in conversations with clients and coworkers; physically; or in an employee concocting some sort of malicious plan.

4. Continuous evaluation enables leaders to compliantly see employee risk indicators - Continuous evaluation solutions alert business leaders to employees exhibiting these early warning signs. In addition to what a background check would typically screen for – criminal activity, chiefly – continuous evaluation solutions can be customized to also screen for other factors of interest: workplace violence, customer service reviews, suspicious financial or internet search activity, etc.

They may also allow for anonymous reporting, so that if individuals witness concerning behavior firsthand, they have an opportunity to relay that information without fear of repercussion from the individual. This ability is especially crucial for workplace sexual assault or harassment cases.

All this must be done compliantly. That’s why employee consent can be included in the onboarding process, and why some continuous evaluation solutions feature an automated review process that ensures a standardized workflow for verification and investigation by HR, Legal, Security and Compliance. And, with the Equal Employment Opportunity Commission (EEOC) and Fair Credit Reporting Act (FCRA) in mind, they also include employee privacy protections and legal guardrails to ensure a fair and equitable process that eliminates bias and favoritism.

5. Early and ongoing discovery enables leaders to intervene before behaviors escalate - Warning signs should never be ignored. Acting sooner rather than later gives security executives the ability to work with other members of the leadership team or HR to prevent an employee’s problem from escalating.

Clearly, companies have a lot to lose by overlooking insider threat, something security leaders now have the ability to quickly identify and mitigate. Aside from being something they should do, leveraging early and ongoing evaluation to see and prevent insider threat is something security executives must do, for the business, its employees and the people it serves. helpnetsecurity.com

Researchers may have found a way to trace serial IP hijackers
It’s estimated that in 2017 alone, routing incidents such as IP hijacks affected more than 10 percent of all the world’s routing domains. What if we could predict these incidents in advance by tracing things back to the hijackers themselves?

That’s the idea behind a new machine-learning system developed by researchers at MIT and the University of California at San Diego (UCSD).

The nature of nearby networks

IP hijackers exploit a key shortcoming in the Border Gateway Protocol (BGP), a routing mechanism that essentially allows different parts of the internet to talk to each other. Through BGP, networks exchange routing information so that data packets find their way to the correct destination.

“It’s like a game of Telephone, where you know who your nearest neighbor is, but you don’t know the neighbors five or 10 nodes away,” says Testart. helpnetsecurity.com

Imperva's Breach Post-Mortem: API Key Left Exposed
 

Toronto, ON: Six face 63 charges in C$7 million cargo crime spree
Six men face 63 charges in connection with a series of cargo crimes near Toronto, including the hijacking of a truckload of nearly C$7 million of cell phones and tablets and the theft of three commercial vehicles. The crimes appeared to have been unusually well-planned and brutal, even as Canada contends with an uptick in cargo theft. Investigators suspect that the six men may have been involved in crimes going back to 2018, and have connections in eastern and western Canada. While the value of the electronics shipment was large, Mooken said the security guard and truck driver from the incidents bore the brunt of the crimes. freightwaves.com

Seattle, WA: ‘Fresh Tangerine’ Jewelers in Capitol Hill suffers $51,000 loss in early morning Burglary
Capitol Hill retailer and designer Fresh Tangerine suffered a devastating hit to the young business after an early morning burglary last week that emptied the E Pine store of thousands of dollars and months of work in handmade jewelry. “We lost 2,085 pieces of inventory which is a retail value of $51,887 along with a couple of other of jewelry items from our cash drawer,” owner Kim Kogane said of the Thursday, October 10th, 5 AM break-in. capitolhillseattle.com

Valencia, CA: Four Arrested for theft of $10,000 in merchandise from Lululemon
“On Sunday, four women entered a sportswear store at the Westfield Valencia mall and walked out with ten thousand dollars worth of products,” said Shirley Miller, Santa Clarita Sheriff’s Station. “The four suspects were all females between the ages of 19 and 20, and from the Oakland area,” Miller added. The arrests of these suspects and ensuing investigation may reveal a connection to similar crimes throughout Southern California, and quite possibly throughout the state, according to Miller. facebook.com

Update: Ammon, ID: 3 arrested for $6,000 theft from TJ Maxx
Three TJ Maxx employees allegedly stole thousands of dollars in merchandise in a scheme foiled by the corporate office. All three of the employees admitted to management and deputies to stealing or helping steal items over several months. The exact amount taken remains unknown but could be upwards of $6,000. When detectives spoke with the corporate loss prevention manager, she said the trio would ring each other up at the register and void some of the items. Additionally, several items in the reported thefts were placed into bags without being scanned. eastidahonews.com