INDUSTRY NEWS

Emerging Cyber-Security Threats

by Robert L. DiLonardo

dilonardo is a well-known authority on the electronic article surveillance business, the cost justification of security products and services, and retail accounting. he is the principal of retail consulting partners, llc (www.retailconsultingllc.com), a firm that provides strategic and tactical guidance in retail security equipment procurement. dilonardo can be reached at 727-709-6961 or by email at rdilonar@tampabay.rr.com.

Once a year I try to leave the safety and comfort of conventional topics, like theft trends and anti-shoplifting countermeasures, to travel to the outer edge of the criminal universe—the invisible world of cyberspace. The catalyst this year is a list of cyber-security threats contained in a report entitled 2011 Threat Predictions, published by McAfee (www.mcafee.com) and some interesting blog comments made by Bob Sullivan, who covers Internet scams and consumer fraud for MSNBC (www.redtape. msnbc.com). Some of these threats have direct and serious implications for retailers and their customers. Others are just downright scary.

Exploiting Social Media

The use of abbreviated URLs on sites like Twitter makes it easy for cyber criminals to mask and direct users to malicious websites. Websites with shortened URLs are growing at the rate of 3,000 per minute, so McAfee expects to see a growing number used for spam, scamming, and other activities.

Friend-finding sites (geolocation services), such as Facebook Places, Gowalla, and foursquare, are prime targets of cyber criminals who use the available personal information to craft targeted attacks on individuals. Malicious content disguised as personal messages or emails, ostensibly from “friends” found on social networking sites, are expected to increase exponentially.

Retailers are beginning to exploit the social networking sites. Did you know that Victoria’s Secret has over 10 million Facebook friends, Starbuck’s has over 18 million, and Coca-Cola has about 20 million friends? It is relatively easy for hackers to commandeer personal information, and send out an email from a friend promising a chance for a free iPod or a discount coupon in the name of a favorite store.

Threats to Mobile Devices

Currently, about 50 percent of mobile phones in the U.S. are web-browser enabled. The advent of the iPhone and Android, with their open application environments, has created an opportunity for hackers. The most recent example is a story about new malware residing on game apps for the Android operating system, intended to collect personal information from those downloading the games. TVs, DVD players, iPads, and even some kitchen appliances are now comparably equipped. Analysts predict that about 50 million tablet PCs with Apple’s or Google’s operating system will be sold in 2011. Currently, the market for tablet-based antivirus software is virtually nonexistent.

Hacktivisim and Cyber Sabotage

The term hacktivisim is defined as “digital cultural jamming and electronic civil disobedience” or “politically motivated computer crime.” Before either definition is chiseled in stone, the legal fate of Julian Assange, the infamous WikiLeaks leader and Time magazine’s runner-up man of the year, must be established. The McAfee report predicts that hacktivisim will become more organized and strategic by incorporating social networks into the process.

There were two major cyber sabotage events in 2010— Operation Aurora and Stuxnet. Both incidents made big news. Operation Aurora was the highly sophisticated attack on Google’s intellectual property, emanating from China. Google wasn’t the only target. Databases from twenty other large multinational companies were similarly breached. There is still some debate over whether or not the Chinese government had a hand in the exercise.

The Stuxnet worm virus was aimed at computer systems that monitor and control industrial processes, including utilities using nuclear power. In November Iran acknowledged that the virus caused problems for a limited number of the country’s centrifuges. As of this writing, no one yet knows who created the virus, but the specialized knowledge required to write it is available only to a few organizations and governments. McAfee warns that companies of all sizes that have any involvement in national security or major global economic activities should expect to be under attack.

Cyber attacks require defensive measures, and might actually provoke responses. The Pentagon is spending $150 million this fiscal year on a new command to lead cyber-war efforts, which are aimed principally at defending military computer networks or attacking those of the enemy. “The United States has powerful offensive capabilities in cyberspace,” says Herbert Lin, an analyst at the National Academies, which advises the government on science and technology issues. “The question is how they should be using them?”

The German government recently announced that it would fund and build a National Cyber-Defense Center in 2011, and Britain announced a similar program. As of now, there has

been no Geneva Convention-type agreement to frame a set of rules of cyber warfare engagement. The United Nations has established the International Telecommunications Union with a cyber-arms treaty as its primary mission. The idea is to develop a code of conduct banning behavior opposed by all member countries.

Evasive Action

My early childhood was framed by frequent Civil Defense exercises at home and at school, advertisements advocating bomb shelters, and regular talk of a nuclear holocaust. I won’t be afraid if the retaliations in a cyber war are confined to armies of hackers slicing each other’s databases to cyber pieces. But, the breaching of Iran’s nuclear development program should raise everyone’s anxiety level high enough so that our IT security brethren take immediate evasive cyber action.

U.S. Cargo Theft Studies Identifies Two-Year Trends

Import cargo volume at the nation’s major retail container ports has increased for the past fourteen consecutive months, evidence that the economic recovery is continuing. The Global Port Tracker, produced by the National Retail Federation and Hackett Associates, estimates in its most recent report that U.S. ports will handle 7.5 million twenty-foot standard intermodal containers of freight in the first half of 2011. The typical container has 1,170 cubic feet of space and can hold between eight and fourteen pallets of merchandise, depending upon the pallet dimensions. That’s a lot of apparel, iPads, or pharmaceuticals. This presents many questions: ■ How much of this stuff gets stolen in transit? ■ Are there any discernable theft trends or correlations? ■ Is there any information out there that will help us get a handle on the severity of the problem?

CargoNet Study

The property/casualty insurance risk industry has started to focus on U.S. cargo theft and has published a very interesting study that provides an analysis of more than 1,700 incidents occurring in 2009 and 2010. CargoNet, a cargo-theft prevention and recovery network, has collected and analyzed cargo-theft incident data beginning in January 2009. The study provides a wealth of specific and correlative information, including theft incident date, location, and time; cargo origin and destination; stolen commodity type; comparatives between 2009 and 2010; and trending data. The report can be downloaded for free at www.cargonet.com. Following are some of the highlights.

Increased Incidents—The total number of theft incidents increased by 48 percent to 1,035 in 2010, compared to 700 in 2009. Unfortunately, the analysts are able to collect only about 60 percent of the loss-value data, due to the reluctance of cargo owners to disclose this information.

Cargo at Rest Is Cargo at Risk—The analysis identified a weekend pattern of incidents taking place on Friday, Saturday, Sunday, and Monday. The analysts believe that this phenomenon could be caused by common freight booking practices in which shipments are promised at the beginning of the week. The freight is loaded on trailers on Friday, but remains parked in terminal yards over the weekend. Long-distance cargo deliveries of more than 450 miles are more vulnerable to cargo theft because of the increased number of driver rest and refueling stops at unsecured truck stops or other locations along U.S. highways.

Stolen Retail Merchandise—During 2010 there was a significant increase in retail activity, especially during late November. Of the eleven major commodities suffering major losses, five were considered retail-oriented and accounted for 47 percent of the theft incidents: ■ Electronics (17% of theft incidents), ■ Prepared foodstuffs and beverages (13%), ■ Apparel and accessories (10%), ■ Personal care and beauty (4%), and ■ Pharma (3%).

There were a couple of interesting anomalies. Analysts acknowledged that consumer demand drives black-market supply. But, “the most-targeted commodity does not necessarily suffer the highest aggregate loss in terms of dollar value. For example, electronics were the number-one stolen item in 2010, but the dollar value of pharmaceuticals stolen was greater.”

In the other example, loss-value is not positively related to the number of thefts, due to the wide variance in the value of a load. For example, a truck full of pharmaceuticals could be 50 times the value of the same size load of apparel.

High-Cargo Concentrations—Cargo theft incidents are positively correlated with proximity to high cargo concentrations, such as ports. Three California container ports account for 50 percent of the cargo volume moving through the top ten ports in the country. It should be no surprise to find that California led the nation in cargo theft incidents with over 300 in 2010.

Volume—Import volume is correlated to theft incidents. Greater cargo availability increases thieves’ success rate. This point is buttressed by the finding that cargo-theft incidents are also correlated to the retail inventory stocking cycles around major shopping periods.

FreightWatch Data

FreightWatch International USA (www.freightwatchintl.com) also tracks cargo freight incidents internationally. Unlike the CargoNet report, this data shows that the average value of stolen goods per load is about $475,000, which is down from a peak of $572,800 in 2009.

Its data also shows that violence is involved in only about 2 percent of U.S. cargo thefts. In contrast 71 percent of Mexico’s incidents were violent. Mexico, Brazil, South Africa, the U.S., Russia, India, and the U.K. are at the greatest risk of cargo thefts.

Echoing the data from CargoNet, the vast majority of U.S. incidents in the FreightWatch study occur while the cargo is at rest in truck stops, unsecured lots or terminals, public access parking lots, and roadside areas.