LPRC - CrimeScience – The Weekly Review – Episode 85 with Dr. Read Hayes, Tom Meehan & Tony D’Onofrio

Episode Date: December 23, 2021

Omicron Variant is Spreading Fast! In this week’s episode, our co-hosts discuss LPRC Kickoff on Jan 19th in NY, 2017 Predictions: Did they really come true?, 10 Security Mega Trends for 2022, Continuation of Last Weeks Largest Cyber Vulnerability Conversation, and Myths and Misconceptions of Cyber Security. Listen in to stay updated on hot topics in the industry and more! The post CrimeScience – The Weekly Review – Episode 85 with Dr. Read Hayes, Tom Meehan & Tony D’Onofrio appeared first on Loss Prevention Research Council.

Hi, everyone, and welcome to Crime Science. In this podcast, we explore the science of crime and the practical application of this science for loss prevention and asset protection practitioners, as well as other professionals. We would like to thank Bosch for making this episode possible. Take advantage of the advanced video capabilities offered by Bosch to help reduce your shrink risk. Integrate video recordings with point-of-s sale data for visual verification of transactions and exception reporting. Use video analytics for immediate notification of important AP related events and leverage analytics metadata for fast forensic searches for evidence and to

improve merchandising and operations. Learn more about extending your video system beyond simple surveillance in zones one through four of LPRC's zones of influence by visiting Bosch online at boschsecurity.com. Welcome, everybody, to another episode of Crime Science, the podcast from LPRC. This is the latest in our weekly update series and joined by co-hosts Tom Meehan and Tony D'Onofrio and our producer Diego Rodriguez. And we'll take a kind of a swift look around the globe here at what's going on. And just before recording, we were talking about what's going to happen with the Omicron. And of course, everybody's monitoring hospitalizations, particularly serious ones, sort of critical care, ICU type admissions and treatment for COVID-19 versus infections and infection rates,

particularly because so few people are being tested evidently as a rate as compared to months ago, as well as the subclinical infections, which we saw before, the asymptomatic infections are very, very low, mild symptoms that may seem to characterize this latest version of the coronavirus called COVID-19. So if it turns out that there's a fair amount of infections, that's one thing, but there's a very low rate of serious disease in part because it's just the virus itself. And we've talked about this in the past. The virus's job is to viral, to go viral and to reproduce.

And if it kills the host, um, or inhibits the host so much that the host can infect other humans, in this case, that's not good for the virus. It's not spreading. So the, the idea is that, uh, using some kind of logic, if you will, that, you know, that's not good for the virus. It's not spreading. So the idea is that using some kind of logic, if you will, that that's how the successful virus is. It makes you just sick enough to spread it to somebody else so it can keep going. It doesn't want to hurt or kill you. So we'll have to stay tuned and see what happens. We're still between six and 800,000 Americans alone that have died. And they believe by and large from COVID-19 or in large part because of COVID-19.

So it's a very serious disease for some of us. We're also looking at, you know, as far as the National Retail Federation, the NRF big show coming up in that second week in January. Most of us are scheduled to be there to even present. LPRC kickoff, of course, is scheduled to be there, hosted by Bloomingdale's at their flagship store on that January 19th from 8.30 to 12.30. But what's all that look like? We're wondering now, since the Omicron seems to be spreading pretty rapidly, particularly in the New York area, will that have peaked and passed to a certain extent waned, or is it set to peak then? Those are those kinds of questions in mid-January.

Here we are in late to middle December, so it may give some time for that type of progression and allow the conference to go forward as stated. But who knows what attendance will be like. Normally tens of tens of thousands of people, a lot of excitement, energy, looking forward to it. So we'll have to see how that goes. It looks like there are, it's really particularly interesting, a lot of science around

how many SARS-CoV-2 infections are asymptomatic, you know, at least subclinical, just almost non-detectable that there is, that you are infected. I myself get tested frequently at the University of Florida. I'd kind of started not doing it so much like everybody else then started doing it. I felt a little funny the other day. I went through my routine test, nothing. So, you know, because you're hearing these mild symptoms. And so I just felt, you know, kind of off for a day. And that was sort of it.

So it wasn't, but it turns out it was not SARS-CoV-2. sort of it. So it wasn't, but it turns out it was not SARS-CoV-2. There's on the therapy side, another malaria drug that's showing progress. And so we'll stay tuned to that. So you're seeing more and more drugs that are coming out of different types of testing that look fairly promising for either stopping the spread within our bodies, replication, slowing it down, purging it. There's all these different modes or mechanisms of action there. We're seeing, too, you look at the data. We just talked a little bit about the low symptoms potentially here with Omicron,

which, by the way, has now been reported by the who anyway in over 89 countries and that just gives all of us an idea of how rapidly how rapidly this particular variant has spread around the world but south africa who was where we really started hearing this it was one the first to really sequence and learn about the this new variant and a lot about the mutations that occurred. Over 50 we've learned and talked about prior, but they also have seen their hospitalization rate plunge at the same time as infections have risen. So we're hoping that these are all good signs that this is where some virologists and epidemiologists were talking about even at the beginning of 2020 or mid-2020, that really this is the type of virus, like different strains of

influenza, that become, as they call it, endemic, where it's an annual occurrence. It spreads throughout the population, depending on exposure and the health of the person, and then again, population depending on exposure and the health of the person, and then again, vaccination. So annual flu vaccines, annual different types of vaccines, you might see this annual or biannual even, we don't know yet, coronavirus vaccine. At this point, you know, we know that there's 100 billion humans have been vaccinated with relatively few, almost none. As far as the side effects, they're extremely serious. There are those. And if you're one of those or any of us are that serious to those that are loved ones,

but we're talking about thousands compared to billions. And so we'll have to stay tuned versus we know with the actual viral infection, it's more serious. So they're looking at different types of AI that are helping detect more rapidly. We've heard of dogs that can sense the infection and all these types of things to look at. They're also, I've seen more research on, is this a respiratory virus or not? It seems to be some scientists are arguing and physicians that it's more of a platelet, um, disease than it is a lung tissue disease. And that's why there are these effects, um, in our brain sometimes with the loss of, or

changes in sense of, of taste and smell, different bleeding episodes, some of the cardiac effects that are there from the coronavirus and so on. So those types of testing, that type of research, that type of science brings the implications around what we need to do about it. So that's part of what we're looking at when we look at the science here. And that's why some of the neurons that are affected by COVID do threaten some people's brains because it's a platelet disease rather than a respiratory. But the platelet, again, brings the implications for new vaccine strains. And we see now at this point, there's still around 110 vaccine candidates,

in addition to the couple dozen that are already out there in emergency use or full use authorization because of the testing. So you're going to see those that affect different ways, affect our bodies and the virus and so forth. Again, at the end of the day, and all the testing that's gone on, the vaccine still makes those of us that become infected less likely to get serious disease. That was always the intention, rather than reduction in infection, which would be a nice goal. And so we're hoping that of the follow-on 100 plus that are already in human clinical trials, that one or more of those might help us provide more infection protection in addition to serious disease from infection. So another study we just saw that Omicron affects 70 times faster than any other

strain, even Delta plus. So we can see it's just very, very infectious, more, more microns evidently, or more particles. And then we talked about how it seems to more readily attach and more rapidly spread and things like that than other ones. So it's interesting to understand why a person might become infected versus from a load or inoculum, an onboarding of some of these particles in another strain that we've seen prior to this. And there have been multiple studies about why this is going on. So I think we talked about the LPRC and what's coming up here. With the kickoff, again, January 19th, if all holds firm from 8.30 to 12.30, reach out to operations at lpresearch.org to register. It's open to all LPRC members, solution partners, and retailers alike. Again, we've got about 110 person limit right now, just because the space that we

have available. And Diego informs us that we're between 80 and 90 registrants already. So we anticipate blowing past that number. But again, as concerns about the Omicron version and so on around there, that may dampen the attendance or cause us to alter our plans completely. So who knows anymore? The Ignite, again, right now, the LPRC Ignite Winter Planning Meeting is scheduled for Gainesville, Florida on campus. And that would be right now in the February 16th time range. And again, for more information or to register for that as an LPRC leader member, then that's again at operations at lpresearch.org. We continue to have some stellar visitors in here.

We've talked about we had the top LPAP decision makers, including Chief Security Officer from Verizon Global, CVS, others, several more are scheduled in. So we're excited to be engaging with so many top leaders as we go through this wild and zany 2021 now into 2022. We've got some new researchers joining our team. We're excited about that. Very excited. We'll have our largest and actually most trained research team in the history, the 21-year

history of the LPRC by mid-February of 2022. So a lot of exciting things happening, and stay tuned. So if I might, I'll head over to friend and colleague Tony D'Onofrio. And Tony, if you can kind of fill us in on everything you're learning and what we need to do. Thank you very much, Reid. Great updates both on COVID and what's happening to the LPRC. And I'm looking forward to all those upcoming events. So this week, I'm going to go on two topics.

One, I'm going to start with the NRF, which just issued an update to their predictions that they made back in 2017. And how many of those predictions actually came through? So from NRF, their number one prediction was machine learning will revolutionize retail. And the reality, according to their article, is that while it's been five years since NRF called that out, companies are still wrestling with the capabilities of machine learning and AI. Recent Gartner reports found that 85% of artificial intelligence and machine learning projects fail to deliver on objectives. Only 53% make it to prototype and production. Their second prediction was no silos for retailers or boundaries or channels.

The biggest challenge they saw back then is ensuring, and they see that today also, is ensuring consistent experience across all those channels. The update is that shoppers emerged from only two years of drinking from our five higher holds of digital commerce interaction. They are looking to retailers to deliver somewhat different experiences in their physical stores. And consumers still won't tolerate excuses about desperate systems

that don't sync or lack inventory transparency, much as we said five years ago. The third prediction was bet on bots and conformational commerce. That was a bold statement in 2017, but it turns out we nailed it. Conversational commerce technology has enjoyed a meteoric rise of 400% since 2017. In addition, the percentage of customers who have daily interactions with chatbots has risen by nearly 40% from 2018-2020 in the U.S. By 2025, the chatbot market is expected to hit $102 billion. The next prediction is out-of-the-box collaboration. That also did happen. 2020 opened to a plethora of unlikely collaboration.

No one has foreseen. Albertson, for example, partnered with 17 companies to offer part-time employment to otherwise furloughed staff. And DSW partner with Hy-Vee to offer footwear on the supermarket website and provide buy online, pick up in store services. Next prediction, time to tune in to TV shopping. It's fair to say they missed this one. Live shopping is coming, but it's coming very slow. Live shopping on Facebook and Instagram is starting to gain some steam. Macy's, Ulta Beauty, and we already all announced live stream sessions during the holiday. And Walmart said that they would host 30 live streaming events before the end of the year,

but it is slow and it's late from 2017. Next prediction, social commerce will gain attention and investment. Just last month, Inc. Magazine reported that social commerce generated approximately $475 billion in revenue in 2020, representing a 40% increase. Businesses of all sizes are finding that social commerce is not a competitor to e-commerce. It's just an extension. And the final prediction they made back in 2017, one-click payments nearly ready for

prime time. They are coming, but they're coming again, slow. Payment networks, including American Express, Visa, MasterCard, and Discover didn't roll out until the end of 2019. So the way they summarize the article is ultimately our ability to protect what was in the cards for retail in 2017 was equivalent to a full house in poker, not four of a kind and certainly not a straight flush. If yet, if one wagered a bet, they would have done reasonably well. So most of the prediction came true, but some took a lot longer to get there.

And let me close this week with some really interesting insights in terms of what's happening to the security industry. Every year, the Security Industry Association publishes their 10 megatrends that they see in security for the new year. So here are the 10, and this is the sixth year in a row that they've done that. Here are the 10 security megatrends for 2022. Number one is artificial intelligence. It was the same last year.

AI investment for security companies is exploding. When they first did the survey in 2019 on this specific topic, less than 2% said that R&D investments were tied to AI. In 2020, that percentage went up to 3%. But sometime in the last year, in the peak of COVID, what started the number is now raging as a fire investments in AI for security, with 13% of companies saying that all their R&D investments are tied into AI opportunities. Number two, and this one is near and dear to Tom's heart, mega trend for 2022 is cybersecurity.

In the previous year of tracking this benchmark question, SIA found that 2% of the respondents said cybersecurity was never a discussion point. Today, no one says that it's not a discussion point. So it's top of mind of a lot of different folks. While a year ago, cybersecurity discussion were often part of the conversations, 52% of the time. Today, that frequency is up to 62% of the time. So what Tom brings up every week, very valuable, is a mega trend for the security industry in 2022.

is a mega trend for the security industry in 2022. Number three, supply chain assurance. 98% of companies in the industry invest more time and focus in supply chain than they did in pre-pandemic. More than half saying they are giving their supply chain a lot more focus. Number four, service models in the cloud. 50% of data is now stored in the cloud. According to Statista, 98% of companies had at least one cloud data breach in the past 18 months. Number five, workforce development.

37% said that worker shortages would be a factor most likely to impact their business ability to grow in 2022. And that's actually been all over the news on worker shortages. Number six, increase interoperability. In 2030, $108 billion is the predicted market value for smart buildings, IoT, endpoint electronics and communication market up from $55 billion in 2020. Number seven, data privacy. A year ago, only 53% said they often had privacy conversation with customers. Unfortunately, that conversation has actually increased dramatically with that number increasing in subsequent years. Number eight, security as prop tech. Loosely defined prop tech is any technology related to how buildings are

managed and used, and even bought or sold or rented. $9.7 billion is the amount of new funding and prop tech sector attracted just in the first half of 2021. Number nine, expanded intelligence monitoring. Expanded intelligence monitoring of public data services is already common, but companies and service providers are more regularly exploring reaches of the deep web and dark web to identify emerging threats and investigate stolen data. Again, a subject that Tom brings up almost every week. And number 10, the last megatrend for 2022 in security is health and sustainability. The pandemic left an indelible imprint upon security and safety. And while the initial response has been to install security solutions that

limited the need to touch, which could detect fevers, the conversation has expanded much more from those early days. And there's a lot more focus now on safety and security going forward. So those are the 10 mega security trends for 2022. And with that, let me turn it over to Tom. Well, thank you, Tony. And you set me up for a couple of different things today. And I'm going to talk a little about some cybersecurity risk.

And last week, I taped, we all taped individually. And it was the week after the Log4J vulnerability was discovered. So it was the weekend after. So that was that weekend and then we taped on a Tuesday. So we have some more information about arguably the most prolific and damaging vulnerability to ever be disclosed. And I say that with a certainty of at least as long as I can remember, I've never seen anything that is far reaching as log4j. So just to give kind of a high level overview of what it is, is log4j or log4shell, either one that you want to hear about, is a part of an open source Java and Apache code. So JSON, if you hear that, Java or Apache code, that affects literally

hundreds of thousands of software platforms. It's even hard to nail down what it affects. And that's what makes this vulnerability so different than others is normally when we talk about a zero-day vulnerability, it's specific to one operating system or one facet of an operating system. So you'll hear there's a vulnerability and Microsoft patches it and, you know, it solves the Windows vulnerability. Even a web based or a browser based vulnerability is usually a lot narrower than this. And when the reports came out, I actually had a birthday party for my daughter, was kind of unplugged on the weekend and had a very early morning flight as I shared the last week's podcast. And there were hundreds and hundreds of posts and really hundreds of thousands of posts and

hundreds of articles about how the internet was on fire. And this was the most significant vulnerability in years. And today, unfortunately, I'm here to report that I actually think even that was probably an understatement. Basically, what this allows is anybody that uses that code is susceptible to a fairly easy exploit and an exploit that anybody with moderate, even intermediate skills could Anybody with moderate, even intermediate skills could expose and get in and remotely execute code via this exploit. And what's unknown today is all of the different ways that this is being taken advantage of. I took some time because I was traveling all week and took a look at Central Europe, Russia and China. central Europe, Russia, and China, the amount of scans increased by off the charts percentages to try to find this exploit. And to date, what we're seeing mostly is that some of the execution of

malicious code has to do with crypto mining. But the challenge here is that we don't know where it ends and where it starts. And it's really the biggest challenge here is that this open source of code, it affects millions of devices. And it could be a video game systems, corporate systems, really anything that uses this code. I know Amazon web service was running 24 hours a day to fix this.

So for everybody that's listening, and we say it repetitively, I can't stress this more than I've ever stressed it, is take a look at everything that you can update and patch and do it. The unfortunate part here is that the bigger softwares will be easy to patch, but us as everyday users, there'll be vulnerabilities that we don't know about. The companies that may not even be in existence anymore or acquired that really make this challenging. And this is one that my prediction will never go away, quite honestly. It will last for several years is what most cybersecurity experts are predicting, that this is a very, very long tail.

My professional opinion is it'll never fully be eradicated because of the depth that it has. So when you think about Microsoft making a public statement that affected Minecraft, just think of that. Their vulnerability affects literally anything. And then LDAP, which is a type of Active Directory. An Active Directory for the listeners is what we use to get on. Usually it's called something referred to as single sign-on. So if you work for a company and you go on and you sign on to your PC and you use that password and username for multiple things, it's often Active Directory. There are newer versions, but LDAP, which is probably the most common that we would see throughout the industry also is affected.

So the login pieces of most modern computers and this is not, you know, this does not discriminate between OS. So anybody, this can affect a Mac. This can affect anything that uses that JavaScript. So I don't know that we'll talk a lot about it. We'll probably give updates because I don't think the narrative is going to change. There is no silver bullet here. This just reminds us of the importance of protecting ourselves and really making sure that we're patching as much as possible. This is going to be one of those things that I think will outlive most vulnerabilities. And when we talk about Internet of Things devices, and on this podcast, we talk so much about the fact that as we adopt

them, it's important to make sure that when you're buying an Internet of Things device or retailers buying any type of hardware to put into their stores, that you're buying it from a reputable company that has a history so that when something like this happens, you're sure that there'll be a patch available. And I know just in speaking to some of my retail friends and former colleagues that they're starting to realize that there are some systems that they use that are no longer supported that have this vulnerability, which basically means they have to be you know considered end of life and removed because this vulnerability exists to date um the maliciousness of this vulnerability really has not come to fruition it's been cryptocurrency i think um the wall street journal uh cryptocurrency miners sorry i think the wall street journal

talked about the the Defense Ministry being affected. So think of that, you know, that they were they had the effect from this. And then Tony mentioned AI, you know, and he talked about artificial intelligence. One of the challenges with this exploit or this vulnerability today is as we adopt artificial intelligence to automate processes. And I want to just oversimplify this. Artificial intelligence at its core is just replicating human behavior. That's the start at its core. Obviously, machine learning and all these other things make it a lot more advanced. But what the bad guys are doing is they're using artificial intelligence to create bots to replicate human behavior and literally trying to attack this vulnerability by the hundreds of thousands per day with actually no human interaction. So as we adopt AI,

and as we use AI, so do the bad guys to take advantage of us. So rule of story here is to patch and get this patch quickly. I wanted to just switch gears a little bit, still talking about cybersecurity, but towards the end of the year, I generally make predictions and write some articles and I'm working on my trends, cybersecurity, what to expect. And then I wanted to just talk about myths and misconceptions, because I think with related to cybersecurity, I think with COVID, we thought of a lot of things. One of the myths and misconceptions is cybersecurity is all about what the newest technology and the newest software, very much like all the listeners on the podcast, they probably know is that a lot of it's basics.

You know, some of the things that we, from a cybersecurity standpoint that we did 20 years ago, still work using good cybersecurity hygiene. So one of the biggest myths is that I have to have the latest and greatest. And using the patch example is patching software has been since the beginning of time. It's really important to remember that. Another big cybersecurity myth is too much security diminishes productivity. That isn't necessarily the case. If it's managed correctly and you're looking at the balance of what the right amount of cybersecurity is, it doesn't have to diminish

productivity if it's implemented correctly and you're working with your teams. That's one of the big misconceptions that I, even myself, would use to fall into the scheme of thinking that this was too much security and it would slow things down. You can build insecurity features that integrate seamless with your system and processes and policies. This requires a lot of work. Another huge myth, and we talk about it a lot on the podcast, is cybersecurity and cyber attacks only happen from outside. We know that more than 60% of the data breaches, and this number fluctuates, and it has for the last 10 years between 60% and 85%, depending on what survey you do, happens within the four walls of your organization, whether it be from a contractor, a business partner, or an actual employee. not necessarily nefarious in nature, but the bulk, more than half, and I would say it's probably closer to that eight to 10, 80% than the 60% based on all the things I've seen happen from some

side of insider interaction. Access and opportunity is what allows people to take advantage of cybersecurity. Very, very, very similar to all the things that we talk about here with physical security. Access and opportunity are the keys, and lack of supervision is the third pillar of the cybersecurity piece, and that supervision could be human-driven or computer-driven. Cyber security experts often talk about big retailers and banks being targets. talk about big retailers and banks being targets. We know today that that's not necessarily the case. Cyber security affects all of us. And one of the things that's important is that larger businesses, while they have a bigger target, they also have bigger budgets for security. So your small to mid-sized businesses, academic organizations are at just as much of a risk, if not more.

And a recent survey showed that only about 14% of mid-sized businesses were actually prepared for a cybersecurity incident. And then I'll finish up with just two more here. You know, one of the other things is antivirus, any malware and intrusion software is enough to protect you. That's just a piece of the puzzle. It's one of those things, again, I love to relate to the Laws of Intervention Research Council.

It's never one thing. It's a combination of things, and it's generally driven by people, process, and technology. The same in the cybersecurity world. There is no magic bullet. There is no magic pill that you can take. There isn't one piece of software. It is a combination of things that come together. One of the, and I'll round it out with this, and this goes directly to physical security. Cybersecurity is too expensive. The cost

doesn't create an ROI. And this is one of the things in our space that we talk about all the time. Everybody wants to create an ROI and that's obviously what you need to do when you're in a business. Unfortunately, with cybersecurity or security instances, there is a level of avoidance that's needed because the true cost of a cybersecurity incident, much like a physical security incident,

is much more than the financial liability. You have brand reputation, you have resources to build. So a lot of times when you're talking about making a cybersecurity investment, you cannot take that traditional ROI argument of my potential loss as X. You have to think of the actual cost of the solution based on what a successful attack looks like when you take into consideration brand, reputation, downtime, and customer impact. And those are really hard things from a financial standpoint to create an ROI. And then the same things we talk about all the time here that we're on this podcast here is if it was just one equation it'd be very very

easy and then last but certainly not least and I feel like this is the broken record as we talk about COVID and the new variants is there is a rash of bad guys trying to take advantage of the new variants spreading misinformation misinformation, as well as selling new therapeutics online, both on the free web and the dark web. And I think what you'll also see, and I'm gonna not talk about it in detail today, is we're starting to see a rash of arrests and terminations related to fake vaccination cards.

So I think there was 14 reports last week of somewhat prominent individuals and actually, unfortunately, quite a few first responders were listed in that 14. I think nine of them were police and firefighters that used fake vaccination cards to get around the mandate and how unfortunate that is that people are now at that stage. So we continue to see that grow. And we'll monitor that. I think as the variants spike, you start to see a lot more of the folks trying to take

advantage of that, as well as people trying to buy fake vaccination cards and negative test results. If you do a quick search on the internet today, it takes no more than about 10 seconds to find out how you can print a template or buy a fake vaccination card and even buy a fake test that much like the diploma mills were years ago, you can actually verify the test. So there's these websites that are set up to look like urgent care facilities. You go, you buy your fake test for $100, and then you get a verification for that test for four days where someone actually calls in

and someone answers the operator. So as we always say, with any unfortunate situation, there are people that take advantage of it. With that, I will turn it back over to Reid. All right, well, thanks so much, Tom, for all that information. Thank you, Tony. Amazing insights. And I know that we all appreciate you guys spending a lot of time pulling together from

a lot of sources, excellent information. Everybody is so busy these days and the convenience is amazing. So I want to kind of wrap up by everybody stay safe out there. Look us up, lpresearch.org. Get a hold of our team and let us know if you have interest in getting in here to Gainesville or you want to do a Zoom or a Teams call and do a virtual walkthrough of all our labs, the capability, the projects we're working on. But on behalf of the LPRC, this team, I want to thank everybody. Have a safe and happy holiday season. and valuable information at lpresearch.org. The content provided in the Crime Science Podcast is for informational purposes only

and is not a substitute for legal, financial, or other advice. Views expressed by guests of the Crime Science Podcast are those of the authors and do not reflect the opinions or positions of the Loss Prevention Research Council.