Connect with us

Expert Speak

How Can Unified Physical Security Can Help Retailers Thrive in a Changing Environment?



Written by Firas Jadallah, Regional Director, Middle East, and Africa at Genetec

The retail industry has evolved dramatically over a relatively short period. Today, digital transformation has unlocked the creation of new innovative business models centered on frictionless, multi-channel shopping and e-commerce while simultaneously presenting new security challenges. In addition, it’s worth noting that digitization has also facilitated innovation in video surveillance technologies, creating new opportunities for retailers to use data from video management systems (VMS) in conjunction with data from access control systems (ACS), automatic license plate readers (ALPR), identity management systems (IMS), sensors, and more.

The key objectives are not only to reduce shrink but also to improve operational efficiency and the overall buyer experience. However, without a fully unified software solution, it is difficult to comprehend how these data puzzle pieces fit together and make sense. Only when retailers are able to consolidate data from multiple sources, can they gain a comprehensive understanding of their environment. A unified physical security platform that allows for the integration of devices and applications, will successfully create a connected store, which centralizes the management of the entire environment for improved visibility, operations, and data intelligence.

How Retailers Can Benefit from Unification:

Frictionless shopping
The introduction of frictionless shopping solutions such as curbside pickup and self-checkout has presented retail security teams with new challenges. Unified security platforms provide a variety of solutions to overcome these challenges. If theft is suspected, asset protection managers can easily review the video of self-checkout systems and share it with law enforcement as necessary. Unified security platforms also enable IT teams, to devote their time to higher-priority tasks and spend less time on software updates. Similarly, a comprehensive view of the connected store allows corporate security managers to work more effectively and efficiently.

E-commerce and logistics
In 2021, e-commerce sales in the UAE surpassed US$4.8 billion, up from US$2.6 billion in 2019, due to the pandemic-enabled acceleration of the global shift towards online shopping. According to an analysis by the Dubai Chamber of Commerce, the value of the UAE’s e-commerce market is expected to reach $9.2 billion by 2026. This exponential growth of the e-commerce market has given rise to new security concerns and a demand for inventory management logistics at distribution centers.

These centers are often frequented by a large number of non-regular employees, as coordinating the delivery of packages involves multiple parties. Here, ALPR technologies can play a crucial role in tracking who enters and exits distribution centers, and in retail locations, they can record who has received products from a curbside pickup station. ALPR solutions can also assist in identifying Organized Retail Crime (ORC) suspects by determining whether a vehicle has been involved in previous thefts.

Supply chain management is another area in which retail security technologies can play a focal role in overcoming challenges. Retailers can significantly reduce losses by utilizing article tags and video surveillance to monitor their environment and track individual products from suppliers to the warehouse, to the store.

Shrink encompasses numerous forms of loss, but it is primarily caused by external theft, such as organized retail crime (ORC). A recent report by Sensormatic estimates that the annual global retail sales loss due to shrinkage amounts to US$99.56 billion. Aside from the loss of goods, in some cases, retailers are also having to contend with violent altercations with thieves. Retailers are implementing a variety of technologies to combat ORC, including artificial intelligence-based video analytics at point-of-sale (POS)/self-checkout, self-service locking cases, autonomous security robots, and automatic license plate recognition (ALPR), in addition to establishing specialized ORC teams.

Cybersecurity threats such as fraud, account takeovers, malware, ransomware, compromised business emails, and data breaches pose escalating risks for retailers today. Any device connected to a retailer’s network, be it a smart IoT thermostat, an access control sensor, or a computer, has the potential to serve as a gateway for cybercriminals to gain access to private data stored on servers connected to that network. Due to the interconnected nature of modern technology, data must be secured and monitored at every stage.

When multiple solutions that were not designed to work together are implemented, it can be challenging for teams to manage, maintain, and scale. A unified security platform designed with cybersecurity in mind enables retailers to secure their entire IT infrastructure and mitigate network intrusion risks through one of their security devices. A unified security platform designed with cybersecurity in mind enables retailers to secure their entire IT infrastructure and mitigate network intrusion risks through one of their security devices.

Advancing Video Surveillance
The vast improvement in video camera quality and cost reductions over the last year have made video surveillance an essential component of retail security solutions. Furthermore, the digitization and automation of video technologies have further improved their value by transferring mundane tasks from humans to machines. Although adding video surveillance can address some of the challenges posed by frictionless shopping, it can also introduce new ones.

These surveillance systems can accumulate vast volumes of footage, which retailers must then store while also making sense of it. A unified system enables retailers to manage data from all cameras, as well as data from access control and ALPR systems, sensors, smart devices, and maps, through a single, intuitive dashboard. In addition, cross-referencing video footage with additional analytic data can yield insightful results.

These tools can provide invaluable insights into the customer’s journey through the store and at checkout, thereby enabling retailers to enhance their customer’s shopping experience.

Hybrid Cloud Solutions
Cloud-based systems make it efficient for retailers to scale storage requirements as the business environment evolves. However, overhauling an entire IT system all at once is a daunting undertaking. As stores are upgraded or retrofitted, retailers can take advantage of new technologies and functionalities by connecting IoT devices. A hybrid cloud strategy enables retailers to continue operating on-premises systems that meet current requirements while integrating them with adaptable cloud technologies. For companies with a combination of new stores that utilize cloud-based systems and established locations with on-premises systems, support of a hybrid cloud approach through a unified platform enables them to manage the data from all of them in one place.

Insights and Efficiency
When physical security systems are siloed, it is challenging to extract the full value of the data collected by each system. By leveraging a unified, connected store, retailers can combine and display data from all of their security systems in a variety of formats, including customized dashboards, graphical maps, mobile applications, and web clients.

When data is centralized, new insights become apparent. Modern physical security systems allow retailers to personalize dashboards that display data that is most pertinent to specific users. Each department, from asset protection to marketing, will have a unique perspective on data and offer a variety of solutions. Here, interdepartmental collaboration can be essential to the development of new strategies. Moreover, unified security platforms enable retailers to scale, regardless of whether they are opening their first physical store or expanding their global brand to hundreds of locations.

Unified security platforms can be easily deployed and integrated with video surveillance, access control, ALPR, and more. Starting with an open, unified security platform allows retailers to maximize the value of the devices and equipment they already possess, utilizing data in novel ways to streamline operations and gain insights. They can deliver an optimal customer experience without sacrificing security or negatively impacting their bottom line. Everything begins with integration – a connected store for the omnichannel world.

Expert Speak

How Taking a DevSecOps Approach Makes Security an Accelerator Rather Than an Inhibitor of Innovation



Written by James Harvey, CTO Advisor, EMEA, Cisco AppDynamics

Security teams have traditionally operated separately from the rest of the IT department and the prevailing perception is that security is a reactive function, brought in to resolve security breaches and patch up vulnerabilities. But the Achilles heel of this siloed approach is being dramatically exposed as the attack surface expands, as the speed of application development continues to soar and we see accelerated adoption of dynamic, cloud-native technologies.

In response, IT departments need to take a different approach to application security and move to a DevSecOps approach, where security is integrated into the applications lifecycle from the outset, rather than being an afterthought at the end of the development pipeline. DevSecOps requires new tools and technologies but, most of all, it requires cultural change, with closer collaboration between teams. As such, technologists need to change their mindsets around security and recognize that, with the right approach, security can lead to faster and more sustainable innovation, rather than slowing it down.

Siloed approach exposes application security vulnerabilities
As organisations have ramped up their digital transformation plans, in response to changing customer needs and to enable hybrid work, application release velocity has skyrocketed. Unfortunately, however, application security hasn’t kept pace. In the latest research from Cisco AppDynamics, The shift to a security approach for the full application stack’, all surveyed technologists from the United Arab Emirates (UAE) admitted that the rush to rapidly innovate during the pandemic came at the expense of robust application security.

Much of this can be attributed to fragmented structures and working practices, where ITOps and security teams operate in silos. The only time any form of collaboration occurs is often when a potential issue is identified — which is arguably too late. Developers don’t seek out input from security colleagues because they fear it will slow release velocity. Indeed, the research found that 71% of technologists across the Emirates perceived security to be more of an inhibitor than an enabler of innovation within their organisation.

Until now, IT departments have largely been able to get away with this siloed approach. But as organizations have accelerated release velocity and built more dynamic applications using low-code and no-code platforms, technologists suddenly find themselves trying to manage a dramatic expansion in attack surfaces. Widespread adoption of multi-cloud environments means that application components are increasingly running on a mix of platforms and on-premise databases, and this is exposing visibility gaps and increasing the risk of a security event. The potential consequences are catastrophic for both the customer experience and the bottom line.

Minimize risk and accelerate innovation with a DevSecOps approach
Faced with this growing challenge, IT leaders are recognizing the need for much tighter collaboration between teams and a more proactive approach to application security. DevSecOps brings together ITOps and SecOps teams so that application security and compliance testing are incorporated into every stage of the application lifecycle, from planning to shipping. By taking this approach, developers can embed robust security into every line of code, resulting in more secure applications and easier security management, before, during, and after release.

IT departments can avoid the current situation where security vulnerabilities are only addressed at the last minute before launch or identified after the application has already been released. By incorporating security testing from the outset of the development process, security teams can analyze and assess security risks and priorities, during planning phases, to lay the foundation for smooth development.

DevSecOps relies on the implementation of holistic monitoring systems which leverage Artificial Intelligence (AI) and Machine Learning technologies within application security processes, to cope with the spiraling volumes of security threats organizations are facing. This type of automation is vital to identify weaknesses, predicting future vulnerabilities, and remediating issues. Once IT teams can teach AI tools to identify threats and resolve them independent of an admin, benefits, from reduced human error and increased efficiency to greater agility in development, are sure to follow.

There is now a widespread realization that DevSecOps is the best way for organizations to cope with increasing cybersecurity risk, without sacrificing development speeds. This is validated by the research which found that 82% of UAE-based technologists now regard a DevSecOps approach as critical for their organization to effectively protect against a multi-staged security attack on the full application stack. Not surprisingly, 49% of organizations in the UAE have already started taking a DevSecOps approach and a further 48% are considering making the shift.

Ultimately, DevSecOps will see security become an accelerator for innovation, rather than an inhibitor. By taking a proactive approach to security throughout the lifecycle of their applications, technologists in the region will spend less time trying to identify and resolve issues, and more time on strategic activities based on business needs. And this means that IT teams will be able to ship and deploy applications more quickly.

Continue Reading

Expert Speak

How SMBs Can Prepare for Identity-Based Attacks in 2023



Written by Michael Sentonas, CTO at CrowdStrike

The cybersecurity threat to small- and medium-sized businesses (SMBs) continues to grow as cybercriminals recognize both how vulnerable they can be and the potential value of the data they have. It is critical for SMBs to be aware of the threats they’ll face and how to defend against them. SMB breaches don’t often make headlines, which has led many to believe they fly under attackers’ radars.

In reality, they are among the lowest-hanging fruit for threat actors to exploit — and the data shows cybercriminals are taking advantage: 76% of SMBs surveyed in a 2022 study were affected by at least one cyberattack in 2021, an increase from 55% who said the same in 2020. Sixty-three percent of SMBs surveyed in a separate report say they face increasingly advanced cyberthreats, including ransomware and identity-based attacks (2022 CrowdStrike SMB Survey).

These threats arrive in many forms. The 2022 Verizon DBIR found system intrusion, social engineering and privilege misuse represent 98% of breaches affecting small businesses; further, credentials made up 93% of data compromised in SMB attacks. Over time, more organizations fear they’ll be the next target: a CNBC survey of 2,000+ small business owners found 61% of small businesses with 50+ employees are concerned they’ll be hit with a cyberattack within a year.

Cyberattacks can create significant financial pressure on SMBs, which is a huge concern in a tough macroeconomic climate. A recent survey found that 60% of SMB victims closed their doors within 6 months of an attack. While many SMBs are familiar with malware and may have installed what they perceive as “good enough” security such as basic antivirus software to combat these kinds of attacks, the reality is the threat landscape is much more complex and sophisticated than it used to be. Cybercriminals continue to evolve their strategies at a breakneck pace to bypass traditional security tools, making traditional AV systems increasingly less effective in protecting SMBs.

Many adversaries employ human-engineered methods to break into businesses of all sizes. Throughout 2022, there has been an increase in identity-based attacks and the development of sophisticated file-less techniques bypassing traditional multi-factor authentication defences.

Adversaries are going beyond credential theft, instead using techniques like pass-the-cookie, golden SAML and social engineering with MFA fatigue to compromise identities. According to 2022 CrowdStrike threat data, 71% of breaches forgo malware entirely to evade legacy antivirus software searching for known file- and signature-based malware.

The evolution in adversary techniques shows no sign of slowing in 2023, but with limited budgets and staff, it is imperative SMBs make the most of their resources and time to stay toe-to-toe with even the most advanced adversaries.

A good offence is a great defence. SMBs should think beyond threat detection to focus on threat prevention as well. Many SMBs opt for a managed services approach to augment limited time, resources and expertise. In addition, the following best practices can have a tremendous impact on the strength of your defences:

  • Educate your employees: Your entire workforce should be aware of the types of security threats and social engineering attacks they face at work, such as phishing, smishing, honey trapping and more.
  • Enforce multi-factor authentication (MFA): As identity becomes a critical component to cyberattacks, MFA provides an extra layer of defence so you can be sure it’s an employee and not an attacker, gaining access to systems and resources.
  • Perform regular backups of critical data: If a breach hits your small business, you’ll be glad you backed up your data in the cloud. The cloud provides better accessibility and visibility into data backups, along with faster execution that further minimizes downtime. It’s worth noting an attacker may encrypt backups if they gain access to your systems, so it’s critical to create a strong defence.
  • Keep up with software patches: Data breaches often start when an attacker exploits an unpatched vulnerability. Keeping software up-to-date ensures this vector is blocked. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has an updated list of known exploited security flaws.
  • Lock down your cloud environments: Protect your cloud drives (such as Box or Google Drive) by implementing MFA and adhering to the principle of least privilege, which ensures employees only have access to the resources they need for their jobs.
  • Implement and test your threat detection and response: Make time to analyze your environment and user behaviours for malicious or abnormal activities. Stay current on threat actors, tradecraft and indicators of attack. Define, document and test what a successful incident response looks like. Plan for the “when,” not the “if.

Once you’ve covered the basics, consider intel-driven defence to support detection and response. Understanding threat actors does not need to be complex or time-consuming, as long as the right threat intelligence is available. Attribution enables security teams to understand their true risk posture by defining who could come after them and how and adjust their security strategy based on these facts.

Cybersecurity is a big challenge for SMBs, but it is possible to build a strong security posture and protect your environment from today’s threats — even with limited resources. Rethinking your security strategy and upgrading your defences now can make a tremendous difference in getting through a cyberattack if – or when – disaster strikes.

Continue Reading

Cyber Security

ChatGPT is Being Used for Cyber Attacks



Check Point Research (CPR) is seeing the first instances of cybercriminals using ChatGPT to develop malicious tools. In underground hacking forums, threat actors are creating infostealers, encryption tools and facilitating fraud activity. CPR warns of the fast-growing interest in ChatGPT by cybercriminals and shares three recent cases, with screenshots, of the development and sharing of malicious tools using ChatGPT.

Case 1: Threat actor recreates malware strains for an infostealer
Case 2: Threat actor creates multi-layer encryption tool
Case 3: Threat actor shows how to create a Dark Web marketplace script for trading illegal goods using ChatGPT

CPR is sharing three cases of recent observations to warn the public of the growing interest by cybercriminals in ChatGPT to scale and teach the malicious activity.

Case 1: Creating Infostealer

Figure 1. Cybercriminal showing how he created infostealer using ChatGPT

On December 29, 2022, a thread named “ChatGPT – Benefits of Malware” appeared on a popular underground hacking forum. The publisher of the thread disclosed that he was experimenting with ChatGPT to recreate malware strains and techniques described in research publications and write-ups about common malware.

In actuality, whilst this individual could be a tech-oriented threat actor, these posts seemed to be demonstrating less technically capable cybercriminals how to utilise ChatGPT for malicious purposes, with real examples they can immediately use.

Case 2: Creating a Multi-Layered Encryption Tool

Figure 2. Cybercriminal dubbed USDoD posts multi-layer encryption tool

On December 21, 2022, a threat actor dubbed USDoD posted a Python script, which he emphasized was the ‘first script he ever created’. When another cybercriminal commented that the style of the code resembles openAI code, USDoD confirmed that the OpenAI gave him a “nice [helping] hand to finish the script with a nice scope.”

Figure 3. Confirmation that the multi-layer encryption tool was created using Open AI

This could mean that potential cybercriminals who have little to no development skills at all, could leverage ChatGPT to develop malicious tools and become a fully-fledged cybercriminals with technical capabilities.

All of the aforementioned code can of course be used in a benign fashion. However, this script can easily be modified to encrypt someone’s machine completely without any user interaction. For example, it can potentially turn the code into ransomware if the script and syntax problems are fixed.

Case 3: Facilitating ChatGPT for Fraud Activity

Figure 4. Threat actor using ChatGPT to create DarkWeb Market scripts

A cybercriminal shows how to create a Dark Web marketplace scripts using ChatGPT. The marketplace’s main role in the underground illicit economy is to provide a platform for the automated trade of illegal or stolen goods like stolen accounts or payment cards, malware, or even drugs and ammunition, with all payments in cryptocurrencies.

Figure 5. Multiple threads in the underground forums on how to use ChatGPT for fraud activity

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software, says, “Cybercriminals are finding ChatGPT attractive. In recent weeks, we’re seeing evidence of hackers starting to use it to write malicious code. ChatGPT has the potential to speed up the process for hackers by giving them a good starting point. Just as ChatGPT can be used for good to assist developers in writing code, it can also be used for malicious purposes. Although the tools that we analyze in this report are pretty basic, it’s only a matter of time until more sophisticated threat actors enhance the way they use AI-based tools. CPR will continue to investigate ChatGPT-related cybercrime in the weeks ahead.”

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.